From 6d27459da819114747aa66f6ed90f4175ced30ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 30 Jun 2026 15:37:36 +0200 Subject: [PATCH] tests: add supplementalGroups to pod-number-cpu for guest-pull MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The genpolicy guest-pull check now fails closed when an image carries supplemental groups that containerd won't reproduce while pulling the layers inside the guest, and quay.io/prometheus/busybox:latest happens to ship gid 10 (wheel). pod-number-cpu.yaml was simply missed when the other busybox manifests got their securityContext, so genpolicy bails out on the expected/actual gid mismatch. Let's declare supplementalGroups: [10] explicitly, just like we already do for the other busybox-based pods, so the generated policy lines up with what containerd actually applies. Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- .../kubernetes/runtimeclass_workloads/pod-number-cpu.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/integration/kubernetes/runtimeclass_workloads/pod-number-cpu.yaml b/tests/integration/kubernetes/runtimeclass_workloads/pod-number-cpu.yaml index e17bd61ce9..4ed388bc2c 100644 --- a/tests/integration/kubernetes/runtimeclass_workloads/pod-number-cpu.yaml +++ b/tests/integration/kubernetes/runtimeclass_workloads/pod-number-cpu.yaml @@ -9,6 +9,8 @@ metadata: name: cpu-test spec: runtimeClassName: kata + securityContext: + supplementalGroups: [10] containers: - name: c1 image: quay.io/prometheus/busybox:latest