Repository: kubernetes/kompose
Pull request #1626 (2023-04-05 18:11:05)

chore(deps)(deps): bump github.com/docker/docker from 23.0.2+incompatible to 23.0.3+incompatible
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.2+incompatible to 23.0.3+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p>
<blockquote>
<h2>v23.0.3</h2>
<h2>23.0.3</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Due to an issue with CentOS 9 Stream's package repositories, packages for
CentOS 9 are currently unavailable. Packages for CentOS 9 may be added later,
or as part of the next (23.0.4) patch release.</p>
</blockquote>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Fixed a number of issues that can cause Swarm encrypted overlay networks
to fail to uphold their guarantees, addressing <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28841">CVE-2023-28841</a>,
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840">CVE-2023-28840</a>, and
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28842">CVE-2023-28842</a>.
<ul>
<li>A lack of kernel support for encrypted overlay networks now reports
as an error.</li>
<li>Encrypted overlay networks are eagerly set up, rather than waiting for
multiple nodes to attach.</li>
<li>Encrypted overlay networks are now usable on Red Hat Enterprise Linux 9
through the use of the <code>xt_bpf</code> kernel module.</li>
<li>Users of Swarm overlay networks should review <a href="https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw">GHSA-vwm3-crmr-xfxw</a>
to ensure that unintentional exposure has not occurred.</li>
</ul>
</li>
</ul>
<h3>Packaging Updates</h3>
<ul>
<li>Update containerd to <a href="https://github.com/containerd/containerd/releases/tag/v1.6.20">v1.6.20</a>.</li>
<li>Update runc to <a href="https://github.com/opencontainers/runc/releases/tag/v1.1.5">v1.1.5</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/moby/moby/commit/59118bff500fc0d95d0560a9788735a8d89568ce"><code>59118bf</code></a> Merge pull request from GHSA-232p-vwff-86mp</li>
<li><a href="https://github.com/moby/moby/commit/b87f7f18b82fbb647b5142c6e5459a88a7652d02"><code>b87f7f1</code></a> libnet/d/overlay: insert the input-drop rule</li>
<li><a href="https://github.com/moby/moby/commit/98cbcb8003b7cf8da35fb5d05f5babbe142ab7c8"><code>98cbcb8</code></a> libnet/d/overlay: add BPF-powered VNI matcher</li>
<li><a href="https://github.com/moby/moby/commit/5c5fac237425c4bf79d2f048c1850f855f0182aa"><code>5c5fac2</code></a> libnet/d/overlay: extract VNI match rule builder</li>
<li><a href="https://github.com/moby/moby/commit/c492a22287557860831a7c4f523b8e53692bb822"><code>c492a22</code></a> libn/d/overlay: enforce encryption on sandbox init</li>
<li><a href="https://github.com/moby/moby/commit/018edb02849100de701d6ab6fb932ffb68843e4b"><code>018edb0</code></a> libnet/d/overlay: document some encryption code</li>
<li>See full diff in <a href="https://github.com/docker/docker/compare/v23.0.2...v23.0.3">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/docker&package-manager=go_modules&previous-version=23.0.2+incompatible&new-version=23.0.3+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kubernetes/kompose/network/alerts).

</details>


Patch:
diff --git a/docs/architecture.md b/docs/architecture.md
index a1896366..bc08ca07 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -14,7 +14,7 @@ redirect_from:
 
 `kompose` has 3 stages: _Loader_, _Transformer_ and _Outputter_. Each stage should have a well-defined interface, so it is easy to write a new Loader, Transformer, or Outputters and plug it in. Currently, only Loader and Transformer interfaces are defined.
 
-![Design Diagram](https://github.com/kubernetes/kompose/blob/master/docs/images/design_diagram.png)
+![Design Diagram](https://raw.githubusercontent.com/kubernetes/kompose/main/docs/images/design_diagram.png)
 
 ## Loader
 
diff --git a/docs/user-guide.md b/docs/user-guide.md
index b7bb1f06..a352045f 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -201,6 +201,7 @@ The currently supported options are:
 | kompose.service.healthcheck.liveness.http_get_port  | kubernetes liveness httpGet port                                                     |
 | kompose.service.healthcheck.liveness.tcp_port       | kubernetes liveness tcpSocket port                                                   |
 | kompose.service.external-traffic-policy       | 'cluster', 'local', ''                                                   |                                                |
+| kompose.security-context.fsgroup       |  kubernetes pod security group fsgroup                                                  |                                                |
 
 **Note**: `kompose.service.type` label should be defined with `ports` only (except for headless service), otherwise `kompose` will fail.
 
@@ -431,6 +432,20 @@ services:
       kompose.service.external-traffic-policy: local
       kompose.service.type: loadbalancer
 ```
+
+- `kompose.security-context.fsgroup` defines Kubernetes Pod [security context FsGroup.](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+
+For example:
+
+```yaml
+version: '3.8'
+
+services:
+  pgadmin:
+    image: nginx
+    labels:
+      kompose.security-context.fsgroup: 1001
+```
 ## Restart
 
 If you want to create normal pods without controller you can use `restart` construct of docker-compose to define that. Follow table below to see what happens on the `restart` value.
diff --git a/go.mod b/go.mod
index c45b7181..23232479 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/containerd/containerd v1.6.18 // indirect
 	github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa // indirect
-	github.com/docker/docker v23.0.2+incompatible // indirect
+	github.com/docker/docker v23.0.3+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
diff --git a/go.sum b/go.sum
index cbcf4268..f052ea43 100644
--- a/go.sum
+++ b/go.sum
@@ -77,8 +77,8 @@ github.com/deckarep/golang-set v1.8.0 h1:sk9/l/KqpunDwP7pSjUg0keiOOLEnOBHzykLrsP
 github.com/deckarep/golang-set v1.8.0/go.mod h1:5nI87KwE7wgsBU1F4GKAw2Qod7p5kyS383rP6+o6qqo=
 github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa h1:L9Ay/slwQ4ERSPaurC+TVkZrM0K98GNrEEo1En3e8as=
 github.com/distribution/distribution/v3 v3.0.0-20230214150026-36d8c594d7aa/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
-github.com/docker/docker v23.0.2+incompatible h1:q81C2qQ/EhPm8COZMUGOQYh4qLv4Xu6CXELJ3WK/mlU=
-github.com/docker/docker v23.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v23.0.3+incompatible h1:9GhVsShNWz1hO//9BNg/dpMnZW25KydO4wtVxWAIbho=
+github.com/docker/docker v23.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
diff --git a/pkg/kobject/kobject.go b/pkg/kobject/kobject.go
index 79e074be..50db8ee3 100644
--- a/pkg/kobject/kobject.go
+++ b/pkg/kobject/kobject.go
@@ -149,6 +149,7 @@ type ServiceConfig struct {
 	Dockerfile         string             `compose:"dockerfile"`
 	Replicas           int                `compose:"replicas"`
 	GroupAdd           []int64            `compose:"group_add"`
+	FsGroup            int64              `compose:"kompose.security-context.fsgroup"`
 	Volumes            []Volumes          `compose:""`
 	Secrets            []types.ServiceSecretConfig
 	HealthChecks       HealthChecks `compose:""`
diff --git a/pkg/loader/compose/compose.go b/pkg/loader/compose/compose.go
index 511ce339..a406c0e4 100644
--- a/pkg/loader/compose/compose.go
+++ b/pkg/loader/compose/compose.go
@@ -705,6 +705,8 @@ func parseKomposeLabels(labels map[string]string, serviceConfig *kobject.Service
 			}
 
 			serviceConfig.ServiceExternalTrafficPolicy = serviceExternalTypeTrafficPolicy
+		case LabelSecurityContextFsGroup:
+			serviceConfig.FsGroup = cast.ToInt64(value)
 		case LabelServiceExpose:
 			serviceConfig.ExposeService = strings.Trim(strings.ToLower(value), " ,")
 		case LabelNodePortPort:
diff --git a/pkg/loader/compose/utils.go b/pkg/loader/compose/utils.go
index b7977114..ce31f3f3 100644
--- a/pkg/loader/compose/utils.go
+++ b/pkg/loader/compose/utils.go
@@ -79,6 +79,8 @@ const (
 
 	// ServiceTypeHeadless ...
 	ServiceTypeHeadless = "Headless"
+	// LabelSecurityContextFsGroup defines the pod FsGroup
+	LabelSecurityContextFsGroup = "kompose.security-context.fsgroup"
 )
 
 // load environment variables from compose file
diff --git a/pkg/transformer/kubernetes/k8sutils.go b/pkg/transformer/kubernetes/k8sutils.go
index d9d1799e..90d12fed 100644
--- a/pkg/transformer/kubernetes/k8sutils.go
+++ b/pkg/transformer/kubernetes/k8sutils.go
@@ -549,6 +549,11 @@ func (k *Kubernetes) UpdateKubernetesObjects(name string, service kobject.Servic
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Security Context FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {
diff --git a/pkg/transformer/kubernetes/podspec.go b/pkg/transformer/kubernetes/podspec.go
index d5237841..80aa5a78 100644
--- a/pkg/transformer/kubernetes/podspec.go
+++ b/pkg/transformer/kubernetes/podspec.go
@@ -128,6 +128,11 @@ func SecurityContext(name string, service kobject.ServiceConfig) PodSpecOption {
 			podSecurityContext.SupplementalGroups = service.GroupAdd
 		}
 
+		//set Pod FsGroup
+		if service.FsGroup != 0 {
+			podSecurityContext.FSGroup = &service.FsGroup
+		}
+
 		// Setup security context
 		securityContext := &api.SecurityContext{}
 		if service.Privileged {


Test patch:
diff --git a/pkg/transformer/kubernetes/kubernetes_test.go b/pkg/transformer/kubernetes/kubernetes_test.go
index 6b86d025..f9ccd45c 100644
--- a/pkg/transformer/kubernetes/kubernetes_test.go
+++ b/pkg/transformer/kubernetes/kubernetes_test.go
@@ -51,6 +51,7 @@ func newServiceConfig() kobject.ServiceConfig {
 		VolList:         []string{"/tmp/volume"},
 		Network:         []string{"network1", "network2"}, // supported
 		Labels:          nil,
+		FsGroup:         1001,
 		Annotations:     map[string]string{"abc": "def"},
 		CPUQuota:        1, // not supported
 		CapAdd:          []string{"cap_add"},
@@ -209,6 +210,9 @@ func checkPodTemplate(config kobject.ServiceConfig, template api.PodTemplateSpec
 	if config.Privileged == privilegedNilOrFalse(template) {
 		return fmt.Errorf("Found different template privileged: %#v vs. %#v", config.Privileged, template.Spec.Containers[0].SecurityContext)
 	}
+	if config.FsGroup != *template.Spec.SecurityContext.FSGroup {
+		return fmt.Errorf("Found different pod security context fs group values: %#v vs. %#v", config.FsGroup, *template.Spec.SecurityContext.FSGroup)
+	}
 	if config.Stdin != template.Spec.Containers[0].Stdin {
 		return fmt.Errorf("Found different values for stdin: %#v vs. %#v", config.Stdin, template.Spec.Containers[0].Stdin)
 	}
diff --git a/script/test/cmd/tests_new.sh b/script/test/cmd/tests_new.sh
index 32432d7c..ca669b72 100755
--- a/script/test/cmd/tests_new.sh
+++ b/script/test/cmd/tests_new.sh
@@ -239,3 +239,11 @@ os_cmd="kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/exter
 os_output="$KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/output-os-v2.yaml"
 convert::expect_success_and_warning "$k8s_cmd" "$k8s_output"
 convert::expect_success_and_warning "$os_cmd" "$os_output"
+
+# Test Pod security context fs group
+k8s_cmd="kompose -f $KOMPOSE_ROOT/script/test/fixtures/fsgroup/docker-compose.yaml convert --stdout --with-kompose-annotation=false"
+k8s_output="$KOMPOSE_ROOT/script/test/fixtures/fsgroup/output-k8s.yaml"
+os_cmd="kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/fsgroup/docker-compose.yaml convert --stdout --with-kompose-annotation=false"
+os_output="$KOMPOSE_ROOT/script/test/fixtures/fsgroup/output-os.yaml"
+convert::expect_success_and_warning "$k8s_cmd" "$k8s_output"
+convert::expect_success "$os_cmd" "$os_output"
diff --git a/script/test/cmd/update-e2e.sh b/script/test/cmd/update-e2e.sh
new file mode 100755
index 00000000..10b8182a
--- /dev/null
+++ b/script/test/cmd/update-e2e.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# HOW TO USE: 
+# In your kompose director execute: UPDATE_OS=true UPDATE_K8S=false ./update-e2e.sh
+
+
+make bin
+# Feel free to update this variable to match your current FS
+export KOMPOSE_ROOT=$HOME/projects/kompose
+
+if $UPDATE_K8S ; then
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/v2.0/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/v2.0/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/v3.0/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/v3.0/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/volume-mounts/windows/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/volume-mounts/windows/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/deploy/placement/docker-compose-placement.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/deploy/placement/output-placement-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/docker-compose.yml convert --stdout --with-kompose-annotation=false --volumes=configMap > $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/docker-compose-withlabel.yml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/output-k8s-withlabel.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/docker-compose.yml convert --with-kompose-annotation=false --stdout --volumes emptyDir > $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/output-k8s-empty-vols-template.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/docker-compose.yml convert --with-kompose-annotation=false --stdout --emptyvols > $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/expose/compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/expose/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/service-group/compose.yaml convert --stdout --with-kompose-annotation=false --service-group-mode=volume >$KOMPOSE_ROOT/script/test/fixtures/service-group/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/multiple-files/first.yaml -f $KOMPOSE_ROOT/script/test/fixtures/multiple-files/second.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/multiple-files/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/healthcheck/docker-compose-healthcheck.yaml convert --stdout --service-group-mode=label --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/healthcheck/output-healthcheck-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/statefulset/docker-compose.yaml convert --stdout --with-kompose-annotation=false --controller statefulset > $KOMPOSE_ROOT/script/test/fixtures/statefulset/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/multiple-type-volumes/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/multiple-type-volumes/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/envvars-interpolation/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/envvars-interpolation/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/single-file-output/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/single-file-output/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/host-port-protocol/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/host-port-protocol/output-k8s.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/docker-compose-v1.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/output-k8s-v1.yaml
+$KOMPOSE_ROOT/kompose -f $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/docker-compose-v2.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/output-k8s-v2.yaml
+fi
+
+if $UPDATE_OS ; then
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/v2.0/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/v2.0/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/volume-mounts/windows/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/volume-mounts/windows/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/v3.0/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/v3.0/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/deploy/placement/docker-compose-placement.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/deploy/placement/output-placement-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/docker-compose.yml convert --stdout --with-kompose-annotation=false --volumes=configMap > $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/output-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/docker-compose-withlabel.yml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/configmap-volume/output-os-withlabel.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/docker-compose.yml convert --with-kompose-annotation=false --stdout --volumes emptyDir > $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/output-os-empty-vols-template.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/docker-compose.yml convert --with-kompose-annotation=false --stdout --emptyvols > $KOMPOSE_ROOT/script/test/fixtures/change-in-volume/output-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/expose/compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/expose/output-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/multiple-files/first.yaml -f $KOMPOSE_ROOT/script/test/fixtures/multiple-files/second.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/multiple-files/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/healthcheck/docker-compose-healthcheck.yaml convert --stdout --service-group-mode=label --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/healthcheck/output-healthcheck-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/statefulset/docker-compose.yaml convert --stdout --with-kompose-annotation=false --controller statefulset > $KOMPOSE_ROOT/script/test/fixtures/statefulset/output-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f  $KOMPOSE_ROOT/script/test/fixtures/multiple-type-volumes/docker-compose.yaml  convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/multiple-type-volumes/output-os.yaml
+$KOMPOSE_ROOT/kompose  --provider=openshift -f  $KOMPOSE_ROOT/script/test/fixtures/envvars-interpolation/docker-compose.yaml  convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/envvars-interpolation/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/host-port-protocol/docker-compose.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/host-port-protocol/output-os.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/docker-compose-v1.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/output-os-v1.yaml
+$KOMPOSE_ROOT/kompose --provider=openshift -f $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/docker-compose-v2.yaml convert --stdout --with-kompose-annotation=false > $KOMPOSE_ROOT/script/test/fixtures/external-traffic-policy/output-os-v2.yaml
+fi
diff --git a/script/test/fixtures/fsgroup/docker-compose.yaml b/script/test/fixtures/fsgroup/docker-compose.yaml
new file mode 100644
index 00000000..63e1c8a9
--- /dev/null
+++ b/script/test/fixtures/fsgroup/docker-compose.yaml
@@ -0,0 +1,14 @@
+version: '3.8'
+volumes:
+  pgadmin-data:
+
+services:
+  pgadmin:
+    labels:
+      kompose.security-context.fsgroup: 1001
+    image: dpage/pgadmin4
+    environment:
+      PGADMIN_DEFAULT_EMAIL: dumb_pgadmin_user@email.com
+      PGADMIN_DEFAULT_PASSWORD: pgadmin_password
+    volumes:
+      - pgadmin-data:/var/lib/pgadmin
diff --git a/script/test/fixtures/fsgroup/output-k8s.yaml b/script/test/fixtures/fsgroup/output-k8s.yaml
new file mode 100644
index 00000000..95ad09ef
--- /dev/null
+++ b/script/test/fixtures/fsgroup/output-k8s.yaml
@@ -0,0 +1,79 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    kompose.security-context.fsgroup: "1001"
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pgadmin
+  name: pgadmin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: pgadmin
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        kompose.security-context.fsgroup: "1001"
+      creationTimestamp: null
+      labels:
+        io.kompose.network/fsgroup-default: "true"
+        io.kompose.service: pgadmin
+    spec:
+      containers:
+        - env:
+            - name: PGADMIN_DEFAULT_EMAIL
+              value: dumb_pgadmin_user@email.com
+            - name: PGADMIN_DEFAULT_PASSWORD
+              value: pgadmin_password
+          image: dpage/pgadmin4
+          name: pgadmin
+          resources: {}
+          volumeMounts:
+            - mountPath: /var/lib/pgadmin
+              name: pgadmin-data
+      restartPolicy: Always
+      securityContext:
+        fsGroup: 1001
+      volumes:
+        - name: pgadmin-data
+          persistentVolumeClaim:
+            claimName: pgadmin-data
+status: {}
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pgadmin-data
+  name: pgadmin-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi
+status: {}
+
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  creationTimestamp: null
+  name: fsgroup-default
+spec:
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              io.kompose.network/fsgroup-default: "true"
+  podSelector:
+    matchLabels:
+      io.kompose.network/fsgroup-default: "true"
+
diff --git a/script/test/fixtures/fsgroup/output-os.yaml b/script/test/fixtures/fsgroup/output-os.yaml
new file mode 100644
index 00000000..50b5eae3
--- /dev/null
+++ b/script/test/fixtures/fsgroup/output-os.yaml
@@ -0,0 +1,102 @@
+---
+apiVersion: v1
+kind: DeploymentConfig
+metadata:
+  annotations:
+    kompose.security-context.fsgroup: "1001"
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pgadmin
+  name: pgadmin
+spec:
+  replicas: 1
+  selector:
+    io.kompose.service: pgadmin
+  strategy:
+    resources: {}
+    type: Recreate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        io.kompose.network/fsgroup-default: "true"
+        io.kompose.service: pgadmin
+    spec:
+      containers:
+        - env:
+            - name: PGADMIN_DEFAULT_EMAIL
+              value: dumb_pgadmin_user@email.com
+            - name: PGADMIN_DEFAULT_PASSWORD
+              value: pgadmin_password
+          image: ' '
+          name: pgadmin
+          resources: {}
+          volumeMounts:
+            - mountPath: /var/lib/pgadmin
+              name: pgadmin-data
+      restartPolicy: Always
+      securityContext:
+        fsGroup: 1001
+      volumes:
+        - name: pgadmin-data
+          persistentVolumeClaim:
+            claimName: pgadmin-data
+  test: false
+  triggers:
+    - type: ConfigChange
+    - imageChangeParams:
+        automatic: true
+        containerNames:
+          - pgadmin
+        from:
+          kind: ImageStreamTag
+          name: pgadmin:latest
+      type: ImageChange
+status:
+  availableReplicas: 0
+  latestVersion: 0
+  observedGeneration: 0
+  replicas: 0
+  unavailableReplicas: 0
+  updatedReplicas: 0
+
+---
+apiVersion: v1
+kind: ImageStream
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pgadmin
+  name: pgadmin
+spec:
+  lookupPolicy:
+    local: false
+  tags:
+    - annotations: null
+      from:
+        kind: DockerImage
+        name: dpage/pgadmin4
+      generation: null
+      importPolicy: {}
+      name: latest
+      referencePolicy:
+        type: ""
+status:
+  dockerImageRepository: ""
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pgadmin-data
+  name: pgadmin-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi
+status: {}
+