code: func ValidatePodSecurityContext(securityContext *core.PodSecurityContext, spec *core.PodSpec, specPath, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	if securityContext != nil {
  		allErrs = append(allErrs, validateHostNetwork(securityContext.HostNetwork, spec.Containers, specPath.Child("containers"))...)
  		if securityContext.FSGroup != nil {
  			for _, msg := range validation.IsValidGroupID(*securityContext.FSGroup) {
  				allErrs = append(allErrs, field.Invalid(fldPath.Child("fsGroup"), *(securityContext.FSGroup), msg))
  			}
  		}
  		if securityContext.RunAsUser != nil {
  			for _, msg := range validation.IsValidUserID(*securityContext.RunAsUser) {
  				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *(securityContext.RunAsUser), msg))
  			}
  		}
  		if securityContext.RunAsGroup != nil {
  			for _, msg := range validation.IsValidGroupID(*securityContext.RunAsGroup) {
  				allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *(securityContext.RunAsGroup), msg))
  			}
  		}
  		for g, gid := range securityContext.SupplementalGroups {
  			for _, msg := range validation.IsValidGroupID(gid) {
  				allErrs = append(allErrs, field.Invalid(fldPath.Child("supplementalGroups").Index(g), gid, msg))
  			}
  		}
  		if securityContext.ShareProcessNamespace != nil && securityContext.HostPID && *securityContext.ShareProcessNamespace {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("shareProcessNamespace"), *securityContext.ShareProcessNamespace, "ShareProcessNamespace and HostPID cannot both be enabled"))
  		}
  
  		if len(securityContext.Sysctls) != 0 {
  			allErrs = append(allErrs, validateSysctls(securityContext.Sysctls, fldPath.Child("sysctls"))...)
  		}
  	}
  
  	return allErrs
  }
docs: // ValidatePodSecurityContext test that the specified PodSecurityContext has valid data.