Change:
<!-- Please only use this template for submitting reports about continuously failing tests or jobs in Kubernetes CI --Which jobs are failing: N/A Which test(s) are failing: should fail substituting values in a volume subpath with absolute path Since when has it been failing: N/A Testgrid link: N/A Reason for failure: Some of the tests are negative test cases which are supposed to ensure that those invalid usecases are handled properly. However, some of the tests are false positives, they can pass due to various reasons. One such example is: should fail substituting values in a volume subpath with absolute path. This test can pass if: the Pod cannot start due to various reasons (e.g.: the container image cannot be pulled or does not exist). the Pod ran to completion, even though the container was not supposed to start in the first place. Anything else we need to know: /sig testing Related:
/sig storage SIG storage owns the test case, though I see that you are changing core framework methods to fix this, so leaving SIG testing. Looks like also possibly sig-node, skimming the linked PRs Based on the PRs this also appears to be related to windows? (unsure, no mention here)
I've Related: to the issue description. After fixing this test, I've noticed that it now fails on Windows, which means the issue was masked by the test's false positive result. Basically, it means that you can have volume subpaths with absolute paths substituted on variable expansion and have Windows containers use them and be running, which according to the test, it shouldn't be a supported usecase. The fix should probably be also backported to previous releases.

Discussion:
Description: Make sure a container's subpath can not be set using an expansion of environment variables when absolute path is supplied. */ framework.ConformanceIt("should fail substituting values in a volume subpath with absolute path [sig-storage][Slow]", func() { <ins> absolutePath := "/tmp" if framework.NodeOSDistroIs("windows") { // Windows does not typically have a C:tmp folder. absolutePath = "C:Users" } </ins> envVars := []v1.EnvVar{ { Name:  "POD_NAME", <del> Value: "/tmp", </del> <ins> Value: absolutePath, </ins> }, } mounts := []v1.VolumeMount{

e2epod.DeletePodWithWait(f.ClientSet, pod) }() <del> err := e2epod.WaitTimeoutForPodRunningInNamespace(f.ClientSet, pod.Name, pod.Namespace, framework.PodStartShortTimeout) framework.ExpectError(err, "while waiting for pod to be running") </del> <ins> err := e2epod.WaitForPodContainerToFail(f.ClientSet, pod.Namespace, pod.Name, 0, "CreateContainerConfigError", framework.PodStartShortTimeout) framework.ExpectNoError(err, "while waiting for the pod container to fail") </ins> } func newPod(command []string, envVars []v1.EnvVar, mounts []v1.VolumeMount, volumes []v1.Volume) *v1.Pod {

return e } <ins> func podContainerFailed(c clientset.Interface, namespace, podName string, containerIndex int, reason string) wait.ConditionFunc { return func() (bool, error) { pod, err := c.CoreV1().Pods(namespace).Get(context.TODO(), podName, metav1.GetOptions{}) if err != nil { return false, err } switch pod.Status.Phase { case v1.PodPending: if len(pod.Status.ContainerStatuses) == 0 { return false, nil } containerStatus := pod.Status.ContainerStatuses[containerIndex] if containerStatus.State.Waiting != nil && containerStatus.State.Waiting.Reason == reason { return true, nil } return false, nil case v1.PodFailed, v1.PodRunning, v1.PodSucceeded: return false, fmt.Errorf("pod was expected to be pending, but it is in the state: %s", pod.Status.Phase) } return false, nil } } </ins> // LogPodStates logs basic info of provided pods for debugging. func LogPodStates(pods []v1.Pod) { // Find maximum widths for pod, node, and phase strings for column printing.

} return podNames, nil } <ins> // WaitForPodContainerToFail waits for the given Pod container to fail with the given reason, specifically due to // invalid container configuration. In this case, the container will remain in a waiting state with a specific // reason set, which should match the given reason. func WaitForPodContainerToFail(c clientset.Interface, namespace, podName string, containerIndex int, reason string, timeout time.Duration) error { return wait.PollImmediate(poll, timeout, podContainerFailed(c, namespace, podName, containerIndex, reason)) } </ins>