Set fsGroupChangePolicy to OnRootMismatch in securityContext by default (#986)

bianchi2 · web-flow · commit 6bc446cef7d6 · 2025-04-17T07:58:26.000+10:00
Co-authored-by: Yevhen Ivantsov &lt;yivantsov@atlassian.com&gt;
diff --git a/src/main/charts/bamboo-agent/README.md b/src/main/charts/bamboo-agent/README.md
@@ -42,6 +42,7 @@ Kubernetes: `>=1.21.x-0`
 | agent.resources.jvm.maxHeap | string | `"512m"` | The maximum amount of heap memory that will be used by the Bamboo agent JVM  |
 | agent.resources.jvm.minHeap | string | `"256m"` | The minimum amount of heap memory that will be used by the Bamboo agent JVM  |
 | agent.securityContext.fsGroup | int | `2005` | The GID used by the Bamboo docker image GID will default to 2005 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Bamboo container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260  |
+| agent.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | agent.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | agent.securityToken.secretKey | string | `"security-token"` |  |
 | agent.securityToken.secretName | string | `nil` | The name of the K8s Secret that contains the security token. When specified the token will be automatically utilised on agent boot. An Example of creating a K8s secret for the secret below: 'kubectl create secret generic <secret-name> --from-literal=security-token=<security token>' https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets  |
diff --git a/src/main/charts/bamboo-agent/values.yaml b/src/main/charts/bamboo-agent/values.yaml
@@ -110,6 +110,12 @@ agent:
     #
     fsGroup: 2005
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/main/charts/bamboo/README.md b/src/main/charts/bamboo/README.md
@@ -82,6 +82,7 @@ Kubernetes: `>=1.21.x-0`
 | bamboo.resources.jvm.maxHeap | string | `"1024m"` | The maximum amount of heap memory that will be used by the Bamboo JVM  |
 | bamboo.resources.jvm.minHeap | string | `"512m"` | The minimum amount of heap memory that will be used by the Bamboo JVM  |
 | bamboo.securityContext.fsGroup | int | `2005` | The GID used by the Bamboo docker image GID will default to 2005 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Bamboo container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260  |
+| bamboo.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | bamboo.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | bamboo.securityToken.secretKey | string | `"security-token"` | The key (default `secretKey`) in the Secret used to store the Bamboo shared key.  |
 | bamboo.securityToken.secretName | string | `nil` | The name of the K8s Secret that contains the security token. When specified the token will overrided the generated one. This secret should also be shared with the agent deployment. An Example of creating a K8s secret for the secret below: 'kubectl create secret generic <secret-name> --from-literal=security-token=<security token>' https://kubernetes.io/docs/concepts/configuration/secret/#opaque-secrets  |
diff --git a/src/main/charts/bamboo/values.yaml b/src/main/charts/bamboo/values.yaml
@@ -648,6 +648,12 @@ bamboo:
     #
     fsGroup: 2005
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/main/charts/bitbucket/README.md b/src/main/charts/bitbucket/README.md
@@ -125,6 +125,7 @@ Kubernetes: `>=1.21.x-0`
 | bitbucket.resources.jvm.maxHeap | string | `"1g"` | The maximum amount of heap memory that will be used by the Bitbucket JVM The same value will be used by the Elasticsearch JVM. |
 | bitbucket.resources.jvm.minHeap | string | `"512m"` | The minimum amount of heap memory that will be used by the Bitbucket JVM The same value will be used by the Elasticsearch JVM. |
 | bitbucket.securityContext.fsGroup | int | `2003` | The GID used by the Bitbucket docker image GID will default to 2003 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Bitbucket container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260  |
+| bitbucket.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | bitbucket.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | bitbucket.service.annotations | object | `{}` | Additional annotations to apply to the Service  |
 | bitbucket.service.contextPath | string | `nil` | The context path that Bitbucket will use.  |
diff --git a/src/main/charts/bitbucket/values.yaml b/src/main/charts/bitbucket/values.yaml
@@ -656,6 +656,12 @@ bitbucket:
     #
     fsGroup: 2003
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/main/charts/confluence/README.md b/src/main/charts/confluence/README.md
@@ -85,6 +85,7 @@ Kubernetes: `>=1.21.x-0`
 | confluence.s3AttachmentsStorage.bucketRegion | string | `nil` |  |
 | confluence.s3AttachmentsStorage.endpointOverride | string | `nil` | EXPERIMENTAL Feature! Override the default AWS API endpoint with a custom one, for example to use Minio as object storage https://min.io/  |
 | confluence.securityContext.fsGroup | int | `2002` | The GID used by the Confluence docker image GID will default to 2002 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Confluence container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260 |
+| confluence.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | confluence.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | confluence.seraphConfig | object | `{"autoLoginCookieAge":"1209600","generateByHelm":false}` | By default seraph-config.xml is generated in the container entrypoint from a template shipped with an official Confluence image. However, seraph-config.xml generation may fail if container is not run as root, which is a common case if Confluence is deployed to OpenShift.  |
 | confluence.seraphConfig.generateByHelm | bool | `false` | Mount seraph-config.xml as a ConfigMap. Override configuration elements if necessary  |
diff --git a/src/main/charts/confluence/values.yaml b/src/main/charts/confluence/values.yaml
@@ -658,6 +658,12 @@ confluence:
     # However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260
     fsGroup: 2002
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/main/charts/crowd/README.md b/src/main/charts/crowd/README.md
@@ -69,6 +69,7 @@ Kubernetes: `>=1.21.x-0`
 | crowd.resources.jvm.maxHeap | string | `"768m"` | The maximum amount of heap memory that will be used by the Crowd JVM  |
 | crowd.resources.jvm.minHeap | string | `"384m"` | The minimum amount of heap memory that will be used by the Crowd JVM  |
 | crowd.securityContext.fsGroup | int | `2004` | The GID used by the Crowd docker image GID will default to 2004 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Crowd container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260  |
+| crowd.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | crowd.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | crowd.service.annotations | object | `{}` | Additional annotations to apply to the Service  |
 | crowd.service.contextPath | string | `"/crowd"` | The Tomcat context path that Crowd will use. The ATL_TOMCAT_CONTEXTPATH will be set automatically.  |
diff --git a/src/main/charts/crowd/values.yaml b/src/main/charts/crowd/values.yaml
@@ -168,6 +168,12 @@ crowd:
     #
     fsGroup: 2004
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/main/charts/jira/README.md b/src/main/charts/jira/README.md
@@ -118,6 +118,7 @@ Kubernetes: `>=1.21.x-0`
 | jira.s3Storage.backups.bucketRegion | string | `nil` | AWS region where the S3 bucket is located.  |
 | jira.s3Storage.backups.endpointOverride | string | `nil` | Override the default AWS API endpoint with a custom one  |
 | jira.securityContext.fsGroup | int | `2001` | The GID used by the Jira docker image GID will default to 2001 if not supplied and securityContextEnabled is set to true. This is intended to ensure that the shared-home volume is group-writeable by the GID used by the Jira container. However, this doesn't appear to work for NFS volumes due to a K8s bug: https://github.com/kubernetes/examples/issues/260  |
+| jira.securityContext.fsGroupChangePolicy | string | `"OnRootMismatch"` | fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods  |
 | jira.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | jira.seraphConfig | object | `{"autoLoginCookieAge":"1209600","generateByHelm":false}` | By default seraph-config.xml is generated in the container entrypoint from a template shipped with an official Jira image. However, seraph-config.xml generation may fail if container is not run as root, which is a common case if Jira is deployed to OpenShift.  |
 | jira.seraphConfig.generateByHelm | bool | `false` | Mount seraph-config.xml as a ConfigMap. Override configuration elements if necessary  |
diff --git a/src/main/charts/jira/values.yaml b/src/main/charts/jira/values.yaml
@@ -530,6 +530,12 @@ jira:
     #
     fsGroup: 2001
 
+    # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.
+    # This field only applies to volume types that support fsGroup controlled ownership and permissions.
+    # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
+    #
+    fsGroupChangePolicy: "OnRootMismatch"
+
   # -- Standard K8s field that holds security configurations that will be applied to a container.
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   #
diff --git a/src/test/java/test/SecurityContextTest.java b/src/test/java/test/SecurityContextTest.java
@@ -142,5 +142,29 @@ void test_synchrony_container_security_context(Product product) throws Exception
                 .getSecurityContext();
         assertThat(containerSecurityContext.path("runAsGroup")).hasValueEqualTo(2000);
     }
+
+    @ParameterizedTest
+    @EnumSource(value = Product.class, names = {"bamboo_agent"}, mode = EnumSource.Mode.EXCLUDE)
+    void test_cfs_group_change_policy_default(Product product) throws Exception {
+
+        final var resources = helm.captureKubeResourcesFromHelmChart(product, Map.of());
+
+        JsonNode containerSecurityContext = resources.getStatefulSet(product.getHelmReleaseName())
+                .getPodSpec().get("securityContext");
+        assertThat(containerSecurityContext.path("fsGroupChangePolicy")).hasTextEqualTo("OnRootMismatch");
+    }
+
+    @ParameterizedTest
+    @EnumSource(value = Product.class, names = {"bamboo_agent"}, mode = EnumSource.Mode.EXCLUDE)
+    void test_cfs_group_change_policy_override(Product product) throws Exception {
+
+        final var resources = helm.captureKubeResourcesFromHelmChart(product, Map.of(
+                product + ".securityContext.fsGroupChangePolicy", "Always"
+        ));
+
+        JsonNode containerSecurityContext = resources.getStatefulSet(product.getHelmReleaseName())
+                .getPodSpec().get("securityContext");
+        assertThat(containerSecurityContext.path("fsGroupChangePolicy")).hasTextEqualTo("Always");
+    }
 }
 
diff --git a/src/test/resources/expected_helm_output/bamboo-agent/output.yaml b/src/test/resources/expected_helm_output/bamboo-agent/output.yaml
@@ -60,6 +60,7 @@ spec:
           ip: 127.0.0.1
       securityContext:
         fsGroup: 2005
+        fsGroupChangePolicy: OnRootMismatch
       initContainers:
       containers:
         - name: bamboo-agent
diff --git a/src/test/resources/expected_helm_output/bamboo/output.yaml b/src/test/resources/expected_helm_output/bamboo/output.yaml
@@ -151,6 +151,7 @@ data:
           minHeap: 512m
       securityContext:
         fsGroup: 2005
+        fsGroupChangePolicy: OnRootMismatch
       securityContextEnabled: true
       securityToken:
         secretKey: agentTestKey
@@ -472,6 +473,7 @@ spec:
           ip: 127.0.0.1
       securityContext:
         fsGroup: 2005
+        fsGroupChangePolicy: OnRootMismatch
       initContainers:
         - name: nfs-permission-fixer
           image: alpine:latest
diff --git a/src/test/resources/expected_helm_output/bitbucket/output.yaml b/src/test/resources/expected_helm_output/bitbucket/output.yaml
@@ -231,6 +231,7 @@ data:
           minHeap: 512m
       securityContext:
         fsGroup: 2003
+        fsGroupChangePolicy: OnRootMismatch
       securityContextEnabled: true
       service:
         annotations: {}
@@ -601,7 +602,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config-jvm: 92e94344363cf1c8d936eeb961255975cc32c7e624f910da39f93bd48564a18f
+        checksum/config-jvm: 60d95111d9edbb3746b89e94dd590776247314947ec7404ab6287eade15250e9
       labels:
         app.kubernetes.io/name: bitbucket-mesh
         app.kubernetes.io/instance: unittest-bitbucket
@@ -722,7 +723,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config-jvm: 381c00ff6676a4dcf3ba225aa169f3f80e0812c7292b6fc369b4db9596f95720
+        checksum/config-jvm: 11b52c0456c560f59c3af47f19fd163244ee23dd0fa0236290ae96b09d7194f2
       labels:
         helm.sh/chart: bitbucket-1.22.7
         app.kubernetes.io/name: bitbucket
@@ -739,6 +740,7 @@ spec:
           ip: 127.0.0.1
       securityContext:
         fsGroup: 2003
+        fsGroupChangePolicy: OnRootMismatch
       initContainers:
         - name: fetch-jmx-exporter
           image: bitnami/jmx-exporter:0.18.0
diff --git a/src/test/resources/expected_helm_output/confluence/output.yaml b/src/test/resources/expected_helm_output/confluence/output.yaml
@@ -156,6 +156,7 @@ data:
         endpointOverride: null
       securityContext:
         fsGroup: 2002
+        fsGroupChangePolicy: OnRootMismatch
       securityContextEnabled: true
       seraphConfig:
         autoLoginCookieAge: "1209600"
@@ -663,7 +664,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config-jvm: 9440a057ff8824a9bd3b7a134c8da4e4cc22f0a7903112eb6e82d88aafb389aa
+        checksum/config-jvm: dcd3dc9d329aade9a42205d6a1e4c4ecb3cf65c2df8f8023af13a3df0b697176
       labels:
         helm.sh/chart: confluence-1.22.7
         app.kubernetes.io/name: confluence
@@ -675,6 +676,7 @@ spec:
       terminationGracePeriodSeconds: 25
       securityContext:
         fsGroup: 2002
+        fsGroupChangePolicy: OnRootMismatch
       hostAliases:
         - hostnames:
           - test.example.com
diff --git a/src/test/resources/expected_helm_output/crowd/output.yaml b/src/test/resources/expected_helm_output/crowd/output.yaml
@@ -139,6 +139,7 @@ data:
           minHeap: 384m
       securityContext:
         fsGroup: 2004
+        fsGroupChangePolicy: OnRootMismatch
       securityContextEnabled: true
       service:
         annotations: {}
@@ -379,7 +380,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config-jvm: d7360ecd4ab5a236db4a4dca24e511e533a9c06fd6c94b02461381ac9dbd54c4
+        checksum/config-jvm: bfc886f0fa9a0a3ebe0de488d3639fc56569302c53da1c0149a76a25898ce276
       labels:
         helm.sh/chart: crowd-1.22.7
         app.kubernetes.io/name: crowd
@@ -396,6 +397,7 @@ spec:
           ip: 127.0.0.1
       securityContext:
         fsGroup: 2004
+        fsGroupChangePolicy: OnRootMismatch
       initContainers:
         - name: nfs-permission-fixer
           image: alpine:latest
diff --git a/src/test/resources/expected_helm_output/jira/output.yaml b/src/test/resources/expected_helm_output/jira/output.yaml
@@ -197,6 +197,7 @@ data:
           endpointOverride: null
       securityContext:
         fsGroup: 2001
+        fsGroupChangePolicy: OnRootMismatch
       securityContextEnabled: true
       seraphConfig:
         autoLoginCookieAge: "1209600"
@@ -436,6 +437,7 @@ spec:
           ip: 127.0.0.1
       securityContext:
         fsGroup: 2001
+        fsGroupChangePolicy: OnRootMismatch
       initContainers:
         - name: nfs-permission-fixer
           image: alpine:latest

Original file line number	Diff line number	Diff line change
`@@ -110,6 +110,12 @@ agent:`
`110`	`110`	`#`
`111`	`111`	`fsGroup: 2005`
`112`	`112`
	`113`	`+ # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.`
	`114`	`+ # This field only applies to volume types that support fsGroup controlled ownership and permissions.`
	`115`	`+ # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods`
	`116`	`+ #`
	`117`	`+ fsGroupChangePolicy: "OnRootMismatch"`
	`118`	`+`
`113`	`119`	`# -- Standard K8s field that holds security configurations that will be applied to a container.`
`114`	`120`	`# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`115`	`121`	`#`
Original file line number	Diff line number	Diff line change
`@@ -648,6 +648,12 @@ bamboo:`
`648`	`648`	`#`
`649`	`649`	`fsGroup: 2005`
`650`	`650`
	`651`	`+ # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.`
	`652`	`+ # This field only applies to volume types that support fsGroup controlled ownership and permissions.`
	`653`	`+ # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods`
	`654`	`+ #`
	`655`	`+ fsGroupChangePolicy: "OnRootMismatch"`
	`656`	`+`
`651`	`657`	`# -- Standard K8s field that holds security configurations that will be applied to a container.`
`652`	`658`	`# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`653`	`659`	`#`
Original file line number	Diff line number	Diff line change
`@@ -656,6 +656,12 @@ bitbucket:`
`656`	`656`	`#`
`657`	`657`	`fsGroup: 2003`
`658`	`658`
	`659`	`+ # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.`
	`660`	`+ # This field only applies to volume types that support fsGroup controlled ownership and permissions.`
	`661`	`+ # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods`
	`662`	`+ #`
	`663`	`+ fsGroupChangePolicy: "OnRootMismatch"`
	`664`	`+`
`659`	`665`	`# -- Standard K8s field that holds security configurations that will be applied to a container.`
`660`	`666`	`# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`661`	`667`	`#`
Original file line number	Diff line number	Diff line change
`@@ -168,6 +168,12 @@ crowd:`
`168`	`168`	`#`
`169`	`169`	`fsGroup: 2004`
`170`	`170`
	`171`	`+ # -- fsGroupChangePolicy defines behavior for changing ownership and permission of the volume before being exposed inside a Pod.`
	`172`	`+ # This field only applies to volume types that support fsGroup controlled ownership and permissions.`
	`173`	`+ # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods`
	`174`	`+ #`
	`175`	`+ fsGroupChangePolicy: "OnRootMismatch"`
	`176`	`+`
`171`	`177`	`# -- Standard K8s field that holds security configurations that will be applied to a container.`
`172`	`178`	`# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/`
`173`	`179`	`#`