Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!--What happened: The read only sig-storage tests validate that Pods can come up when readOnly is set. But it doesn't actually validate that the container cannot write to the volume. What you expected to happen: Tests should validate that the container cannot write to readonly volumes. <!-- DO NOT EDIT BELOW THIS LINE --/kind bug
/help
This request has been marked as needing help from a contributor. Please ensure the request meets the requirements listed . If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
can this issue be closed after your last PR or is there more to work on? If yes I'd like to know what's left because I'm looking for something to work on
I think we should actually reinstate the test case I removed and enhance it to handle the two scenarios I mentioned. It would also be good to see if we have other readOnly test cases that could be enhanced as well
Thanks ! I have a few questions: 1) how do I run the tests in locally? and 2) how can I assert writing to volume has failed? Thank you in advance!!

Discussion:
setInitCommand(input.pod, fmt.Sprintf("ln -s /bin %s", input.subPathDir)) // Pod should fail <del> testPodFailSubpath(input.f, input.pod) </del> <ins> testPodFailSubpath(input.f, input.pod, false) </ins> }) It("should fail if subpath file is outside the volume [Slow]", func() {

setInitCommand(input.pod, fmt.Sprintf("ln -s /bin/sh %s", input.subPathDir)) // Pod should fail <del> testPodFailSubpath(input.f, input.pod) </del> <ins> testPodFailSubpath(input.f, input.pod, false) </ins> }) It("should fail if non-existent subpath is outside the volume [Slow]", func() {

setInitCommand(input.pod, fmt.Sprintf("ln -s /bin/notanexistingpath %s", input.subPathDir)) // Pod should fail <del> testPodFailSubpath(input.f, input.pod) </del> <ins> testPodFailSubpath(input.f, input.pod, false) </ins> }) It("should fail if subpath with backstepping is outside the volume [Slow]", func() {

setInitCommand(input.pod, fmt.Sprintf("ln -s ../ %s", input.subPathDir)) // Pod should fail <del> testPodFailSubpath(input.f, input.pod) </del> <ins> testPodFailSubpath(input.f, input.pod, false) </ins> }) It("should support creating multiple subpath from same volumes [Slow]", func() {

testReadFile(input.f, input.filePathInSubpath, input.pod, 0) }) <ins> It("should verify container cannot write to subpath readonly volumes", func() { if input.roVol == nil { framework.Skipf("Volume type %v doesn't support readOnly source", input.volType) } // Format the volume while it's writable formatVolume(input.f, input.formatPod) // Set volume source to read only input.pod.Spec.Volumes[0].VolumeSource = *input.roVol // Write the file in the volume from container 0 setWriteCommand(input.subPathDir, &input.pod.Spec.Containers[0]) // Pod should fail testPodFailSubpath(input.f, input.pod, true) }) </ins> // TODO: add a test case for the same disk with two partitions }

Expect(err).NotTo(HaveOccurred(), "while deleting pod") } <del> func testPodFailSubpath(f *framework.Framework, pod *v1.Pod) { testPodFailSubpathError(f, pod, "subPath") </del> <ins> func testPodFailSubpath(f *framework.Framework, pod *v1.Pod, allowContainerTerminationError bool) { testPodFailSubpathError(f, pod, "subPath", allowContainerTerminationError) </ins> } <del> func testPodFailSubpathError(f *framework.Framework, pod *v1.Pod, errorMsg string) { </del> <ins> func testPodFailSubpathError(f *framework.Framework, pod *v1.Pod, errorMsg string, allowContainerTerminationError bool) { </ins> By(fmt.Sprintf("Creating pod %s", pod.Name)) pod, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(pod) Expect(err).ToNot(HaveOccurred(), "while creating pod")

framework.DeletePodWithWait(f, f.ClientSet, pod) }() By("Checking for subpath error in container status") <del> err = waitForPodSubpathError(f, pod) </del> <ins> err = waitForPodSubpathError(f, pod, allowContainerTerminationError) </ins> Expect(err).NotTo(HaveOccurred(), "while waiting for subpath failure") }

return "" } <del> func waitForPodSubpathError(f *framework.Framework, pod *v1.Pod) error { </del> <ins> func waitForPodSubpathError(f *framework.Framework, pod *v1.Pod, allowContainerTerminationError bool) error { </ins> subpathContainerName := findSubpathContainerName(pod) if subpathContainerName == "" { return fmt.Errorf("failed to find container that uses subpath")

case status.State.Running != nil: return false, fmt.Errorf("subpath container unexpectedly became running") case status.State.Terminated != nil: <ins> if status.State.Terminated.ExitCode != 0 && allowContainerTerminationError { return true, nil } </ins> return false, fmt.Errorf("subpath container unexpectedly terminated") case status.State.Waiting != nil: if status.State.Waiting.Reason == "CreateContainerConfigError" &&