Run pod bind mounts in the host mount namespace via nsenter.

Kubelet checks volume mounts from the host namespace, so NodePublishVolume
must mkdir and bind-mount the pod target path on the host, not only inside
the CSI plugin container.

Co-authored-by: Cursor <cursoragent@cursor.com>

pkg/csi/driver/mount_linux_test.go

@@ -4,45 +4,23 @@ package driver
 
 import (
 	"os"
-	"path/filepath"
+	"os/exec"
 	"testing"
 )
 
-func TestBindMountCreatesTargetAndIsIdempotent(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	source := filepath.Join(root, "globalmount")
-	target := filepath.Join(root, "pods", "test", "mount")
-	if err := os.MkdirAll(source, 0o755); err != nil {
-		t.Fatalf("mkdir source: %v", err)
+func TestHostMountRequiresNsenter(t *testing.T) {
+	if _, err := exec.LookPath("nsenter"); err != nil {
+		t.Skip("nsenter not available")
 	}
-	if err := os.WriteFile(filepath.Join(source, "probe"), []byte("ok"), 0o644); err != nil {
-		t.Fatalf("write probe file: %v", err)
+	if os.Geteuid() != 0 {
+		t.Skip("host mount namespace tests require root")
 	}
 
-	mounter := newMounter()
-	if err := mounter.Mount("tmpfs", source, "tmpfs", []string{}); err != nil {
-		t.Fatalf("mount tmpfs at source: %v", err)
+	tmp := t.TempDir()
+	if out, err := hostMount("mkdir", "-p", tmp); err != nil {
+		t.Fatalf("hostMount mkdir failed: %v: %s", err, string(out))
 	}
-	t.Cleanup(func() {
-		_ = cleanupMountPoint(source, mounter)
-	})
-
-	if err := bindMount(source, target); err != nil {
-		t.Fatalf("first bindMount failed: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = cleanupMountPoint(target, mounter)
-	})
-
-	if _, err := os.Stat(target); err != nil {
-		t.Fatalf("target mount path missing: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(target, "probe")); err != nil {
-		t.Fatalf("bind mount did not expose source contents: %v", err)
-	}
-	if err := bindMount(source, target); err != nil {
-		t.Fatalf("second bindMount failed: %v", err)
+	if _, err := os.Stat(tmp); err != nil {
+		t.Fatalf("expected host-visible directory: %v", err)
 	}
 }