pod.Spec.SecurityContext.RunAsUser = runAsUser
	pod.Spec.SecurityContext.RunAsGroup = runAsGroup
	pod.Spec.SecurityContext.SupplementalGroups = []int64{*supplementalGroup}
	return nil
}

// runKubeSchedulerAsNonRoot updates the pod manifest and the hostVolume permissions to run kube-scheduler as non root.
func runKubeSchedulerAsNonRoot(pod *v1.Pod, runAsUser, runAsGroup *int64, updatePathOwnerAndPermissions pathOwnerAndPermissionsUpdaterFunc) error {

		filepath.Join(cfg.CertificatesDir, kubeadmconstants.APIServerKubeletClientKeyName): {uid: runAsUser, gid: runAsGroup, permissions: 0600},
		filepath.Join(cfg.CertificatesDir, kubeadmconstants.FrontProxyClientKeyName):       {uid: runAsUser, gid: runAsGroup, permissions: 0600},

			PodSC: &api.PodSecurityContext{
				RunAsGroup: &runAsGroup,
			},
			SC: nil,
			Effective: &api.SecurityContext{
				RunAsGroup: &runAsGroup,
			},
		},
		{
			PodSC: &api.PodSecurityContext{
				RunAsGroup: &runAsGroupPod,
			},
			SC: &api.SecurityContext{
				RunAsGroup: &runAsGroup,
			},
			Effective: &api.SecurityContext{
				RunAsGroup: &runAsGroup,
			},
		},
	}

      {{- end }}
      {{- if .Values.postJob.securityContext.enabled }}
      securityContext:
        runAsUser: {{ .Values.postJob.securityContext.runAsUser }}
        runAsGroup: {{ .Values.postJob.securityContext.runAsGroup }}
        fsGroup: {{ .Values.postJob.securityContext.fsGroup }}
      {{- end }}
      volumes:
        - name: etc-path
          emptyDir: {}
        - name: tmp
          emptyDir: {}

	}

	if containerSc.RunAsUser != nil {
		effectiveSc.RunAsUser = new(int64)
		*effectiveSc.RunAsUser = *containerSc.RunAsUser
	}

	if containerSc.RunAsGroup != nil {
		effectiveSc.RunAsGroup = new(int64)
		*effectiveSc.RunAsGroup = *containerSc.RunAsGroup
	}

	if containerSc.RunAsNonRoot != nil {
		effectiveSc.RunAsNonRoot = new(bool)
		*effectiveSc.RunAsNonRoot = *containerSc.RunAsNonRoot
	}

		w.containerSC.SetRunAsUser(v)
	}
}
func (w *effectiveContainerSecurityContextWrapper) RunAsGroup() *int64 {
	if v := w.containerSC.RunAsGroup(); v != nil {
		return v
	}
	return w.podSC.RunAsGroup()
}
func (w *effectiveContainerSecurityContextWrapper) SetRunAsGroup(v *int64) {
	if !reflect.DeepEqual(w.RunAsGroup(), v) {
		w.containerSC.SetRunAsGroup(v)
	}
}

metadata:
  name: kube-addon-manager
  namespace: kube-system
  labels:
    component: kube-addon-manager
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
    runAsUser: {{runAsUser}}
    runAsGroup: {{runAsGroup}}
  priorityClassName: system-node-critical
  priority: 2000001000
  hostNetwork: true
  containers:
  - name: kube-addon-manager
    securityContext:
      allowPrivilegeEscalation: false

}

// WithRunAsGroup sets the RunAsGroup field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the RunAsGroup field is set to the value of the last call.
func (b *PodSecurityContextApplyConfiguration) WithRunAsGroup(value int64) *PodSecurityContextApplyConfiguration {
	b.RunAsGroup = &value
	return b
}

}

func newTestPodWithLinuxSecurityContext() *v1.Pod {
	anyGroup := int64(10)
	anyUser := int64(1000)
	pod := newTestPod()

	pod.Spec.SecurityContext = &v1.PodSecurityContext{
		SELinuxOptions: &v1.SELinuxOptions{
			User: "qux",
		},
		RunAsUser:  &anyUser,
		RunAsGroup: &anyGroup,
	}

	return pod
}

    "tier": "control-plane",
    "component": "kube-scheduler"
  }
},
"spec":{
"securityContext": {
  "seccompProfile": {
      "type": "RuntimeDefault"
  },
  "runAsUser": {{runAsUser}},
  "runAsGroup": {{runAsGroup}}
},
"priorityClassName": "system-node-critical",
"priority": 2000001000,
"hostNetwork": true,
"containers":[
    {
    "name": "kube-scheduler",
    "securityContext": {