What is Kubernetes Pod Security Context Supplemental Groups?

Question

Accepted Answer

**Supplemental Groups** — additional Linux groups for Pod.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: supplemental-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    supplementalGroups: [4000, 5000]
  containers:
  - name: app
    image: nginx:latest
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc
---
# fsGroupChangePolicy
apiVersion: v1
kind: Pod
metadata:
  name: fsgroup-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    fsGroupChangePolicy: OnRootMismatch
  containers:
  - name: app
    image: nginx:latest
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc
```

```bash
# Check groups
kubectl exec supplemental-pod -- id
kubectl exec supplemental-pod -- groups

# Check volume ownership
kubectl exec supplemental-pod -- ls -la /data
kubectl exec supplemental-pod -- stat /data

# Verify fsGroup
kubectl get pod supplemental-pod -o jsonpath='{.spec.securityContext.fsGroup}'
kubectl get pod supplemental-pod -o jsonpath='{.spec.securityContext.supplementalGroups}'

# Check volume group
kubectl exec supplemental-pod -- ls -ln /data
kubectl exec supplemental-pod -- cat /proc/1/status | grep Gid
```

**Groups:**
- runAsGroup: primary group.
- fsGroup: volume group ownership.
- supplementalGroups: additional groups.

**Behavior:**
- fsGroup: applied to all volume mounts.
- supplementalGroups: added to process groups.
- fsGroupChangePolicy: control volume chown behavior.

**Use cases:**
- Shared storage access.
- Volume permission management.

DevOps: What is Kubernetes Pod Security Context Supplemental Groups?