- Fixed a bug where the kubelet ephemerally failed with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`, due to the cpuset cgroup being deleted on cgroup v2 with systemd cgroup manager.
   ([#125923](https://github.com/kubernetes/kubernetes/pull/125923), [@haircommander](https://github.com/haircommander)) [SIG Node and Testing]

- Supported fine-grained supplemental groups policy (KEP-3619), which enabled
  fine-grained control for supplementary groups in the first container processes.
  This allows you to choose whether to include groups defined in the container image (/etc/groups)

			continue
		}
		groups.Remove(group)
		c.iamUserGroupMemberships[member] = groups
	}
}

func (c *iamCache) policyDBGetGroups(store *IAMStoreSys, userPolicyPresent bool, groups ...string) ([]string, error) {
	var policies []string
	for _, group := range groups {
		if store.getUsersSysType() == MinIOUsersSysType {
			g, ok := c.iamGroupsMap[group]
			if !ok {
				continue
			}

	}

	if etcdClient == nil {
		var (
			group  *singleflight.Group
			policy *singleflight.Group
		)
		if env.Get("_MINIO_IAM_SINGLE_FLIGHT", config.EnableOn) == config.EnableOn {
			group = &singleflight.Group{}
			policy = &singleflight.Group{}
		}
		sys.store = &IAMStoreSys{
			IAMStorageAPI: newIAMObjectStore(objAPI, sys.usersSysType),
			group:         group,
			policy:        policy,
		}
	} else {

        assertNotNull(groupNames);
        assertEquals(2, groupNames.length);
        assertEquals("group1", groupNames[0]);
        assertEquals("group2", groupNames[1]);
    }

    public void test_getGroupNames_empty() {
        // Test when no groups match the prefix
        ComponentUtil.setFessConfig(new FessConfig.SimpleImpl() {
            @Override

						return
					}
				}
				if _, gerr := globalIAMSys.AddUsersToGroup(ctx, group, grpInfo.Members); gerr != nil {
					failed.Groups = append(failed.Groups, madmin.IAMErrEntity{Name: group, Error: err})
				} else {
					added.Groups = append(added.Groups, group)
				}
			}
		}
	}

	// import service accounts
	{

  For metrics `etcd_request_duration_seconds`, `etcd_requests_total` and `etcd_request_errors_total` replace `type` label with API `resource` and `group` label.
  For metric `apiserver_selfrequest_total` add a API `group` label.

	r, err := ies.client.Get(cctx, iamConfigGroupsPrefix, etcd.WithPrefix(), etcd.WithKeysOnly())
	if err != nil {
		return err
	}

	groups := etcdKvsToSet(iamConfigGroupsPrefix, r.Kvs)

	// Reload config for all groups.
	for _, group := range groups.ToSlice() {
		if err = ies.loadGroup(ctx, group, m); err != nil && err != errNoSuchGroup {
			return err
		}
	}
	return nil
}

		}

		bootstrapTraceMsgFirstTime("loading regular IAM groups")
		groupsLoadStartTime := UTCNow()
		groupsList := listedConfigItems[groupsListKey]
		for _, item := range groupsList {
			group := path.Dir(item)
			if err := iamOS.loadGroup(ctx, group, cache.iamGroupsMap); err != nil && err != errNoSuchGroup {
				return fmt.Errorf("unable to load the group: %w", err)
			}
		}

        });

    }

    /**
     * Deletes a group from both LDAP and the database, and removes the group
     * association from all users that belong to this group.
     *
     * @param group the group entity to delete
     */
    public void delete(final Group group) {
        ComponentUtil.getLdapManager().delete(group);

        groupBhv.delete(group, op -> {
            op.setRefreshPolicy(Constants.TRUE);