// RunAsGroup feature gate to be enabled.
  // +optional
  optional RunAsGroupStrategyOptions runAsGroup = 22;

  // supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.
  optional SupplementalGroupsStrategyOptions supplementalGroups = 12;

  // fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.

  // even if they are not included in this list.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  repeated int64 supplementalGroups = 4;

  // A special supplemental group that applies to all containers in a pod.
  // Some volume types allow the Kubelet to change the ownership of that volume
  // to be owned by the pod:
  //

SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai - projected - secret {{- end }} minio/templates/service.yaml {{ $scheme := .Values.tls.enabled | ternary "https" "http" }} apiVersion: v1 kind: Service metadata:...

SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai - projected - secret {{- end }} minio/templates/service.yaml {{ $scheme := .Values.tls.enabled | ternary "https" "http" }} apiVersion: v1 kind: Service metadata:...

SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai - projected - secret {{- end }} minio/templates/service.yaml {{ $scheme := .Values.tls.enabled | ternary "https" "http" }} apiVersion: v1 kind: Service metadata:...