Feat support security fsgroup (#1613)

* feat: support security context fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* test: add unit test to security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* test: add functional test to security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* docs: add documentation of the new label of security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

---------

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

pkg/kobject/kobject.go

@@ -149,6 +149,7 @@ type ServiceConfig struct {
 	Dockerfile         string             `compose:"dockerfile"`
 	Replicas           int                `compose:"replicas"`
 	GroupAdd           []int64            `compose:"group_add"`
+	FsGroup            int64              `compose:"kompose.security-context.fsgroup"`
 	Volumes            []Volumes          `compose:""`
 	Secrets            []types.ServiceSecretConfig
 	HealthChecks       HealthChecks `compose:""`

pkg/loader/compose/compose.go

@@ -705,6 +705,8 @@ func parseKomposeLabels(labels map[string]string, serviceConfig *kobject.Service
 			}
 
 			serviceConfig.ServiceExternalTrafficPolicy = serviceExternalTypeTrafficPolicy
+		case LabelSecurityContextFsGroup:
+			serviceConfig.FsGroup = cast.ToInt64(value)
 		case LabelServiceExpose:
 			serviceConfig.ExposeService = strings.Trim(strings.ToLower(value), " ,")
 		case LabelNodePortPort:

pkg/loader/compose/utils.go

@@ -79,6 +79,8 @@ const (
 
 	// ServiceTypeHeadless ...
 	ServiceTypeHeadless = "Headless"
+	// LabelSecurityContextFsGroup defines the pod FsGroup
+	LabelSecurityContextFsGroup = "kompose.security-context.fsgroup"
 )
 
 // load environment variables from compose file

pkg/transformer/kubernetes/k8sutils.go

@@ -549,6 +549,11 @@ func (k *Kubernetes) UpdateKubernetesObjects(name string, service kobject.Servic
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Security Context FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {

pkg/transformer/kubernetes/kubernetes_test.go

@@ -51,6 +51,7 @@ func newServiceConfig() kobject.ServiceConfig {
 		VolList:         []string{"/tmp/volume"},
 		Network:         []string{"network1", "network2"}, // supported
 		Labels:          nil,
+		FsGroup:         1001,
 		Annotations:     map[string]string{"abc": "def"},
 		CPUQuota:        1, // not supported
 		CapAdd:          []string{"cap_add"},
@@ -209,6 +210,9 @@ func checkPodTemplate(config kobject.ServiceConfig, template api.PodTemplateSpec
 	if config.Privileged == privilegedNilOrFalse(template) {
 		return fmt.Errorf("Found different template privileged: %#v vs. %#v", config.Privileged, template.Spec.Containers[0].SecurityContext)
 	}
+	if config.FsGroup != *template.Spec.SecurityContext.FSGroup {
+		return fmt.Errorf("Found different pod security context fs group values: %#v vs. %#v", config.FsGroup, *template.Spec.SecurityContext.FSGroup)
+	}
 	if config.Stdin != template.Spec.Containers[0].Stdin {
 		return fmt.Errorf("Found different values for stdin: %#v vs. %#v", config.Stdin, template.Spec.Containers[0].Stdin)
 	}

pkg/transformer/kubernetes/podspec.go

@@ -128,6 +128,11 @@ func SecurityContext(name string, service kobject.ServiceConfig) PodSpecOption {
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Pod FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {