Summary

When a Kubernetes pod template has Supplemental Groups configured in the Jenkins UI/CasC (alongside Run As User / Run As Group) and also defines raw pod YAML with Yaml merge strategy = Override, the live agent pod receives runAsUser/runAsGroup but not supplementalGroups.

Same class of bug as #2444 (pod-level securityContext fields not fully merged), but specifically affects supplementalGroups from pod template fields.

Environment

• Jenkins LTS 2.555.3 (jenkins/jenkins:lts-jdk21)
• kubernetes-plugin (current master)
• kind cluster, pod template with raw YAML + Override strategy

Steps to reproduce

1. Configure a Kubernetes cloud pod template with:
   • Supplemental Groups: 5001,5002
   • Run As User ID: 1000
   • Run As Group ID: 1000
   • Yaml merge strategy: Override
   • Show raw yaml in console: enabled
   • Raw YAML defining at least the jnlp container
2. Run a pipeline with agent { kubernetes { label '<template-label>' } }
3. Inspect Jenkins console raw YAML and the scheduled agent pod:
   kubectl get pod <agent> -o jsonpath='{.spec.securityContext}'

Expected

{
  "runAsUser": 1000,
  "runAsGroup": 1000,
  "supplementalGroups": [5001, 5002]
}

Actual

{
  "runAsUser": 1000,
  "runAsGroup": 1000
}

Root cause

PodTemplateBuilder.build() applies supplementalGroups to the builder pod spec, then merges with raw YAML via PodTemplateUtils.combine(yamlPod, builderSpec). Pod-level combine() only merges runAsUser and runAsGroup.

Related

• [JENKINS-65126] specified Linux capabilities via yaml override gets ignored #2444 — capabilities / other securityContext fields ignored with yaml override