tmpMounts, err := os.CreateTemp("", "mounts")
	if err != nil {
		return "", fmt.Errorf("cannot create temporary mount file: %v", err)
	}
	tmpMountsFileName := tmpMounts.Name()
	defer tmpMounts.Close()
	defer os.Remove(tmpMountsFileName)

	mounts, err := os.Open(MountsFile)
	if err != nil {
		return "", fmt.Errorf("cannot open mounts file %s: %v", MountsFile, err)
	}
	defer mounts.Close()

			ContainerPath:  `C:\Windows\System32\drivers\etc\hosts`,
			HostPath:       filepath.Join(podDir, "etc-hosts"),
			ReadOnly:       false,
			SELinuxRelabel: true,
		},
	}
	assert.Equal(t, expectedMounts, mounts, "mounts of container %+v", container)

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
- 31410
releaseNotes:
- |
  **Improved** configmaps to be read directly rather than from volume mounts. This improves the speed

func GetStaticPodSpecs(cfg *kubeadmapi.ClusterConfiguration, endpoint *kubeadmapi.APIEndpoint, proxyEnvs []kubeadmapi.EnvVar) map[string]v1.Pod {
	// Get the required hostpath mounts
	mounts := getHostPathVolumesForTheControlPlane(cfg)
	if proxyEnvs == nil {
		proxyEnvs = kubeadmutil.GetProxyEnvVars()
	}
	componentHealthCheckTimeout := kubeadmapi.GetActiveTimeouts().ControlPlaneComponentHealthCheck

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
- 26882
releaseNotes:
- |
  **Improved** sidecar injection to not modify the pod `securityPolicy.fsGroup` which could conflict with existing settings and secret mounts.

)

// Exposed for testing "constants"
var (
	CNIBinDir     = "/opt/cni/bin"
	HostCNIBinDir = "/host/opt/cni/bin"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

// FirstQuota is the quota ID we start with.
// XXXXXXX Need a better way of doing this...
var FirstQuota QuotaID = 1048577

// MountsFile is the location of the system mount data
var MountsFile = "/proc/self/mounts"

// MountParseRegexp parses out /proc/sys/self/mounts
var MountParseRegexp = regexp.MustCompilePOSIX("^([^ ]*)[ \t]*([^ ]*)[ \t]*([^ ]*)") // Ignore options etc.

// LinuxVolumeQuotaProvider returns an appropriate quota applier

	if err != nil {
		return nil, err
	} else if devOpts == nil {
		return opts, nil
	}
	opts.Devices = append(opts.Devices, devOpts.Devices...)
	opts.Mounts = append(opts.Mounts, devOpts.Mounts...)
	opts.Envs = append(opts.Envs, devOpts.Envs...)
	opts.Annotations = append(opts.Annotations, devOpts.Annotations...)
	return opts, nil
}

	if err := fd.incref(); err != nil {
		return err
	}
	defer fd.decref()
	return ignoringEINTR(func() error {
		_, err := unix.Fcntl(fd.Sysfd, syscall.F_FULLFSYNC, 0)

		// There are scenarios such as SMB mounts where fcntl will fail
		// with ENOTSUP. In those cases fallback to fsync.
		// See #64215
		if err != nil && errors.Is(err, syscall.ENOTSUP) {
			err = syscall.Fsync(fd.Sysfd)
		}
		return err
	})

		ObjectMeta: metav1.ObjectMeta{
			Name:      serviceAccountName,
			Namespace: ns,
			UID:       types.UID(serviceAccountUID),
		},
	})

	// Define a pod with a container that already mounts a volume at the API token path
	// Admission should respect that
	// Additionally, no volume should be created if no container is going to use it
	pod := &api.Pod{
		Spec: api.PodSpec{
			Containers: []api.Container{