code: func validatePSPRunAsGroup(fldPath *field.Path, runAsGroup *policy.RunAsGroupStrategyOptions) field.ErrorList {
  	var allErrs field.ErrorList
  
  	if runAsGroup == nil {
  		return allErrs
  	}
  
  	switch runAsGroup.Rule {
  	case policy.RunAsGroupStrategyRunAsAny:
  		if len(runAsGroup.Ranges) != 0 {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("ranges"), runAsGroup.Ranges, "Ranges must be empty"))
  		}
  	case policy.RunAsGroupStrategyMustRunAs, policy.RunAsGroupStrategyMayRunAs:
  		if len(runAsGroup.Ranges) == 0 {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("ranges"), runAsGroup.Ranges, "must provide at least one range"))
  		}
  		// validate range settings
  		for idx, rng := range runAsGroup.Ranges {
  			allErrs = append(allErrs, validateGroupIDRange(fldPath.Child("ranges").Index(idx), rng)...)
  		}
  	default:
  		supportedRunAsGroupRules := []string{
  			string(policy.RunAsGroupStrategyMustRunAs),
  			string(policy.RunAsGroupStrategyRunAsAny),
  			string(policy.RunAsGroupStrategyMayRunAs),
  		}
  		allErrs = append(allErrs, field.NotSupported(fldPath.Child("rule"), runAsGroup.Rule, supportedRunAsGroupRules))
  	}
  	return allErrs
  }
docs: // validatePSPRunAsGroup validates the RunAsGroup fields of PodSecurityPolicy.