}
		}

		if podSc.SupplementalGroupsPolicy != nil {
			policyValue, ok := runtimeapi.SupplementalGroupsPolicy_value[string(*podSc.SupplementalGroupsPolicy)]
			if !ok {
				return nil, fmt.Errorf("unsupported supplementalGroupsPolicy: %s", string(*podSc.SupplementalGroupsPolicy))
			}
			synthesized.SupplementalGroupsPolicy = runtimeapi.SupplementalGroupsPolicy(policyValue)
		}
	}

	}

	return pod
}

func newSupplementalGroupsPolicyPod(supplementalGroupsPolicy *v1.SupplementalGroupsPolicy) *v1.Pod {
	pod := newTestPod()
	if pod.Spec.SecurityContext == nil {
		pod.Spec.SecurityContext = &v1.PodSecurityContext{}
	}
	pod.Spec.SecurityContext.SupplementalGroupsPolicy = supplementalGroupsPolicy
	return pod
}

	SupplementalGroups       []int64                                          `json:"supplementalGroups,omitempty"`
	SupplementalGroupsPolicy *corev1.SupplementalGroupsPolicy                 `json:"supplementalGroupsPolicy,omitempty"`
	FSGroup                  *int64                                           `json:"fsGroup,omitempty"`

			}
		}
		if sc.SupplementalGroupsPolicy != nil {
			policyValue, ok := runtimeapi.SupplementalGroupsPolicy_value[string(*sc.SupplementalGroupsPolicy)]
			if !ok {
				return nil, fmt.Errorf("unsupported supplementalGroupsPolicy: %s", string(*sc.SupplementalGroupsPolicy))
			}
			lc.SecurityContext.SupplementalGroupsPolicy = runtimeapi.SupplementalGroupsPolicy(policyValue)
		}

		name           string
		pod            *v1.Pod
		expected       runtimeapi.SupplementalGroupsPolicy
		expectErr      bool
		expectedErrMsg string
	}{{
		name: "Merge SupplementalGroupsPolicy should convert to Merge",
		pod: &v1.Pod{
			Spec: v1.PodSpec{
				SecurityContext: &v1.PodSecurityContext{
					SupplementalGroupsPolicy: &supplementalGroupsPolicyMerge,
				},
				Containers: []v1.Container{

		featureEnabled bool
	}{
		"non nil user, SupplementalGroupsPolicy is disabled": {
			input: &runtimeapi.ContainerUser{
				Linux: &runtimeapi.LinuxContainerUser{
					Uid:                0,
					Gid:                0,
					SupplementalGroups: []int64{10},
				},
			},
			expected:       nil,
			featureEnabled: false,
		},
		"empty user, SupplementalGroupsPolicy is disabled": {

		}
	}

	// If the feature is disabled and not in use, drop the SupplementalGroupsPolicy field.
	if !utilfeature.DefaultFeatureGate.Enabled(features.SupplementalGroupsPolicy) && !supplementalGroupsPolicyInUse(oldPodSpec) {
		// Drop the field in podSpec only if SecurityContext is not nil.
		// If it is nil, there is no need to set supplementalGroupsPolicy=nil (it will be nil too).
		if podSpec.SecurityContext != nil {

	// owner: @everpeace
	// kep: https://kep.k8s.io/3619
	// alpha: v1.31
	//
	// Enable SupplementalGroupsPolicy feature in PodSecurityContext
	SupplementalGroupsPolicy featuregate.Feature = "SupplementalGroupsPolicy"
)

func init() {
	runtime.Must(utilfeature.DefaultMutableFeatureGate.Add(defaultKubernetesFeatureGates))

		pod                         func() *api.Pod
	}{
		{
			description:                 "with SupplementalGroupsPolicy and User",
			hasSupplementalGroupsPolicy: true,
			pod:                         podWithSupplementalGroupsPolicy,
		},
		{
			description:                 "without SupplementalGroupsPolicy and User",
			hasSupplementalGroupsPolicy: false,

          },
          "runAsUser": 2,
          "runAsGroup": 6,
          "runAsNonRoot": true,
          "supplementalGroups": [
            4
          ],
          "supplementalGroupsPolicy": "supplementalGroupsPolicyValue",
          "fsGroup": 5,
          "sysctls": [
            {
              "name": "nameValue",
              "value": "valueValue"
            }
          ],