SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai - projected - secret {{- end }} minio/templates/service.yaml {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} apiVersion:...

SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai - projected - secret {{- end }} minio/templates/service.yaml {{ $scheme := .Values.tls.enabled | ternary "https" "http" }} apiVersion: v1 kind: Service metadata:...

- PodSecurityPolicy objects now support a `MayRunAs` rule for `fsGroup` and `supplementalGroups` options. This allows specifying ranges of allowed GIDs for pods/containers without forcing a default GID the way `MustRunAs` does. This means that a container to which such a policy applies to won't use any fsGroup/supplementalGroup GID if not explicitly specified, yet a specified GID must still fall in the GID range according to the policy. ([#65135](ht...