Feat support security fsgroup (#1613)

* feat: support security context fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* test: add unit test to security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* test: add functional test to security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

* docs: add documentation of the new label of security group fsgroup

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

---------

Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>

pkg/transformer/kubernetes/k8sutils.go

@@ -549,6 +549,11 @@ func (k *Kubernetes) UpdateKubernetesObjects(name string, service kobject.Servic
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Security Context FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {

pkg/transformer/kubernetes/kubernetes_test.go

@@ -51,6 +51,7 @@ func newServiceConfig() kobject.ServiceConfig {
 		VolList:         []string{"/tmp/volume"},
 		Network:         []string{"network1", "network2"}, // supported
 		Labels:          nil,
+		FsGroup:         1001,
 		Annotations:     map[string]string{"abc": "def"},
 		CPUQuota:        1, // not supported
 		CapAdd:          []string{"cap_add"},
@@ -209,6 +210,9 @@ func checkPodTemplate(config kobject.ServiceConfig, template api.PodTemplateSpec
 	if config.Privileged == privilegedNilOrFalse(template) {
 		return fmt.Errorf("Found different template privileged: %#v vs. %#v", config.Privileged, template.Spec.Containers[0].SecurityContext)
 	}
+	if config.FsGroup != *template.Spec.SecurityContext.FSGroup {
+		return fmt.Errorf("Found different pod security context fs group values: %#v vs. %#v", config.FsGroup, *template.Spec.SecurityContext.FSGroup)
+	}
 	if config.Stdin != template.Spec.Containers[0].Stdin {
 		return fmt.Errorf("Found different values for stdin: %#v vs. %#v", config.Stdin, template.Spec.Containers[0].Stdin)
 	}

pkg/transformer/kubernetes/podspec.go

@@ -128,6 +128,11 @@ func SecurityContext(name string, service kobject.ServiceConfig) PodSpecOption {
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Pod FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {