<p>Is there a way to define that all pods spawned in specific namespace
will have specific fsGroup (=65534 for instance) ?</p>
<p>Thanks!</p>

DarkSpark
<p>fsGroup can only be set on the pod level itself however there are ways to control and mutate pods created by the apiserver.</p>
<p>You could have a mutating webhook which adds/modifies the fsGroup field for all pods created in a particular namespace:
<a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/</a></p>
<p>You could also use OPA which provides a configurable dynamic admission controller where you just define the policy for it to enact:
<a href="https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/" rel="nofollow noreferrer">https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/</a></p>
