Change:
Is this a BUG REPORT or FEATURE REQUEST?: This is request for improvements. What happened: When PodSecurityPolicy provider validates or fields of a pod, it shows an error like "999 is not an allowed group" if the group doesn't belong to the range(s). What you expected to happen: It should include to the error message also the allowed values -- the ranges against what we were validating this group. This will simplify user experience and debugging. How to reproduce it (as minimally and precisely as possible): run kubernetes cluster with PSP support create a PSP that allows fsGroup/SupplementalGroups in some ranges grant to a user access to this PSP try to create a pod that has fsGroup/SupplementalGroups outside of the allowed ranges Anything else we need to know?: In order to improve the current behavior, we need to modify function here: Reported-by: /kind help
This looks like a good first issue! My suggestion would be something like . I would also suggest to merge overlaying ranges in the log message, like as , to keep the log as concise as possible. I will look into it.
Maybe something like ? Thank you!
We can use the same approach that strategy uses:
Sure, that is probably the most consistent solution.
/remove-help

Discussion:
for _, group := range groups { if !s.isGroupValid(group) { <del> detail := fmt.Sprintf("%d is not an allowed group", group) </del> <ins> detail := fmt.Sprintf("group %d must be in the ranges: %v", group, s.ranges) </ins> allErrs = append(allErrs, field.Invalid(field.NewPath(s.field), groups, detail)) } }

package group import ( <del> "k8s.io/kubernetes/pkg/apis/extensions" </del> <ins> "strings" </ins> "testing" <ins> "k8s.io/kubernetes/pkg/apis/extensions" </ins> ) func TestMustRunAsOptions(t *testing.T) {

func TestValidate(t *testing.T) { tests := map[string]struct { <del> ranges []extensions.GroupIDRange groups []int64 pass   bool </del> <ins> ranges        []extensions.GroupIDRange groups        []int64 expectedError string </ins> }{ "nil security context": { ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, <ins> expectedError: "unable to validate empty groups against required ranges", </ins> }, "empty groups": { ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, <ins> expectedError: "unable to validate empty groups against required ranges", </ins> }, "not in range": { groups: []int64{5},

{Min: 1, Max: 3}, {Min: 4, Max: 4}, }, <ins> expectedError: "group 5 must be in the ranges: [{1 3} {4 4}]", </ins> }, "in range 1": { groups: []int64{2}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, <del> pass: true, </del> }, "in range boundary min": { groups: []int64{1}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, <del> pass: true, </del> }, "in range boundary max": { groups: []int64{3}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, <del> pass: true, </del> }, "singular range": { groups: []int64{4}, ranges: []extensions.GroupIDRange{ {Min: 4, Max: 4}, }, <del> pass: true, </del> }, }

t.Errorf("error creating strategy for %s: %v", k, err) } errs := s.Validate(nil, v.groups) <del> if v.pass && len(errs) > 0 { </del> <ins> if v.expectedError == "" && len(errs) > 0 { </ins> t.Errorf("unexpected errors for %s: %v", k, errs) } <del> if !v.pass && len(errs) == 0 { t.Errorf("expected no errors for %s but got: %v", k, errs) </del> <ins> if v.expectedError != "" && len(errs) == 0 { t.Errorf("expected errors for %s but got: %v", k, errs) } if v.expectedError != "" && len(errs) > 0 && !strings.Contains(errs[0].Error(), v.expectedError) { t.Errorf("expected error for %s: %v, but got: %v", k, v.expectedError, errs[0]) </ins> } } }

"failSupplementalGroupOutOfRange": { pod:           failSupplementalGroupPod, psp:           failSupplementalGroupPSP, <del> expectedError: "999 is not an allowed group", </del> <ins> expectedError: "group 999 must be in the ranges: [{1 1}]", </ins> }, "failSupplementalGroupEmpty": { pod:           defaultPod(),

"failFSGroupOutOfRange": { pod:           failFSGroupPod, psp:           failFSGroupPSP, <del> expectedError: "999 is not an allowed group", </del> <ins> expectedError: "group 999 must be in the ranges: [{1 1}]", </ins> }, "failFSGroupEmpty": { pod:           defaultPod(),