This setting enables a pod to specify a `PodFSGroupChangePolicy` that indicates that volume ownership and permissions will be changed only when permission and ownership of the root directory do not match with expected permissions on the volume.

	out.FSGroup = (*int64)(unsafe.Pointer(in.FSGroup))
	out.Sysctls = *(*[]core.Sysctl)(unsafe.Pointer(&in.Sysctls))
	out.FSGroupChangePolicy = (*core.PodFSGroupChangePolicy)(unsafe.Pointer(in.FSGroupChangePolicy))
	out.SeccompProfile = (*core.SeccompProfile)(unsafe.Pointer(in.SeccompProfile))
	out.AppArmorProfile = (*core.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile))
	return nil

		in, out := &in.FSGroup, &out.FSGroup
		*out = new(int64)
		**out = **in
	}
	if in.FSGroupChangePolicy != nil {
		in, out := &in.FSGroupChangePolicy, &out.FSGroupChangePolicy
		*out = new(PodFSGroupChangePolicy)
		**out = **in
	}
	if in.Sysctls != nil {
		in, out := &in.Sysctls, &out.Sysctls
		*out = make([]Sysctl, len(*in))
		copy(*out, *in)
	}
	if in.SeccompProfile != nil {

		*out = make([]Sysctl, len(*in))
		copy(*out, *in)
	}
	if in.FSGroupChangePolicy != nil {
		in, out := &in.FSGroupChangePolicy, &out.FSGroupChangePolicy
		*out = new(PodFSGroupChangePolicy)
		**out = **in
	}
	if in.SeccompProfile != nil {
		in, out := &in.SeccompProfile, &out.SeccompProfile
		*out = new(SeccompProfile)
		(*in).DeepCopyInto(*out)
	}

	}
	return allErrors
}

var validFSGroupChangePolicies = sets.New(core.FSGroupChangeOnRootMismatch, core.FSGroupChangeAlways)

func validateFSGroupChangePolicy(fsGroupPolicy *core.PodFSGroupChangePolicy, fldPath *field.Path) field.ErrorList {
	allErrors := field.ErrorList{}
	if !validFSGroupChangePolicies.Has(*fsGroupPolicy) {

	maxUserID := int64(2147483647)
	minGroupID := int64(0)
	maxGroupID := int64(2147483647)
	goodfsGroupChangePolicy := core.FSGroupChangeAlways
	badfsGroupChangePolicy1 := core.PodFSGroupChangePolicy("invalid")
	badfsGroupChangePolicy2 := core.PodFSGroupChangePolicy("")

	successCases := map[string]core.PodSpec{
		"populate basic fields, leave defaults for most": {

			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthGenerated
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			s := PodFSGroupChangePolicy(dAtA[iNdEx:postIndex])
			m.FSGroupChangePolicy = &s
			iNdEx = postIndex
		case 10:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field SeccompProfile", wireType)