tests: pin identity in policy workloads

Add explicit securityContext values to static Kubernetes policy
workloads whose generated policy now includes image-derived identity
data.

Refresh existing guest-pull comments to point at the Limitations
documentation instead of the old issue link.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>

tests/integration/kubernetes/k8s-measured-rootfs.bats

@@ -41,7 +41,8 @@ setup() {
 	nginx_digest=$(get_from_kata_deps ".docker_images.nginx.digest")
 	nginx_image="${nginx_registry}@${nginx_digest}"
 
-	pod_config="$(new_pod_config "${nginx_image}" "kata-${KATA_HYPERVISOR}")"
+	pod_config="$(new_pod_config "${nginx_image}" "kata-${KATA_HYPERVISOR}" \
+		"" "" "1, 2, 3, 4, 6, 10, 11, 20, 26, 27")"
 	auto_generate_policy "${pod_config_dir}" "${pod_config}"
 
 	incorrect_hash="1111111111111111111111111111111111111111111111111111111111111111"

tests/integration/kubernetes/runtimeclass_workloads/busybox-pod.yaml

@@ -10,6 +10,8 @@ metadata:
 spec:
   shareProcessNamespace: true
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: first-test-container
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/busybox-template.yaml

@@ -10,6 +10,8 @@ metadata:
 spec:
   runtimeClassName: kata
   shareProcessNamespace: true
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: CTR_NAME
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/cron-job.yaml

@@ -9,6 +9,8 @@ spec:
       template:
         spec:
           runtimeClassName: kata
+          securityContext:
+            supplementalGroups: [10]
           containers:
           - name: pi
             image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/initContainer-shared-volume.yaml

@@ -9,6 +9,8 @@ metadata:
   name: initcontainer-shared-volume
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   initContainers:
   - name: first
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/initcontainer-shareprocesspid.yaml

@@ -10,6 +10,8 @@ metadata:
 spec:
   shareProcessNamespace: true
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   initContainers:
   - name: first
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/job-template.yaml

@@ -17,6 +17,8 @@ spec:
         jobgroup: jobtest
     spec:
       runtimeClassName: kata
+      securityContext:
+        supplementalGroups: [10]
       containers:
       - name: test
         image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/job.yaml

@@ -11,6 +11,8 @@ spec:
   template:
     spec:
       runtimeClassName: kata
+      securityContext:
+        supplementalGroups: [10]
       containers:
       - name: pi
         image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/k8s-pod-sc-nobodyupdate-deployment.yaml

@@ -26,6 +26,7 @@ spec:
       runtimeClassName: kata
       securityContext:
         runAsUser: 65534
+        runAsGroup: 65534
       containers:
       - name: master
         image: quay.io/kata-containers/test-images/opstree/redis:sha256-2642c7b07713df6897fa88cbe6db85170690cf3650018ceb2ab16cfa0b4f8d48

tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-deployment.yaml

@@ -26,6 +26,7 @@ spec:
       runtimeClassName: kata
       securityContext:
         runAsUser: 1000
+        runAsGroup: 1000
       containers:
       - name: master
         image: quay.io/kata-containers/test-images/opstree/redis:sha256-2642c7b07713df6897fa88cbe6db85170690cf3650018ceb2ab16cfa0b4f8d48

tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-job.yaml

@@ -11,6 +11,8 @@ spec:
   template:
     spec:
       runtimeClassName: kata
+      securityContext:
+        supplementalGroups: [10]
       containers:
         - name: hello
           image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-pod-pvc.yaml

@@ -9,6 +9,8 @@ metadata:
   name: policy-pod-pvc
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: busybox
       image: "quay.io/prometheus/busybox:latest"

tests/integration/kubernetes/runtimeclass_workloads/numa-topology-gpu-test.yaml.in

@@ -11,6 +11,8 @@ metadata:
     app: ${POD_NAME_NUMA}
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27]
   containers:
   - name: numa-check
     image: "quay.io/kata-containers/numa:2026-05-15@sha256:a863fcf95fcbbf63352b0555a61a62537f74399dc4bca826a2e42d001e26accb"

tests/integration/kubernetes/runtimeclass_workloads/numa-topology-test.yaml.in

@@ -11,6 +11,8 @@ metadata:
     app: ${POD_NAME_NUMA}
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27]
   containers:
   - name: numa-check
     image: "quay.io/kata-containers/numa:2026-05-15@sha256:a863fcf95fcbbf63352b0555a61a62537f74399dc4bca826a2e42d001e26accb"

tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in

@@ -16,9 +16,8 @@ metadata:
     # cc_init_data annotation will be added by genpolicy with CDH configuration
     # from the custom default-initdata.toml created by create_nim_initdata_file()
 spec:
-  # Explicit user/group/supplementary groups to support nydus guest-pull.
-  # See issue https://github.com/kata-containers/kata-containers/issues/11162 and
-  # other references to this issue in the genpolicy source folder.
+  # Explicit user/group IDs keep guest-pull requests aligned with policy.
+  # See docs/Limitations.md#guest-pulled-container-images.
   securityContext:
     runAsUser: 1000
     runAsGroup: 1000

tests/integration/kubernetes/runtimeclass_workloads/nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in

@@ -16,9 +16,8 @@ metadata:
     # cc_init_data annotation will be added by genpolicy with CDH configuration
     # from the custom default-initdata.toml created by create_nim_initdata_file()
 spec:
-  # Explicit user/group/supplementary groups to support nydus guest-pull.
-  # See issue https://github.com/kata-containers/kata-containers/issues/11162 and
-  # other references to this issue in the genpolicy source folder.
+  # Explicit user/group IDs keep guest-pull requests aligned with policy.
+  # See docs/Limitations.md#guest-pulled-container-images.
   securityContext:
     runAsUser: 1000
     runAsGroup: 1000

tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-client-pod.yaml

@@ -11,9 +11,8 @@ metadata:
   labels:
     app: openvpn-client
 spec:
-  # Explicit user/group/supplementary groups to support nydus guest-pull.
-  # See issue https://github.com/kata-containers/kata-containers/issues/11162 and
-  # other references to this issue in the genpolicy source folder.
+  # Explicit security context values keep guest-pull requests aligned with policy.
+  # See docs/Limitations.md#guest-pulled-container-images.
   securityContext:
     runAsUser: 0
     runAsGroup: 0

tests/integration/kubernetes/runtimeclass_workloads/openvpn/openvpn-server-pod.yaml

@@ -11,9 +11,8 @@ metadata:
   labels:
     app: openvpn-server
 spec:
-  # Explicit user/group/supplementary groups to support nydus guest-pull.
-  # See issue https://github.com/kata-containers/kata-containers/issues/11162 and
-  # other references to this issue in the genpolicy source folder.
+  # Explicit security context values keep guest-pull requests aligned with policy.
+  # See docs/Limitations.md#guest-pulled-container-images.
   securityContext:
     runAsUser: 0
     runAsGroup: 0

tests/integration/kubernetes/runtimeclass_workloads/pod-besteffort.yaml

@@ -9,6 +9,8 @@ metadata:
   name: besteffort-test
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: qos-besteffort
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-burstable.yaml

@@ -9,6 +9,8 @@ metadata:
   name: burstable-test
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: qos-burstable
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-caps.yaml

@@ -9,6 +9,8 @@ metadata:
   name: pod-caps
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-configmap-volume.yaml

@@ -10,6 +10,8 @@ metadata:
 spec:
   terminationGracePeriodSeconds: 0
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: test-container
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-configmap.yaml

@@ -9,6 +9,8 @@ metadata:
   name: config-env-test-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-cpu-defaults.yaml

@@ -9,6 +9,8 @@ metadata:
   name: default-cpu-test
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: default-cpu-demo-ctr
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-empty-dir.yaml

@@ -9,6 +9,8 @@ metadata:
   name: sharevol-kata
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: test
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-env.yaml

@@ -9,6 +9,8 @@ metadata:
   name: test-env
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-file-volume.yaml

@@ -9,6 +9,8 @@ metadata:
   name: test-file-volume
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   nodeName: NODE
   volumes:

tests/integration/kubernetes/runtimeclass_workloads/pod-guaranteed.yaml

@@ -9,6 +9,8 @@ metadata:
   name: qos-test
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: qos-guaranteed
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-hostname.yaml

@@ -10,6 +10,8 @@ metadata:
   name: test-pod-hostname
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   containers:
   - image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-hostpath-kmsg.yaml

@@ -10,6 +10,8 @@ metadata:
   name: hostpath-kmsg
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   volumes:
   - name: dev-kmsg

tests/integration/kubernetes/runtimeclass_workloads/pod-http-liveness.yaml

@@ -11,6 +11,8 @@ metadata:
   name: liveness-http
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27]
   containers:
   - name: liveness
     image: ${agnhost_image}

tests/integration/kubernetes/runtimeclass_workloads/pod-liveness.yaml

@@ -11,6 +11,8 @@ metadata:
   name: liveness-exec
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: liveness
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-nested-configmap-secret.yaml

@@ -24,6 +24,8 @@ metadata:
   name: nested-configmap-secret-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-configmap.yaml

@@ -9,6 +9,8 @@ metadata:
   name: optional-empty-config-test-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-optional-empty-secret.yaml

@@ -9,6 +9,8 @@ metadata:
   name: optional-empty-secret-test-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-privileged.yaml

@@ -10,6 +10,8 @@ metadata:
   name: privileged
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   containers:
   - image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-quota-deployment.yaml

@@ -18,6 +18,8 @@ spec:
         purpose: quota-demo
     spec:
       runtimeClassName: kata
+      securityContext:
+        supplementalGroups: [10]
       containers:
       - name: pod-quota-demo
         image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-cgroup.yaml

@@ -12,6 +12,8 @@ metadata:
     io.katacontainers.config.runtime.sandbox_cgroup_only: "false"
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   containers:
   - image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-sandbox-vcpus-allocation.yaml

@@ -12,6 +12,8 @@ metadata:
     io.katacontainers.config.hypervisor.default_vcpus: "0"
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: vcpus-less-than-one-with-no-limits
     image: quay.io/prometheus/busybox:latest
@@ -29,6 +31,8 @@ metadata:
     io.katacontainers.config.hypervisor.default_vcpus: "0.75"
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: vcpus-less-than-one-with-limits
     image: quay.io/prometheus/busybox:latest
@@ -47,6 +51,8 @@ metadata:
     io.katacontainers.config.hypervisor.default_vcpus: "0.75"
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: vcpus-more-than-one-with-limits
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-secret-env.yaml

@@ -9,6 +9,8 @@ metadata:
   name: secret-envars-test-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
   - name: envars-test-container
     image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-secret.yaml

@@ -9,6 +9,8 @@ metadata:
   name: secret-test-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   containers:
     - name: test-container
       image: quay.io/prometheus/busybox:latest

tests/integration/kubernetes/runtimeclass_workloads/pod-shared-volume.yaml

@@ -9,6 +9,8 @@ metadata:
   name: test-shared-volume
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   volumes:
   - name: shared-data

tests/integration/kubernetes/runtimeclass_workloads/pod-sysctl.yaml

@@ -10,6 +10,7 @@ metadata:
 spec:
   runtimeClassName: kata
   securityContext:
+    supplementalGroups: [10]
     sysctls:
     - name: kernel.shm_rmid_forced
       value: "0"

tests/integration/kubernetes/runtimeclass_workloads/pod-tcp-liveness.yaml

@@ -11,6 +11,8 @@ metadata:
     app: tcp-liveness
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27]
   containers:
   - name: tcp-liveness
     image: ${agnhost_image}

tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-fail.yaml

@@ -10,6 +10,8 @@ metadata:
   name: pod-termination-log-fail
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   containers:
     - name: termination-log-test

tests/integration/kubernetes/runtimeclass_workloads/pod-termination-log-success.yaml

@@ -10,6 +10,8 @@ metadata:
   name: pod-termination-log-success
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   restartPolicy: Never
   containers:
     - name: termination-log-test

tests/integration/kubernetes/runtimeclass_workloads/pod-trusted-ephemeral-data-storage.yaml

@@ -4,9 +4,8 @@ apiVersion: v1
 metadata:
   name: trusted-ephemeral-data-storage
 spec:
-  # Explicit user/group/supplementary groups to support nydus guest-pull.
-  # See issue https://github.com/kata-containers/kata-containers/issues/11162 and
-  # other references to this issue in the genpolicy source folder.
+  # Explicit security context values keep guest-pull requests aligned with policy.
+  # See docs/Limitations.md#guest-pulled-container-images.
   securityContext:
     runAsUser: 0
     runAsGroup: 0

tests/integration/kubernetes/runtimeclass_workloads/pv-pod.yaml

@@ -9,6 +9,8 @@ metadata:
   name: pv-pod
 spec:
   runtimeClassName: kata
+  securityContext:
+    supplementalGroups: [10]
   nodeName: NODE
   volumes:
     - name: pv-storage