<p>I have two clusters.
Kubernetes 1.25 and Openshift 4.11</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: testcustom
  #namespace: ics-e2e-pods-456
  namespace: ics-e2e-deploy-7887
  labels:
    app: testcustom
spec:
  replicas: 1
  selector:
    matchLabels:
      app: testcustom
  template:
    metadata:
      labels:
        app: testcustom
    spec:
      containers:
      - image: busybox #image name which should be avilable within cluster
        name: container-name # name of the container inside POD
        volumeMounts:
        - mountPath: /myvolumepath  # mount path for pvc from container
          name: pvc-name # pvc name for this pod
        securityContext:
          fsGroup: 1000
          seccompProfile:
            type: RuntimeDefault
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 1000
          capabilities:
            drop: [&quot;ALL&quot;]
      volumes:
      - name: pvc-name  # volume resource name in this POD, user can choose any name as per kubernetes
        persistentVolumeClaim:
          claimName: csi-block-pvc-custom-one  # pvc name which was created by using claim.yaml file
</code></pre>
<p>When I try to deploy this pod, it fails in either of the above cluster throwing errors related to security context. If I fix issue for one cluster, the same spec doesn't work in other cluster. I am wondering how to get a common deployment file which can be used in both clusters</p>
<p>Error</p>
<pre><code>Error creating: pods &quot;testcustom-589767ccd5-&quot; is forbidden: unable to validate against any security context constraint: [provider &quot;anyuid&quot;: Forbidden: not usable by user or serviceaccount, spec.containers[0].securityContext.runAsUser: Invalid value: 1000: must be in the ranges: [1000640000, 1000649999], provider &quot;restricted&quot;: Forbidden: not usable by user or serviceaccount, provider &quot;nonroot-v2&quot;: Forbidden: not usable by user or serviceaccount, provider &quot;nonroot&quot;: : Forbidden: not usable by user or serviceaccount, provider &quot;privileged&quot;: Forbidden: not usable by user or serviceaccount]
</code></pre>

ambikanair
<p>In openshift when namespace/project is created please ensure below ranges specified properly.  the values should be mapped to security context specified in yaml definition for fsgroup and runAsUser.  More details are in <a href="https://docs.openshift.com/container-platform/4.6/authentication/managing-security-context-constraints.html" rel="nofollow noreferrer">openshift</a> documentation.  the same pod definition will work in k8s and openshift.</p>
<pre><code>openshift.io/sa.scc.uid-range
openshift.io/sa.scc.supplemental-groups
</code></pre>
