}{
		"empty": {
			[]string{},
			[]string{},
		},
		"not-pod-mount": {
			[]string{"/mnt/outside"},
			[]string{},
		},
		"pod-mount": {
			[]string{filepath.Join(podsDir, "pod-mount")},
			[]string{filepath.Join(podsDir, "pod-mount")},
		},
		"not-directory-prefix": {
			[]string{podsDir + "pod-mount"},
			[]string{},
		},
		"mix": {
			[]string{"/mnt/outside",

				goto childerror
			}
			if _, _, err1 = RawSyscall(SYS_CLOSE, fd1, 0, 0); err1 != 0 {
				goto childerror
			}
		}

		// The unshare system call in Linux doesn't unshare mount points
		// mounted with --shared. Systemd mounts / with --shared. For a
		// long discussion of the pros and cons of this see debian bug 739593.
		// The Go model of unsharing is more like Plan 9, where you ask

		path           string
		mounter        mount.Interface
		expectedResult resource.Quantity
		shouldFail     bool
	}{
		"Valid: existing 2Mi mount": {
			path:           "/mnt/hugepages-2Mi",
			mounter:        mounter,
			shouldFail:     false,
			expectedResult: resource.MustParse("2Mi"),
		},
		"Valid: existing 1Gi mount": {
			path:           "/mnt/hugepages-1Gi",

            - mountPath: /spiffe-csi
              name: spiffe-csi-socket-dir
            # The volume containing mount points for containers.
            - mountPath: /var/lib/kubelet/pods
              mountPropagation: Bidirectional
              name: mountpoint-dir
          securityContext:
            privileged: true

	totalTimeout = time.Second * 10
)

const (
	// firstRetryBackOffDuration is the initial backoff time interval when hitting
	// non-retryable error in CSR request or while there is an error in reading file mounts.
	firstRetryBackOffDuration = 50 * time.Millisecond
)

// SecretManagerClient a SecretManager that signs CSRs using a provided security.Client. The primary

		WorkingDir:  container.WorkingDir,
		Labels:      newContainerLabels(container, pod),
		Annotations: newContainerAnnotations(container, pod, restartCount, opts),
		Devices:     makeDevices(opts),
		Mounts:      m.makeMounts(opts, container),
		LogPath:     containerLogsPath,
		Stdin:       container.Stdin,
		StdinOnce:   container.StdinOnce,
		Tty:         container.TTY,
		Linux:       l,
		Envs:        envs,

			}
		}
		// TODO: Add validation for PodSpec, currently this will check volumes, which we know will
		// fail. We should really check that the union of the given volumes and volumeClaims match
		// volume mounts in the containers.
		// allErrs = append(allErrs, apivalidation.ValidatePodTemplateSpec(template, fldPath)...)
		allErrs = append(allErrs, unversionedvalidation.ValidateLabels(template.Labels, fldPath.Child("labels"))...)

			a.Security.CARootPath = cafile.CACertFilePath
			return a
		}).Check(t, cfg.GetRootResourceName(), cfg.GetResourceName())
	})
	t.Run("Implicit file mounted certs", func(t *testing.T) {
		// User mounts certificates in /etc/certs (hardcoded path). CA communication is disabled.
		// mTLS is always used for authentication with Istiod, never JWT.
		copyCerts(t, "./etc/certs")
		t.Cleanup(func() {

	SELinuxMount featuregate.Feature = "SELinuxMount"

	// owner: @AkihiroSuda
	// kep: https://kep.k8s.io/3857
	// alpha: v1.30
	//
	// Allows recursive read-only mounts.
	RecursiveReadOnlyMounts featuregate.Feature = "RecursiveReadOnlyMounts"

	// owner: @everpeace
	// kep: https://kep.k8s.io/3619
	// alpha: v1.31
	//

	// If a volume has 'Filesystem' volumeMode, MountVolume mounts the
	// volume to the pod specified in volumeToMount.
	// Specifically it will:
	// * Wait for the device to finish attaching (for attachable volumes only).
	// * Mount device to global mount path (for attachable volumes only).
	// * Update actual state of world to reflect volume is globally mounted (for
	//   attachable volumes only).
	// * Mount the volume to the pod specific path.