allow fsGroup values greater than zero
change the policy require-non-root-groups to allow fsGroup values greater than zero
@@ -56,10 +56,10 @@ spec:
- Pod
validate:
message: >-
- Changing of file system groups is not allowed. The field
- spec.securityContext.fsGroup must not be defined.
+ Changing to root group ID is disallowed. The field
+ spec.securityContext.fsGroup must be empty or greater than zero.
pattern:
spec:
=(securityContext):
- X(fsGroup): "*"
+ =(fsGroup): ">0"
{{- end -}}
\ No newline at end of file
