@@ -32,8 +32,26 @@ At that time, the openshift docker registry image must be upgraded in order to c

 1. The `volume.metadata` field is deprecated as of Origin 1.0.6 in favor of `volume.downwardAPI`.

-1. New fields (`allowHostPID` and `allowHostIPC`) have been added to the default SCCs in Origin 1.0.7.  

-You may set these fields manually or [reset your default SCCs](https://docs.openshift.org/latest/admin_guide/manage_scc.html#updating-the-default-security-context-constraints).

+1. New fields (`fsGroup`, `supplementalGroups`, `allowHostPID` and `allowHostIPC`) have been added 

+to the default SCCs in Origin 1.0.7.  These allow you to control groups for persistent volumes,

+supplemental groups for the container, and usage of the host PID/IPC namespaces.  The fields will 

+default as follows for existing SCCs:

+

+  1.  allowHostPID - defaults to false.  You may wish to change this to true on any privileged SCCs or 

+  [reset your default SCCs](https://docs.openshift.org/latest/admin_guide/manage_scc.html#updating-the-default-security-context-constraints) 

+  which will set this field to true for the privileged SCC and false for the restricted SCC.

+  1.  allowHostIPC - defaults to false.  You may wish to change this to true on any privileged SCCs or 

+  [reset your default SCCs](https://docs.openshift.org/latest/admin_guide/manage_scc.html#updating-the-default-security-context-constraints) 

+  which will set this field to true for the privileged SCC and false for the restricted SCC.

+  1.  fsGroup - if the strategy type is unset this field will default based on the runAsUser strategy.

+  If runAsUser is set to RunAsAny this field will also be set to RunAsAny.  If the strategy type is

+  any other value this field will default to MustRunAs and look to the namespace for [annotation 

+  configuration](https://docs.openshift.org/latest/architecture/additional_concepts/authorization.html#understanding-pre-allocated-values-and-security-context-constraints).

+  1.  supplementalGroups - if the strategy type is unset this field will default based on the runAsUser strategy.

+  If runAsUser is set to RunAsAny this field will also be set to RunAsAny.  If the strategy type is

+  any other value this field will default to MustRunAs and look to the namespace for [annotation 

+  configuration](https://docs.openshift.org/latest/architecture/additional_concepts/authorization.html#understanding-pre-allocated-values-and-security-context-constraints).    

+   

 1. The `v1beta3` API version is being removed in Origin 1.1 (OSE 3.1).

 Existing `v1beta3` resources stored in etcd will still be readable and

@@ -31,6 +31,12 @@ func GetBootstrapSecurityContextConstraints(buildControllerUsername string) []ka

 			RunAsUser: kapi.RunAsUserStrategyOptions{

 				Type: kapi.RunAsUserStrategyRunAsAny,

 			},

+			FSGroup: kapi.FSGroupStrategyOptions{

+				Type: kapi.FSGroupStrategyRunAsAny,

+			},

+			SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+				Type: kapi.SupplementalGroupsStrategyRunAsAny,

+			},

 			Users:  []string{buildControllerUsername},

 			Groups: []string{ClusterAdminGroup, NodesGroup},

 		},

@@ -50,6 +56,22 @@ func GetBootstrapSecurityContextConstraints(buildControllerUsername string) []ka

 				// will fail.

 				Type: kapi.RunAsUserStrategyMustRunAsRange,

 			},

+			FSGroup: kapi.FSGroupStrategyOptions{

+				// This strategy requires that annotations on the namespace which will be populated

+				// by the admission controller.  Admission will first look for the SupplementalGroupsAnnotation

+				// on the namespace and if it is unable to find that annotation it will attempt

+				// to use the UIDRangeAnnotation.  If neither annotation exists then creation

+				// of the SCC will fail.

+				Type: kapi.FSGroupStrategyMustRunAs,

+			},

+			SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+				// This strategy requires that annotations on the namespace which will be populated

+				// by the admission controller.  Admission will first look for the SupplementalGroupsAnnotation

+				// on the namespace and if it is unable to find that annotation it will attempt

+				// to use the UIDRangeAnnotation.  If neither annotation exists then creation

+				// of the SCC will fail.

+				Type: kapi.SupplementalGroupsStrategyMustRunAs,

+			},

 			Groups: []string{AuthenticatedGroup},

 		},

 	}

@@ -15,6 +15,7 @@ import (

 	"k8s.io/kubernetes/pkg/fields"

 	"k8s.io/kubernetes/pkg/labels"

 	"k8s.io/kubernetes/pkg/runtime"

+	sc "k8s.io/kubernetes/pkg/securitycontext"

 	scc "k8s.io/kubernetes/pkg/securitycontextconstraints"

 	"k8s.io/kubernetes/pkg/util/sets"

 	"k8s.io/kubernetes/pkg/watch"

@@ -164,24 +165,46 @@ func assignSecurityContext(provider scc.SecurityContextConstraintsProvider, pod

 	errs := fielderrors.ValidationErrorList{}

-	for i, c := range pod.Spec.Containers {

-		sc, err := provider.CreateSecurityContext(pod, &c)

+	psc, err := provider.CreatePodSecurityContext(pod)

+	if err != nil {

+		errs = append(errs, fielderrors.NewFieldInvalid("spec.securityContext", pod.Spec.SecurityContext, err.Error()))

+	}

+

+	// save the original PSC and validate the generated PSC.  Leave the generated PSC

+	// set for container generation/validation.  We will reset to original post container

+	// validation.

+	originalPSC := pod.Spec.SecurityContext

+	pod.Spec.SecurityContext = psc

+	errs = append(errs, provider.ValidatePodSecurityContext(pod).Prefix("spec.securityContext")...)

+

+	// Note: this is not changing the original container, we will set container SCs later so long

+	// as all containers validated under the same SCC.

+	for i, containerCopy := range pod.Spec.Containers {

+		// We will determine the effective security context for the container and validate against that

+		// since that is how the sc provider will eventually apply settings in the runtime.

+		// This results in an SC that is based on the Pod's PSC with the set fields from the container

+		// overriding pod level settings.

+		containerCopy.SecurityContext = sc.DetermineEffectiveSecurityContext(pod, &containerCopy)

+

+		sc, err := provider.CreateContainerSecurityContext(pod, &containerCopy)

 		if err != nil {

 			errs = append(errs, fielderrors.NewFieldInvalid(fmt.Sprintf("spec.containers[%d].securityContext", i), "", err.Error()))

 			continue

 		}

 		generatedSCs[i] = sc

-		c.SecurityContext = sc

-		errs = append(errs, provider.ValidateSecurityContext(pod, &c).Prefix(fmt.Sprintf("spec.containers[%d].securityContext", i))...)

+		containerCopy.SecurityContext = sc

+		errs = append(errs, provider.ValidateContainerSecurityContext(pod, &containerCopy).Prefix(fmt.Sprintf("spec.containers[%d].securityContext", i))...)

 	}

 	if len(errs) > 0 {

+		// ensure psc is not mutated if there are errors

+		pod.Spec.SecurityContext = originalPSC

 		return errs

 	}

 	// if we've reached this code then we've generated and validated an SC for every container in the

-	// pod so let's apply what we generated

+	// pod so let's apply what we generated.  Note: the psc is already applied.

 	for i, sc := range generatedSCs {

 		pod.Spec.Containers[i].SecurityContext = sc

 	}

@@ -205,51 +228,63 @@ func (c *constraint) createProvidersFromConstraints(ns string, sccs []*kapi.Secu

 		var err error

 		resolveUIDRange := requiresPreAllocatedUIDRange(constraint)

 		resolveSELinuxLevel := requiresPreAllocatedSELinuxLevel(constraint)

+		resolveFSGroup := requiresPreallocatedFSGroup(constraint)

+		resolveSupplementalGroups := requiresPreallocatedSupplementalGroups(constraint)

+		requiresNamespaceAllocations := resolveUIDRange || resolveSELinuxLevel || resolveFSGroup || resolveSupplementalGroups

-		if resolveUIDRange || resolveSELinuxLevel {

-			var min, max *int64

-			var level string

-

+		if requiresNamespaceAllocations {

 			// Ensure we have the namespace

-			if namespace, err = c.getNamespace(ns, namespace); err != nil {

+			namespace, err = c.getNamespace(ns, namespace)

+			if err != nil {

 				errs = append(errs, fmt.Errorf("error fetching namespace %s required to preallocate values for %s: %v", ns, constraint.Name, err))

 				continue

 			}

+		}

-			// Resolve the values from the namespace

-			if resolveUIDRange {

-				if min, max, err = getPreallocatedUIDRange(namespace); err != nil {

-					errs = append(errs, fmt.Errorf("unable to find pre-allocated uid annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

-					continue

-				}

+		// Make a copy of the constraint so we don't mutate the store's cache

+		var constraintCopy kapi.SecurityContextConstraints = *constraint

+		constraint = &constraintCopy

+

+		// Resolve the values from the namespace

+		if resolveUIDRange {

+			constraint.RunAsUser.UIDRangeMin, constraint.RunAsUser.UIDRangeMax, err = getPreallocatedUIDRange(namespace)

+			if err != nil {

+				errs = append(errs, fmt.Errorf("unable to find pre-allocated uid annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

+				continue

 			}

-			if resolveSELinuxLevel {

-				if level, err = getPreallocatedLevel(namespace); err != nil {

-					errs = append(errs, fmt.Errorf("unable to find pre-allocated mcs annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

-					continue

-				}

+		}

+		if resolveSELinuxLevel {

+			var level string

+			if level, err = getPreallocatedLevel(namespace); err != nil {

+				errs = append(errs, fmt.Errorf("unable to find pre-allocated mcs annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

+				continue

 			}

-			// Make a copy of the constraint so we don't mutate the store's cache

-			var constraintCopy kapi.SecurityContextConstraints = *constraint

-			constraint = &constraintCopy

-			if resolveSELinuxLevel && constraint.SELinuxContext.SELinuxOptions != nil {

-				// Make a copy of the SELinuxOptions so we don't mutate the store's cache

+			// SELinuxOptions is a pointer, if we are resolving and it is already initialized

+			// we need to make a copy of it so we don't manipulate the store's cache.

+			if constraint.SELinuxContext.SELinuxOptions != nil {

 				var seLinuxOptionsCopy kapi.SELinuxOptions = *constraint.SELinuxContext.SELinuxOptions

 				constraint.SELinuxContext.SELinuxOptions = &seLinuxOptionsCopy

+			} else {

+				constraint.SELinuxContext.SELinuxOptions = &kapi.SELinuxOptions{}

 			}

-

-			// Set the resolved values

-			if resolveUIDRange {

-				constraint.RunAsUser.UIDRangeMin = min

-				constraint.RunAsUser.UIDRangeMax = max

+			constraint.SELinuxContext.SELinuxOptions.Level = level

+		}

+		if resolveFSGroup {

+			fsGroup, err := getPreallocatedFSGroup(namespace)

+			if err != nil {

+				errs = append(errs, fmt.Errorf("unable to find pre-allocated group annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

+				continue

 			}

-			if resolveSELinuxLevel {

-				if constraint.SELinuxContext.SELinuxOptions == nil {

-					constraint.SELinuxContext.SELinuxOptions = &kapi.SELinuxOptions{}

-				}

-				constraint.SELinuxContext.SELinuxOptions.Level = level

+			constraint.FSGroup.Ranges = fsGroup

+		}

+		if resolveSupplementalGroups {

+			supplementalGroups, err := getPreallocatedSupplementalGroups(namespace)

+			if err != nil {

+				errs = append(errs, fmt.Errorf("unable to find pre-allocated group annotation for namespace %s while trying to configure SCC %s: %v", namespace.Name, constraint.Name, err))

+				continue

 			}

+			constraint.SupplementalGroups.Ranges = supplementalGroups

 		}

 		// Create the provider

@@ -315,7 +350,7 @@ func constraintSupportsGroup(group string, constraintGroups []string) bool {

 	return false

 }

-// getPreallocatedUIDRange retrieves the annotated value from the service account, splits it to make

+// getPreallocatedUIDRange retrieves the annotated value from the namespace, splits it to make

 // the min/max and formats the data into the necessary types for the strategy options.

 func getPreallocatedUIDRange(ns *kapi.Namespace) (*int64, *int64, error) {

 	annotationVal, ok := ns.Annotations[allocator.UIDRangeAnnotation]

@@ -336,7 +371,7 @@ func getPreallocatedUIDRange(ns *kapi.Namespace) (*int64, *int64, error) {

 	return &min, &max, nil

 }

-// getPreallocatedLevel gets the annotated value from the service account.

+// getPreallocatedLevel gets the annotated value from the namespace.

 func getPreallocatedLevel(ns *kapi.Namespace) (string, error) {

 	level, ok := ns.Annotations[allocator.MCSAnnotation]

 	if !ok {

@@ -349,6 +384,87 @@ func getPreallocatedLevel(ns *kapi.Namespace) (string, error) {

 	return level, nil

 }

+// getSupplementalGroupsAnnotation provides a backwards compatible way to get supplemental groups

+// annotations from a namespace by looking for SupplementalGroupsAnnotation and falling back to

+// UIDRangeAnnotation if it is not found.

+func getSupplementalGroupsAnnotation(ns *kapi.Namespace) (string, error) {

+	groups, ok := ns.Annotations[allocator.SupplementalGroupsAnnotation]

+	if !ok {

+		glog.V(4).Infof("unable to find supplemental group annotation %s falling back to %s", allocator.SupplementalGroupsAnnotation, allocator.UIDRangeAnnotation)

+

+		groups, ok = ns.Annotations[allocator.UIDRangeAnnotation]

+		if !ok {

+			return "", fmt.Errorf("unable to find supplemental group or uid annotation for namespace %s", ns.Name)

+		}

+	}

+

+	if len(groups) == 0 {

+		return "", fmt.Errorf("unable to find groups using %s and %s annotations", allocator.SupplementalGroupsAnnotation, allocator.UIDRangeAnnotation)

+	}

+	return groups, nil

+}

+

+// getPreallocatedFSGroup gets the annotated value from the namespace.

+func getPreallocatedFSGroup(ns *kapi.Namespace) ([]kapi.IDRange, error) {

+	groups, err := getSupplementalGroupsAnnotation(ns)

+	if err != nil {

+		return nil, err

+	}

+	glog.V(4).Infof("got preallocated value for groups: %s in namespace %s", groups, ns.Name)

+

+	blocks, err := parseSupplementalGroupAnnotation(groups)

+	if err != nil {

+		return nil, err

+	}

+	return []kapi.IDRange{

+		{

+			Min: int64(blocks[0].Start),

+			Max: int64(blocks[0].Start),

+		},

+	}, nil

+}

+

+// getPreallocatedSupplementalGroups gets the annotated value from the namespace.

+func getPreallocatedSupplementalGroups(ns *kapi.Namespace) ([]kapi.IDRange, error) {

+	groups, err := getSupplementalGroupsAnnotation(ns)

+	if err != nil {

+		return nil, err

+	}

+	glog.V(4).Infof("got preallocated value for groups: %s in namespace %s", groups, ns.Name)

+

+	blocks, err := parseSupplementalGroupAnnotation(groups)

+	if err != nil {

+		return nil, err

+	}

+

+	idRanges := []kapi.IDRange{}

+	for _, block := range blocks {

+		rng := kapi.IDRange{

+			Min: int64(block.Start),

+			Max: int64(block.End),

+		}

+		idRanges = append(idRanges, rng)

+	}

+	return idRanges, nil

+}

+

+// parseSupplementalGroupAnnotation parses the group annotation into blocks.

+func parseSupplementalGroupAnnotation(groups string) ([]uid.Block, error) {

+	blocks := []uid.Block{}

+	segments := strings.Split(groups, ",")

+	for _, segment := range segments {

+		block, err := uid.ParseBlock(segment)

+		if err != nil {

+			return nil, err

+		}

+		blocks = append(blocks, block)

+	}

+	if len(blocks) == 0 {

+		return nil, fmt.Errorf("no blocks parsed from annotation %s", groups)

+	}

+	return blocks, nil

+}

+

 // requiresPreAllocatedUIDRange returns true if the strategy is must run in range and the min or max

 // is not set.

 func requiresPreAllocatedUIDRange(constraint *kapi.SecurityContextConstraints) bool {

@@ -369,6 +485,24 @@ func requiresPreAllocatedSELinuxLevel(constraint *kapi.SecurityContextConstraint

 	return constraint.SELinuxContext.SELinuxOptions.Level == ""

 }

+// requiresPreAllocatedSELinuxLevel returns true if the strategy is must run as and there is no

+// range specified.

+func requiresPreallocatedSupplementalGroups(constraint *kapi.SecurityContextConstraints) bool {

+	if constraint.SupplementalGroups.Type != kapi.SupplementalGroupsStrategyMustRunAs {

+		return false

+	}

+	return len(constraint.SupplementalGroups.Ranges) == 0

+}

+

+// requiresPreallocatedFSGroup returns true if the strategy is must run as and there is no

+// range specified.

+func requiresPreallocatedFSGroup(constraint *kapi.SecurityContextConstraints) bool {

+	if constraint.FSGroup.Type != kapi.FSGroupStrategyMustRunAs {

+		return false

+	}

+	return len(constraint.FSGroup.Ranges) == 0

+}

+

 // deduplicateSecurityContextConstraints ensures we have a unique slice of constraints.

 func deduplicateSecurityContextConstraints(sccs []*kapi.SecurityContextConstraints) []*kapi.SecurityContextConstraints {

 	deDuped := []*kapi.SecurityContextConstraints{}

@@ -15,6 +15,7 @@ import (

 	"k8s.io/kubernetes/pkg/util"

 	allocator "github.com/openshift/origin/pkg/security"

+	"github.com/openshift/origin/pkg/security/uid"

 )

 func NewTestAdmission(store cache.Store, kclient client.Interface) kadmission.Interface {

@@ -31,11 +32,16 @@ func TestAdmit(t *testing.T) {

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "default",

 			Annotations: map[string]string{

-				allocator.UIDRangeAnnotation: "1/3",

-				allocator.MCSAnnotation:      "s0:c1,c0",

+				allocator.UIDRangeAnnotation:           "1/3",

+				allocator.MCSAnnotation:                "s0:c1,c0",

+				allocator.SupplementalGroupsAnnotation: "2/3",

 			},

 		},

 	}

+

+	// used for cases where things are preallocated

+	defaultGroup := int64(2)

+

 	serviceAccount := &kapi.ServiceAccount{

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "default",

@@ -55,6 +61,12 @@ func TestAdmit(t *testing.T) {

 		SELinuxContext: kapi.SELinuxContextStrategyOptions{

 			Type: kapi.SELinuxStrategyMustRunAs,

 		},

+		FSGroup: kapi.FSGroupStrategyOptions{

+			Type: kapi.FSGroupStrategyMustRunAs,

+		},

+		SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+			Type: kapi.SupplementalGroupsStrategyMustRunAs,

+		},

 		Groups: []string{"system:serviceaccounts"},

 	}

 	// create scc that has specific requirements that shouldn't match but is permissioned to

@@ -74,6 +86,18 @@ func TestAdmit(t *testing.T) {

 				Level: "s9:z0,z1",

 			},

 		},

+		FSGroup: kapi.FSGroupStrategyOptions{

+			Type: kapi.FSGroupStrategyMustRunAs,

+			Ranges: []kapi.IDRange{

+				{Min: 999, Max: 999},

+			},

+		},

+		SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+			Type: kapi.SupplementalGroupsStrategyMustRunAs,

+			Ranges: []kapi.IDRange{

+				{Min: 999, Max: 999},

+			},

+		},

 		Groups: []string{"system:serviceaccounts"},

 	}

 	store := cache.NewStore(cache.MetaNamespaceKeyFunc)

@@ -125,6 +149,23 @@ func TestAdmit(t *testing.T) {

 		Level: "s0:c1,c0",

 	}

+	// specifies an FSGroup in the range of preallocated sup group annotation

+	specifyFSGroupInRange := goodPod()

+	// group in the range of a preallocated fs group which, by default is a single digit range

+	// based on the first value of the ns annotation.

+	goodFSGroup := int64(2)

+	specifyFSGroupInRange.Spec.SecurityContext.FSGroup = &goodFSGroup

+

+	// specifies a sup group in the range of preallocated sup group annotation

+	specifySupGroup := goodPod()

+	// group is not the default but still in the range

+	specifySupGroup.Spec.SecurityContext.SupplementalGroups = []int64{3}

+

+	specifyPodLevelSELinux := goodPod()

+	specifyPodLevelSELinux.Spec.SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{

+		Level: "s0:c1,c0",

+	}

+

 	requestsHostNetwork := goodPod()

 	requestsHostNetwork.Spec.SecurityContext.HostNetwork = true

@@ -137,12 +178,29 @@ func TestAdmit(t *testing.T) {

 	requestsHostPorts := goodPod()

 	requestsHostPorts.Spec.Containers[0].Ports = []kapi.ContainerPort{{HostPort: 1}}

+	requestsSupplementalGroup := goodPod()

+	requestsSupplementalGroup.Spec.SecurityContext.SupplementalGroups = []int64{1}

+

+	requestsFSGroup := goodPod()

+	fsGroup := int64(1)

+	requestsFSGroup.Spec.SecurityContext.FSGroup = &fsGroup

+

+	requestsPodLevelMCS := goodPod()

+	requestsPodLevelMCS.Spec.SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{

+		User:  "user",

+		Type:  "type",

+		Role:  "role",

+		Level: "level",

+	}

+

 	testCases := map[string]struct {

-		pod           *kapi.Pod

-		shouldAdmit   bool

-		expectedUID   int64

-		expectedLevel string

-		expectedPriv  bool

+		pod               *kapi.Pod

+		shouldAdmit       bool

+		expectedUID       int64

+		expectedLevel     string

+		expectedFSGroup   int64

+		expectedSupGroups []int64

+		expectedPriv      bool

 	}{

 		"uidNotInRange": {

 			pod:         uidNotInRange,

@@ -157,16 +215,44 @@ func TestAdmit(t *testing.T) {

 			shouldAdmit: false,

 		},

 		"specifyUIDInRange": {

-			pod:           specifyUIDInRange,

-			shouldAdmit:   true,

-			expectedUID:   *specifyUIDInRange.Spec.Containers[0].SecurityContext.RunAsUser,

-			expectedLevel: "s0:c1,c0",

+			pod:               specifyUIDInRange,

+			shouldAdmit:       true,

+			expectedUID:       *specifyUIDInRange.Spec.Containers[0].SecurityContext.RunAsUser,

+			expectedLevel:     "s0:c1,c0",

+			expectedFSGroup:   defaultGroup,

+			expectedSupGroups: []int64{defaultGroup},

 		},

 		"specifyLabels": {

-			pod:           specifyLabels,

-			shouldAdmit:   true,

-			expectedUID:   1,

-			expectedLevel: specifyLabels.Spec.Containers[0].SecurityContext.SELinuxOptions.Level,

+			pod:               specifyLabels,

+			shouldAdmit:       true,

+			expectedUID:       1,

+			expectedLevel:     specifyLabels.Spec.Containers[0].SecurityContext.SELinuxOptions.Level,

+			expectedFSGroup:   defaultGroup,

+			expectedSupGroups: []int64{defaultGroup},

+		},

+		"specifyFSGroup": {

+			pod:               specifyFSGroupInRange,

+			shouldAdmit:       true,

+			expectedUID:       1,

+			expectedLevel:     "s0:c1,c0",

+			expectedFSGroup:   *specifyFSGroupInRange.Spec.SecurityContext.FSGroup,

+			expectedSupGroups: []int64{defaultGroup},

+		},

+		"specifySupGroup": {

+			pod:               specifySupGroup,

+			shouldAdmit:       true,

+			expectedUID:       1,

+			expectedLevel:     "s0:c1,c0",

+			expectedFSGroup:   defaultGroup,

+			expectedSupGroups: []int64{specifySupGroup.Spec.SecurityContext.SupplementalGroups[0]},

+		},

+		"specifyPodLevelSELinuxLevel": {

+			pod:               specifyPodLevelSELinux,

+			shouldAdmit:       true,

+			expectedUID:       1,

+			expectedLevel:     "s0:c1,c0",

+			expectedFSGroup:   defaultGroup,

+			expectedSupGroups: []int64{defaultGroup},

 		},

 		"requestsHostNetwork": {

 			pod:         requestsHostNetwork,

@@ -184,6 +270,18 @@ func TestAdmit(t *testing.T) {

 			pod:         requestsHostIPC,

 			shouldAdmit: false,

 		},

+		"requestsSupplementalGroup": {

+			pod:         requestsSupplementalGroup,

+			shouldAdmit: false,

+		},

+		"requestsFSGroup": {

+			pod:         requestsFSGroup,

+			shouldAdmit: false,

+		},

+		"requestsPodLevelMCS": {

+			pod:         requestsPodLevelMCS,

+			shouldAdmit: false,

+		},

 	}

 	for k, v := range testCases {

@@ -205,12 +303,30 @@ func TestAdmit(t *testing.T) {

 			if validatedSCC != saSCC.Name {

 				t.Errorf("%s should have validated against %s but found %s", k, saSCC.Name, validatedSCC)

 			}

+

+			// ensure anything we expected to be defaulted on the container level is set

 			if *v.pod.Spec.Containers[0].SecurityContext.RunAsUser != v.expectedUID {

 				t.Errorf("%s expected UID %d but found %d", k, v.expectedUID, *v.pod.Spec.Containers[0].SecurityContext.RunAsUser)

 			}

 			if v.pod.Spec.Containers[0].SecurityContext.SELinuxOptions.Level != v.expectedLevel {

 				t.Errorf("%s expected Level %s but found %s", k, v.expectedLevel, v.pod.Spec.Containers[0].SecurityContext.SELinuxOptions.Level)

 			}

+

+			// ensure anything we expected to be defaulted on the pod level is set

+			if v.pod.Spec.SecurityContext.SELinuxOptions.Level != v.expectedLevel {

+				t.Errorf("%s expected pod level SELinux Level %s but found %s", k, v.expectedLevel, v.pod.Spec.SecurityContext.SELinuxOptions.Level)

+			}

+			if *v.pod.Spec.SecurityContext.FSGroup != v.expectedFSGroup {

+				t.Errorf("%s expected fsgroup %d but found %d", k, v.expectedFSGroup, *v.pod.Spec.SecurityContext.FSGroup)

+			}

+			if len(v.pod.Spec.SecurityContext.SupplementalGroups) != len(v.expectedSupGroups) {

+				t.Errorf("%s found unexpected supplemental groups.  Expected: %v, actual %v", k, v.expectedSupGroups, v.pod.Spec.SecurityContext.SupplementalGroups)

+			}

+			for _, g := range v.expectedSupGroups {

+				if !hasSupGroup(g, v.pod.Spec.SecurityContext.SupplementalGroups) {

+					t.Errorf("%s expected sup group %d", k, g)

+				}

+			}

 		}

 	}

@@ -231,6 +347,12 @@ func TestAdmit(t *testing.T) {

 		SELinuxContext: kapi.SELinuxContextStrategyOptions{

 			Type: kapi.SELinuxStrategyRunAsAny,

 		},

+		FSGroup: kapi.FSGroupStrategyOptions{

+			Type: kapi.FSGroupStrategyRunAsAny,

+		},

+		SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+			Type: kapi.SupplementalGroupsStrategyRunAsAny,

+		},

 		Groups: []string{"system:serviceaccounts"},

 	}

 	store.Add(adminSCC)

@@ -253,10 +375,20 @@ func TestAdmit(t *testing.T) {

 	}

 }

+func hasSupGroup(group int64, groups []int64) bool {

+	for _, g := range groups {

+		if g == group {

+			return true

+		}

+	}

+	return false

+}

+

 func TestAssignSecurityContext(t *testing.T) {

 	// set up test data

 	// scc that will deny privileged container requests and has a default value for a field (uid)

 	var uid int64 = 9999

+	fsGroup := int64(1)

 	scc := &kapi.SecurityContextConstraints{

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "test scc",

@@ -268,6 +400,17 @@ func TestAssignSecurityContext(t *testing.T) {

 			Type: kapi.RunAsUserStrategyMustRunAs,

 			UID:  &uid,

 		},

+

+		// require allocation for a field in the psc as well to test changes/no changes

+		FSGroup: kapi.FSGroupStrategyOptions{

+			Type: kapi.FSGroupStrategyMustRunAs,

+			Ranges: []kapi.IDRange{

+				{Min: fsGroup, Max: fsGroup},

+			},

+		},

+		SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+			Type: kapi.SupplementalGroupsStrategyRunAsAny,

+		},

 	}

 	provider, err := kscc.NewSimpleProvider(scc)

 	if err != nil {

@@ -291,7 +434,7 @@ func TestAssignSecurityContext(t *testing.T) {

 		shouldValidate bool

 		expectedUID    *int64

 	}{

-		"container SC is not changed when invalid": {

+		"pod and container SC is not changed when invalid": {

 			pod: &kapi.Pod{

 				Spec: kapi.PodSpec{

 					SecurityContext: &kapi.PodSecurityContext{},

@@ -333,16 +476,23 @@ func TestAssignSecurityContext(t *testing.T) {

 		}

 		// if we shouldn't have validated ensure that uid is not set on the containers

+		// and ensure the psc does not have fsgroup set

 		if !v.shouldValidate {

+			if v.pod.Spec.SecurityContext.FSGroup != nil {

+				t.Errorf("%s had a non-nil FSGroup %d.  FSGroup should not be set on test cases that don't validate", k, *v.pod.Spec.SecurityContext.FSGroup)

+			}

 			for _, c := range v.pod.Spec.Containers {

 				if c.SecurityContext.RunAsUser != nil {

-					t.Errorf("%s had non-nil UID %d.  UID should not be set on test cases that dont' validate", k, *c.SecurityContext.RunAsUser)

+					t.Errorf("%s had non-nil UID %d.  UID should not be set on test cases that don't validate", k, *c.SecurityContext.RunAsUser)

 				}

 			}

 		}

 		// if we validated then the pod sc should be updated now with the defaults from the SCC

 		if v.shouldValidate {

+			if *v.pod.Spec.SecurityContext.FSGroup != fsGroup {

+				t.Errorf("%s expected fsgroup to be defaulted but found %v", k, v.pod.Spec.SecurityContext.FSGroup)

+			}

 			for _, c := range v.pod.Spec.Containers {

 				if *c.SecurityContext.RunAsUser != uid {

 					t.Errorf("%s expected uid to be defaulted to %d but found %v", k, uid, c.SecurityContext.RunAsUser)

@@ -357,8 +507,9 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "default",

 			Annotations: map[string]string{

-				allocator.UIDRangeAnnotation: "1/3",

-				allocator.MCSAnnotation:      "s0:c1,c0",

+				allocator.UIDRangeAnnotation:           "1/3",

+				allocator.MCSAnnotation:                "s0:c1,c0",

+				allocator.SupplementalGroupsAnnotation: "1/3",

 			},

 		},

 	}

@@ -366,7 +517,8 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "default",

 			Annotations: map[string]string{

-				allocator.MCSAnnotation: "s0:c1,c0",

+				allocator.MCSAnnotation:                "s0:c1,c0",

+				allocator.SupplementalGroupsAnnotation: "1/3",

 			},

 		},

 	}

@@ -374,7 +526,29 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 		ObjectMeta: kapi.ObjectMeta{

 			Name: "default",

 			Annotations: map[string]string{

+				allocator.UIDRangeAnnotation:           "1/3",

+				allocator.SupplementalGroupsAnnotation: "1/3",

+			},

+		},

+	}

+

+	namespaceNoSupplementalGroupsFallbackToUID := &kapi.Namespace{

+		ObjectMeta: kapi.ObjectMeta{

+			Name: "default",

+			Annotations: map[string]string{

 				allocator.UIDRangeAnnotation: "1/3",

+				allocator.MCSAnnotation:      "s0:c1,c0",

+			},

+		},

+	}

+

+	namespaceBadSupGroups := &kapi.Namespace{

+		ObjectMeta: kapi.ObjectMeta{

+			Name: "default",

+			Annotations: map[string]string{

+				allocator.UIDRangeAnnotation:           "1/3",

+				allocator.MCSAnnotation:                "s0:c1,c0",

+				allocator.SupplementalGroupsAnnotation: "",

 			},

 		},

 	}

@@ -397,6 +571,12 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 					RunAsUser: kapi.RunAsUserStrategyOptions{

 						Type: kapi.RunAsUserStrategyRunAsAny,

 					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyRunAsAny,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyRunAsAny,

+					},

 				}

 			},

 			namespace: namespaceValid,

@@ -414,6 +594,12 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 					RunAsUser: kapi.RunAsUserStrategyOptions{

 						Type: kapi.RunAsUserStrategyMustRunAsRange,

 					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyMustRunAs,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyMustRunAs,

+					},

 				}

 			},

 			namespace: namespaceValid,

@@ -430,6 +616,12 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 					RunAsUser: kapi.RunAsUserStrategyOptions{

 						Type: kapi.RunAsUserStrategyMustRunAsRange,

 					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyRunAsAny,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyRunAsAny,

+					},

 				}

 			},

 			namespace:   namespaceNoUID,

@@ -447,11 +639,62 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 					RunAsUser: kapi.RunAsUserStrategyOptions{

 						Type: kapi.RunAsUserStrategyMustRunAsRange,

 					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyRunAsAny,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyRunAsAny,

+					},

 				}

 			},

 			namespace:   namespaceNoMCS,

 			expectedErr: "unable to find pre-allocated mcs annotation",

 		},

+		"pre-allocated group falls back to UID annotation": {

+			scc: func() *kapi.SecurityContextConstraints {

+				return &kapi.SecurityContextConstraints{

+					ObjectMeta: kapi.ObjectMeta{

+						Name: "pre-allocated no sup group annotation",

+					},

+					SELinuxContext: kapi.SELinuxContextStrategyOptions{

+						Type: kapi.SELinuxStrategyRunAsAny,

+					},

+					RunAsUser: kapi.RunAsUserStrategyOptions{

+						Type: kapi.RunAsUserStrategyRunAsAny,

+					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyMustRunAs,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyMustRunAs,

+					},

+				}

+			},

+			namespace: namespaceNoSupplementalGroupsFallbackToUID,

+		},

+		"pre-allocated group bad value fails": {

+			scc: func() *kapi.SecurityContextConstraints {

+				return &kapi.SecurityContextConstraints{

+					ObjectMeta: kapi.ObjectMeta{

+						Name: "pre-allocated no sup group annotation",

+					},

+					SELinuxContext: kapi.SELinuxContextStrategyOptions{

+						Type: kapi.SELinuxStrategyRunAsAny,

+					},

+					RunAsUser: kapi.RunAsUserStrategyOptions{

+						Type: kapi.RunAsUserStrategyRunAsAny,

+					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyMustRunAs,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyMustRunAs,

+					},

+				}

+			},

+			namespace:   namespaceBadSupGroups,

+			expectedErr: "unable to find pre-allocated group annotation",

+		},

 		"bad scc strategy options": {

 			scc: func() *kapi.SecurityContextConstraints {

 				return &kapi.SecurityContextConstraints{

@@ -464,6 +707,12 @@ func TestCreateProvidersFromConstraints(t *testing.T) {

 					RunAsUser: kapi.RunAsUserStrategyOptions{

 						Type: kapi.RunAsUserStrategyMustRunAs,

 					},

+					FSGroup: kapi.FSGroupStrategyOptions{

+						Type: kapi.FSGroupStrategyRunAsAny,

+					},

+					SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+						Type: kapi.SupplementalGroupsStrategyRunAsAny,

+					},

 				}

 			},

 			namespace:   namespaceValid,

@@ -722,3 +971,315 @@ func TestDeduplicateSecurityContextConstraints(t *testing.T) {

 	}

 }

+

+func TestRequiresPreallocatedSupplementalGroups(t *testing.T) {

+	testCases := map[string]struct {

+		scc      *kapi.SecurityContextConstraints

+		requires bool

+	}{

+		"must run as": {

+			scc: &kapi.SecurityContextConstraints{

+				SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+					Type: kapi.SupplementalGroupsStrategyMustRunAs,

+				},

+			},

+			requires: true,

+		},

+		"must with range specified": {

+			scc: &kapi.SecurityContextConstraints{

+				SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+					Type: kapi.SupplementalGroupsStrategyMustRunAs,

+					Ranges: []kapi.IDRange{

+						{Min: 1, Max: 1},

+					},

+				},

+			},

+		},

+		"run as any": {

+			scc: &kapi.SecurityContextConstraints{

+				SupplementalGroups: kapi.SupplementalGroupsStrategyOptions{

+					Type: kapi.SupplementalGroupsStrategyRunAsAny,

+				},

+			},

+		},

+	}

+	for k, v := range testCases {

+		result := requiresPreallocatedSupplementalGroups(v.scc)

+		if result != v.requires {

+			t.Errorf("%s expected result %t but got %t", k, v.requires, result)

+		}

+	}

+}

+

+func TestRequiresPreallocatedFSGroup(t *testing.T) {

+	testCases := map[string]struct {

+		scc      *kapi.SecurityContextConstraints

+		requires bool

+	}{

+		"must run as": {

+			scc: &kapi.SecurityContextConstraints{

+				FSGroup: kapi.FSGroupStrategyOptions{

+					Type: kapi.FSGroupStrategyMustRunAs,

+				},

+			},

+			requires: true,

+		},

+		"must with range specified": {

+			scc: &kapi.SecurityContextConstraints{

+				FSGroup: kapi.FSGroupStrategyOptions{

+					Type: kapi.FSGroupStrategyMustRunAs,

+					Ranges: []kapi.IDRange{

+						{Min: 1, Max: 1},

+					},

+				},