fix lint errors

Author: Rohit Patil

security/v1/types.go

@@ -133,8 +133,9 @@ type SecurityContextConstraints struct {
 	// +nullable
 	FSGroup FSGroupStrategyOptions `json:"fsGroup,omitempty" protobuf:"bytes,16,opt,name=fsGroup"`
 	// runAsGroup is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
-	// +nullable
-	RunAsGroup RunAsGroupStrategyOptions `json:"runAsGroup,omitempty" protobuf:"bytes,27,opt,name=runAsGroup"`
+	// When omitted, the RunAsGroup strategy will not be enforced and containers may run with any group ID.
+	// +optional
+	RunAsGroup RunAsGroupStrategyOptions `json:"runAsGroup,omitzero" protobuf:"bytes,27,opt,name=runAsGroup"`
 	// readOnlyRootFilesystem when set to true will force containers to run with a read only root file
 	// system.  If the container specifically requests to run with a non-read only root file system
 	// the SCC should deny the pod.
@@ -275,19 +276,28 @@ type SupplementalGroupsStrategyOptions struct {
 // RunAsGroupStrategyOptions defines the strategy type and options used to create the strategy.
 type RunAsGroupStrategyOptions struct {
 	// type is the strategy that will dictate what RunAsGroup is used in the SecurityContext.
+	// Valid values are "MustRunAs" and "RunAsAny".
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=32
 	Type RunAsGroupStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=RunAsGroupStrategyType"`
 	// ranges are the allowed ranges of gids.  If you would like to force a single
 	// gid then supply a single range with the same start and end.
+	// When omitted, any gid is allowed (equivalent to RunAsAny strategy).
+	// +optional
 	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=256
 	Ranges []IDRange `json:"ranges,omitempty" protobuf:"bytes,2,rep,name=ranges"`
 }
 
 // IDRange provides a min/max of an allowed range of IDs.
 // TODO: this could be reused for UIDs.
 type IDRange struct {
 	// min is the start of the range, inclusive.
+	// +kubebuilder:validation:Required
 	Min int64 `json:"min,omitempty" protobuf:"varint,1,opt,name=min"`
 	// max is the end of the range, inclusive.
+	// +kubebuilder:validation:Required
 	Max int64 `json:"max,omitempty" protobuf:"varint,2,opt,name=max"`
 }