reason: reasonValue
    user:
      linux:
        gid: 2
        supplementalGroups:
        - 3
        uid: 1
    volumeMounts:
    - mountPath: mountPathValue
      name: nameValue
      readOnly: true
      recursiveReadOnly: recursiveReadOnlyValue
  ephemeralContainerStatuses:
  - allocatedResources:
      allocatedResourcesKey: "0"
    containerID: containerIDValue
    image: imageValue

              "name": "nameValue"
            }
          ]
        },
        "volumeMounts": [
          {
            "name": "nameValue",
            "mountPath": "mountPathValue",
            "readOnly": true,
            "recursiveReadOnly": "recursiveReadOnlyValue"
          }
        ],
        "user": {
          "linux": {
            "uid": 1,
            "gid": 2,

! go list -m all
stderr 'go: can''t compute ''all'' using the vendor directory\n\t\(Use -mod=mod or -mod=readonly to bypass.\)'

! go list -m -f '{{.Dir}}' all
stderr 'go: can''t compute ''all'' using the vendor directory\n\t\(Use -mod=mod or -mod=readonly to bypass.\)'

# An explicit -mod=mod should force the vendor directory to be ignored.
env GOFLAGS=-mod=mod

go list -f {{.Dir}} -tags tools -e all

    "verify-golangci-lint.sh"              # runs in separate pull-kubernetes-verify-lint
    )
fi

# Exclude readonly package check in certain cases, aka, in periodic jobs we don't care and a readonly package won't be touched
if [[ ${EXCLUDE_READONLY_PACKAGE:-} =~ ^[yY]$ ]]; then
  EXCLUDED_PATTERNS+=(
    "verify-readonly-packages.sh"  # skip in CI, if env is set
    )
fi

# Only run known fast checks in quick mode.

}

func getVolumeSource(spec *volume.Spec) (*v1.SecretVolumeSource, bool) {
	var readOnly bool
	var volumeSource *v1.SecretVolumeSource

	if spec.Volume != nil && spec.Volume.Secret != nil {
		volumeSource = spec.Volume.Secret
		readOnly = spec.ReadOnly
	}

	return volumeSource, readOnly

stdout 'Hello, world.'
cd $GOPATH/src

go list all # all includes both modules
stdout 'example.com/a'
stdout 'example.com/b'

# -mod can only be set to readonly in workspace mode
go list -mod=readonly all
! go list -mod=mod all
stderr '^go: -mod may only be set to readonly or vendor when in workspace mode'
env GOWORK=off
go list -mod=mod all
env GOWORK=

# Test that duplicates in the use list return an error

}

func getVolumeSource(spec *volume.Spec) (*v1.GitRepoVolumeSource, bool) {
	var readOnly bool
	var volumeSource *v1.GitRepoVolumeSource

	if spec.Volume != nil && spec.Volume.GitRepo != nil {
		volumeSource = spec.Volume.GitRepo
		readOnly = spec.ReadOnly
	}

	return volumeSource, readOnly
}

func validateNonFlagArgument(arg, argName string) error {
	if len(arg) > 0 && arg[0] == '-' {

        volumeMounts:
        - name: log
          mountPath: /var/log
        - name: kmsg
          mountPath: /dev/kmsg
          readOnly: true
        - name: localtime
          mountPath: /etc/localtime
          readOnly: true
      volumes:
      - name: log
        hostPath:
          path: /var/log/
      - name: kmsg
        hostPath:
          path: /dev/kmsg

  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.docker,destination=/config/.docker,readonly "
fi

# gcloud conditional host mount (needed for docker push with the gcloud auth configure-docker)
if [[ -d "${HOME}/.config/gcloud" ]]; then
  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.config/gcloud,destination=/config/.config/gcloud,readonly "
fi

# gitconfig conditional host mount (needed for git commands inside container)

          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
          {{- range $gateway.configVolumes }}
          {{- if .mountPath }}
          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
          {{- end }}
{{- if $gateway.additionalContainers }}