return b
}

// WithFSGroup sets the FSGroup field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the FSGroup field is set to the value of the last call.
func (b *PodSecurityContextApplyConfiguration) WithFSGroup(value int64) *PodSecurityContextApplyConfiguration {
	b.FSGroup = &value
	return b
}

		}
	} else {
		mountVolume := &csipbv1.VolumeCapability_MountVolume{
			FsType:     fsType,
			MountFlags: mountOptions,
		}
		if fsGroup != nil {
			mountVolume.VolumeMountGroup = strconv.FormatInt(*fsGroup, 10 /* base */)
		}
		req.VolumeCapability.AccessType = &csipbv1.VolumeCapability_Mount{
			Mount: mountVolume,
		}
	}

	_, err := c.nodeClient.NodePublishVolume(ctx, req)

		nodeID string,
		maxVolumePerNode int64,
		accessibleTopology map[string]string,
		err error)

	// The caller is responsible for checking whether the driver supports
	// applying FSGroup by calling NodeSupportsVolumeMountGroup().
	// If the driver does not, fsGroup must be set to nil.
	NodePublishVolume(
		ctx context.Context,
		volumeid string,
		readOnly bool,
		stagingTargetPath string,
		targetPath string,

	api "k8s.io/kubernetes/pkg/apis/core"
	"k8s.io/utils/pointer"
)

func TestPodSecurityContextAccessor(t *testing.T) {
	fsGroup := int64(2)
	runAsUser := int64(1)
	runAsGroup := int64(1)
	runAsNonRoot := true

	testcases := []*api.PodSecurityContext{
		nil,
		{},
		{FSGroup: &fsGroup},
		{HostIPC: true},
		{HostNetwork: true},
		{HostPID: true},
		{RunAsNonRoot: &runAsNonRoot},
		{RunAsUser: &runAsUser},

        app: hello
    spec:
      containers:
      - name: hello
        image: "fake.docker.io/google-samples/hello-go-gke:1.0"
      # We expect this to get overwritten to 1337
      securityContext:

			}

			var fsGroup *int64
			if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.FSGroup != nil {
				fsGroup = pod.Spec.SecurityContext.FSGroup
			}

			csiMounter := mounter.(*csiMountMgr)
			csiMounter.csiClient = csiClient
			var mounterArgs volume.MounterArgs
			mounterArgs.FsGroup = fsGroup
			err = csiMounter.SetUp(mounterArgs)

	SupportsMetrics  bool `json:"supportsMetrics"`
	FSGroup          bool `json:"fsGroup"`
	RequiresFSResize bool `json:"requiresFSResize"`
}

func defaultCapabilities() *DriverCapabilities {
	return &DriverCapabilities{
		Attach:           true,
		SELinuxRelabel:   true,
		SupportsMetrics:  false,
		FSGroup:          true,
		RequiresFSResize: true,
	}
}

      app: external-forward-proxy
  template:
    metadata:
      labels:
        app: external-forward-proxy
    spec:
      securityContext:
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
      containers:
      - name: external-forward-proxy
        image: envoyproxy/envoy:v1.21.0
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: external-forward-proxy-config

  template:
    metadata:
      labels:
        k8s-app: calico-typha-autoscaler
    spec:
      priorityClassName: system-cluster-critical
      securityContext:
        supplementalGroups: [ 65534 ]
        fsGroup: 65534
      containers:
      - image: registry.k8s.io/cluster-proportional-autoscaler-amd64:1.7.1
        name: autoscaler
        command:
          - /cluster-proportional-autoscaler

		},
		{
			testName:                       "fsgroup provided, driver supports volume mount group; expect fsgroup to be passed to NodeStageVolume",
			volName:                        "test-vol1",
			devicePath:                     "path1",
			deviceMountPath:                "path2",
			fsGroup:                        &testFSGroup,
			driverSupportsVolumeMountGroup: true,