// Module included in the following assemblies:
//
// * storage/persistent_storage/persistent-storage-nfs.adoc
// * storage/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc

:_mod-docs-content-type: CONCEPT
[id=storage-persistent-storage-nfs-group-ids_{context}]
= Group IDs

[role="_abstract"]
You can use supplemental groups to manage NFS access in {product-title} when you cannot change permissions on the NFS export. Supplemental groups manage shared storage such as NFS, while block storage such as iSCSI uses the `fsGroup` SCC strategy and `fsGroup` value in the pod `securityContext`.

[NOTE]
====
To gain access to persistent storage, it is generally preferable to use supplemental group IDs versus user IDs.
====

Because the group ID on the example target NFS directory
is `5555`, the pod can define that group ID using `supplementalGroups`
under the `securityContext` definition of the pod. For example:

[source,yaml]
----
spec:
  containers:
    - name:
    ...
  securityContext:
    supplementalGroups: [5555]
----
where:

`spec.securityContext`:: Must be defined at the pod level, not under a specific container.
`spec.securityContext.supplementalGroups`:: Specifies an array of GIDs defined for the pod. In this case, there is one element in the array. Additional GIDs would be comma-separated.

Assuming there are no custom SCCs that might satisfy the pod
requirements, the pod likely matches the `restricted` SCC. This SCC has
the `supplementalGroups` strategy set to `RunAsAny`, meaning that any
supplied group ID is accepted without range checking.

As a result, the above pod passes admissions and is launched. However,
if group ID range checking is desired, a custom SCC is the preferred
solution. A custom SCC can be created such that minimum
and maximum group IDs are defined, group ID range checking is enforced,
and a group ID of `5555` is allowed.

[NOTE]
====
To use a custom SCC, you must first add it to the appropriate service
account. For example, use the `default` service account in the given project
unless another has been specified on the `Pod` specification.
====
