mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-08 03:35:22 +00:00
6d27459da8
The genpolicy guest-pull check now fails closed when an image carries supplemental groups that containerd won't reproduce while pulling the layers inside the guest, and quay.io/prometheus/busybox:latest happens to ship gid 10 (wheel). pod-number-cpu.yaml was simply missed when the other busybox manifests got their securityContext, so genpolicy bails out on the expected/actual gid mismatch. Let's declare supplementalGroups: [10] explicitly, just like we already do for the other busybox-based pods, so the generated policy lines up with what containerd actually applies. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Assisted-by: Cursor <cursoragent@cursor.com>