From 50fe29e524b256dd82f00b4fc1d452de1eae2f40 Mon Sep 17 00:00:00 2001
From: Hemant Kumar <hekumar@redhat.com>
Date: Wed, 21 May 2025 16:39:25 -0400
Subject: [PATCH 1/2] Add accessors for fsgroup change policy

---
 pkg/securitycontext/accessors.go | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkg/securitycontext/accessors.go b/pkg/securitycontext/accessors.go
index ef1cd13a8e0..9eb7d581b2f 100644
--- a/pkg/securitycontext/accessors.go
+++ b/pkg/securitycontext/accessors.go
@@ -35,6 +35,7 @@ type PodSecurityContextAccessor interface {
 	SeccompProfile() *api.SeccompProfile
 	SupplementalGroups() []int64
 	FSGroup() *int64
+	FSGroupChangePolicy() *api.PodFSGroupChangePolicy
 }
 
 // PodSecurityContextMutator allows reading and writing the values of a PodSecurityContext object
@@ -52,6 +53,7 @@ type PodSecurityContextMutator interface {
 	SetSeccompProfile(*api.SeccompProfile)
 	SetSupplementalGroups([]int64)
 	SetFSGroup(*int64)
+	SetFSGroupChangePolicy(*api.PodFSGroupChangePolicy)
 
 	// PodSecurityContext returns the current PodSecurityContext object
 	PodSecurityContext() *api.PodSecurityContext
@@ -231,6 +233,23 @@ func (w *podSecurityContextWrapper) SetFSGroup(v *int64) {
 	w.podSC.FSGroup = v
 }
 
+func (w *podSecurityContextWrapper) FSGroupChangePolicy() *api.PodFSGroupChangePolicy {
+	if w.podSC == nil {
+		return nil
+	}
+
+	return w.podSC.FSGroupChangePolicy
+}
+
+func (w *podSecurityContextWrapper) SetFSGroupChangePolicy(v *api.PodFSGroupChangePolicy) {
+	if w.podSC == nil && v == nil {
+		return
+	}
+
+	w.ensurePodSC()
+	w.podSC.FSGroupChangePolicy = v
+}
+
 // ContainerSecurityContextAccessor allows reading the values of a SecurityContext object
 type ContainerSecurityContextAccessor interface {
 	Capabilities() *api.Capabilities

From b0847b47697954bfbaab4693b6d2ff74b306fa0c Mon Sep 17 00:00:00 2001
From: Hemant Kumar <hekumar@redhat.com>
Date: Tue, 27 May 2025 10:38:45 -0400
Subject: [PATCH 2/2] Add unit tests for fsGroupChangePolicy accessors

---
 pkg/securitycontext/accessors_test.go | 42 ++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/pkg/securitycontext/accessors_test.go b/pkg/securitycontext/accessors_test.go
index 5f857b6273a..c70b921c46c 100644
--- a/pkg/securitycontext/accessors_test.go
+++ b/pkg/securitycontext/accessors_test.go
@@ -31,6 +31,7 @@ func TestPodSecurityContextAccessor(t *testing.T) {
 	runAsGroup := int64(1)
 	runAsNonRoot := true
 	hostUsers := false
+	onRootMismatchPolicy := api.FSGroupChangeOnRootMismatch
 
 	testcases := []*api.PodSecurityContext{
 		nil,
@@ -46,6 +47,7 @@ func TestPodSecurityContextAccessor(t *testing.T) {
 		{SELinuxOptions: &api.SELinuxOptions{User: "bob"}},
 		{SeccompProfile: &api.SeccompProfile{Type: api.SeccompProfileTypeRuntimeDefault}},
 		{SupplementalGroups: []int64{1, 2, 3}},
+		{FSGroupChangePolicy: &onRootMismatchPolicy},
 	}
 
 	for i, tc := range testcases {
@@ -89,6 +91,9 @@ func TestPodSecurityContextAccessor(t *testing.T) {
 		if v := a.SupplementalGroups(); !reflect.DeepEqual(expected.SupplementalGroups, v) {
 			t.Errorf("%d: expected %#v, got %#v", i, expected.SupplementalGroups, v)
 		}
+		if v := a.FSGroupChangePolicy(); !reflect.DeepEqual(expected.FSGroupChangePolicy, v) {
+			t.Errorf("%d: expected %#v, got %#v", i, expected.FSGroupChangePolicy, v)
+		}
 	}
 }
 
@@ -105,17 +110,18 @@ func TestPodSecurityContextMutator(t *testing.T) {
 		"populated": {
 			newSC: func() *api.PodSecurityContext {
 				return &api.PodSecurityContext{
-					HostNetwork:        true,
-					HostIPC:            true,
-					HostPID:            true,
-					HostUsers:          nil,
-					SELinuxOptions:     &api.SELinuxOptions{},
-					RunAsUser:          nil,
-					RunAsGroup:         nil,
-					RunAsNonRoot:       nil,
-					SeccompProfile:     nil,
-					SupplementalGroups: nil,
-					FSGroup:            nil,
+					HostNetwork:         true,
+					HostIPC:             true,
+					HostPID:             true,
+					HostUsers:           nil,
+					SELinuxOptions:      &api.SELinuxOptions{},
+					RunAsUser:           nil,
+					RunAsGroup:          nil,
+					RunAsNonRoot:        nil,
+					SeccompProfile:      nil,
+					SupplementalGroups:  nil,
+					FSGroup:             nil,
+					FSGroupChangePolicy: nil,
 				}
 			},
 		},
@@ -146,6 +152,7 @@ func TestPodSecurityContextMutator(t *testing.T) {
 			m.SetSeccompProfile(m.SeccompProfile())
 			m.SetSELinuxOptions(m.SELinuxOptions())
 			m.SetSupplementalGroups(m.SupplementalGroups())
+			m.SetFSGroupChangePolicy(m.FSGroupChangePolicy())
 			if !reflect.DeepEqual(sc, originalSC) {
 				t.Errorf("%s: unexpected mutation: %#v, %#v", k, sc, originalSC)
 			}
@@ -290,6 +297,19 @@ func TestPodSecurityContextMutator(t *testing.T) {
 				continue
 			}
 		}
+
+		// FSGroupChangePolicy
+		{
+			onRootMismatchPolicy := api.FSGroupChangeOnRootMismatch
+			modifiedSC := nonNilSC(tc.newSC())
+			m := NewPodSecurityContextMutator(tc.newSC())
+			modifiedSC.FSGroupChangePolicy = &onRootMismatchPolicy
+			m.SetFSGroupChangePolicy(&onRootMismatchPolicy)
+			if !reflect.DeepEqual(m.PodSecurityContext(), modifiedSC) {
+				t.Errorf("%s: unexpected object:\n%s", k, diff.ObjectGoPrintSideBySide(modifiedSC, m.PodSecurityContext()))
+				continue
+			}
+		}
 	}
 }