Change:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Some of our storage e2e tests write and read data in the host FS (/tmp), using the hostPath storage plugin. By default, containers running on SELinux environments can only read/write data in directories/files (in the host) that contain the label . In the absence of this label, there are two options: 1) Run the container as privileged or; 2) In the host, add this label to the direcotories/files in which the container will write data (and keep the container unprivileged). Currently, we run the container as privileged if the host is not Windows and the volume is FS (rather than block). That being said, we should run containers as unprivileged in all cases (e.g., option 2 above), so I propose to: 1) Prepare a special e2e directory in the host by adding the proper label to it (); 2) Change the tests to read/write data from/to this directory instead (they typically use /tmp/ for that); 3) Make the test containers run as unprivileged. Reference:
/sig storage
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Is this issue still open?
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale yes, we'd like to have this fixed eventually.
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
/remove-lifecycle stale
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-contributor-experience at . /lifecycle rotten
Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . Send feedback to sig-contributor-experience at . /close
Closing this issue. <detailsIn response to : Rotten issues close after 30d of inactivity. Reopen the issue with . Mark the issue as fresh with . /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
You can't reopen an issue/PR unless you authored it or you are a collaborator. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/reopen
Reopened this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/remove-lifecycle rotten

Discussion:
var gracePeriod int64 = 1 var command string <ins> /** This condition fixes running storage e2e tests in SELinux environment. HostPath Volume Plugin creates a directory within /tmp on host machine, to be mounted as volume. Inject-pod writes content to the volume, and a client-pod tries the read the contents and verify. When SELinux is enabled on the host, client-pod can not read the content, with permission denied. Invoking client-pod as privileged, so that it can access the volume content, even when SELinux is enabled on the host. */ if config.Prefix == "hostpathsymlink" || config.Prefix == "hostpath" { privileged = true } </ins> command = "while true ; do sleep 2; done " seLinuxOptions := &v1.SELinuxOptions{Level: "s0:c0,c1"} clientPod := &v1.Pod{