Under https://docs.openshift.com/container-platform/4.12/authentication/managing-security-context-constraints.html#default-sccs_configuring-internal-oauth the explanation for restricted says:

~~~ 
* Requires that a pod is run as a user in a pre-allocated range of UIDs [...] 
* Allows pods to use any FSGroup 
* Allows pods to use any supplemental group
~~~

However the definition of the "restricted-v2" SCC (https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.15/bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-restricted-v2.yaml#L13) is:

~~~
fsGroup:
  type: MustRunAs
~~~

This conflicts with "Allows pods to use any FSGroup", as it has to be a specific group

OpenShift Container Platform 4.15

Always

    1. Create a Pod that is using the "restricted" or "restricted-v2" SCC
    2. Set an arbitraty `fsGroup`    

    SCC does not allow Pod to be created

    Documentation states correctly that "fsGroup" is configured as "MustRunAs"

    Suggested change: Replace "Allows pods to use any FSGroup" with "Requires that a pod is run with a pre-allocated FSGroup"