@pweil- @lnsp I tried to reproduce a bug and couldn't. I looked again to the code and now I think that there is no bug. :)    > Should it return early if it finds valid?    This particular loop iterates over pod's supplementalGroups and we need to sure that all user provided groups are fall in the allowed ranges.