fix: treat empty existing mount as stale in ensureMountPoint

On Linux, ensureMountPoint returned mounted=true for any existing mount
whose directory could be listed, without checking whether the mount
actually had content. If a previous NodePublishVolume was interrupted
between mounting the tmpfs and writing provider objects to it (driver
pod killed, context canceled), the kernel-level mount persisted but was
empty. The next NodePublishVolume retry short-circuited at the
"target path is already mounted" branch and reported success on an
empty directory, causing the pod to start with no secrets.

This preserves the same invariant the Windows branch of the function
already enforces - "empty target directory means the caller should
perform a fresh mount" - now correctly on Linux where a stale tmpfs
can persist across driver pod restarts.

Signed-off-by: Gustavo Salvador <gustavo.salvador@outsystems.com>

Author: OS-gustavosalvador

pkg/secrets-store/utils.go

@@ -43,8 +43,24 @@ func (ns *nodeServer) ensureMountPoint(target string) (bool, error) {
 
 	if !notMnt {
 		// testing original mount point, make sure the mount link is valid
-		_, err := os.ReadDir(target)
+		entries, err := os.ReadDir(target)
 		if err == nil {
+			// A mount that exists but has no content indicates that a previous
+			// NodePublishVolume call was interrupted (e.g. the driver pod was
+			// killed, or the gRPC context was canceled) between mounting the
+			// tmpfs and writing provider objects to it. Returning mounted=true
+			// here would cause NodePublishVolume to short-circuit on the next
+			// retry and report success for an empty directory, starting the
+			// pod with no secrets. Unmount so the caller performs a fresh
+			// mount.
+			if len(entries) == 0 {
+				klog.InfoS("mount point exists but is empty; unmounting stale mount so caller can perform a fresh mount", "targetPath", target)
+				if err := ns.mounter.Unmount(target); err != nil {
+					klog.ErrorS(err, "failed to unmount stale empty mount", "targetPath", target)
+					return !notMnt, err
+				}
+				return false, nil
+			}
 			klog.InfoS("already mounted to target", "targetPath", target)
 			// already mounted
 			return !notMnt, nil

pkg/secrets-store/utils_test.go

@@ -19,6 +19,8 @@ package secretsstore
 import (
 	"context"
 	"fmt"
+	"os"
+	"path/filepath"
 	"reflect"
 	"testing"
 
@@ -28,6 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	mount "k8s.io/mount-utils"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 )
@@ -69,6 +72,102 @@ func newSecretProviderClassPodStatus(name, namespace, node string) *secretsstore
 	}
 }
 
+func TestEnsureMountPoint(t *testing.T) {
+	// newMountedFakeMounter returns a FakeMounter with target pre-registered
+	// as a tmpfs mount point, matching what nodeserver.go creates before the
+	// provider writes content.
+	newMountedFakeMounter := func(target string) *mount.FakeMounter {
+		return mount.NewFakeMounter([]mount.MountPoint{{Device: "tmpfs", Path: target, Type: "tmpfs"}})
+	}
+
+	tests := []struct {
+		name string
+		// setup prepares the target directory (a freshly created tempdir) and
+		// returns the mounter to use for this case.
+		setup func(t *testing.T, target string) mount.Interface
+		// expected return values of ensureMountPoint.
+		wantMounted bool
+		wantErr     bool
+		// wantStillMounted is the expected mount state AFTER ensureMountPoint
+		// runs, asserted via IsLikelyNotMountPoint.
+		wantStillMounted bool
+	}{
+		{
+			name: "target is not mounted",
+			setup: func(t *testing.T, target string) mount.Interface {
+				return mount.NewFakeMounter([]mount.MountPoint{})
+			},
+			wantMounted:      false,
+			wantErr:          false,
+			wantStillMounted: false,
+		},
+		{
+			name: "target is mounted and non-empty",
+			setup: func(t *testing.T, target string) mount.Interface {
+				if err := os.WriteFile(filepath.Join(target, "secret1"), []byte("v"), 0644); err != nil {
+					t.Fatalf("seed: %v", err)
+				}
+				return newMountedFakeMounter(target)
+			},
+			wantMounted:      true,
+			wantErr:          false,
+			wantStillMounted: true,
+		},
+		{
+			// Regression for the #1051 race: a previous NodePublishVolume call
+			// was interrupted between mounting tmpfs and writing content, so
+			// the kernel mount persists but the directory is empty. The fix
+			// unmounts the stale mount and returns mounted=false so the caller
+			// performs a fresh mount instead of short-circuiting to success on
+			// an empty directory.
+			name: "target is mounted but empty — stale mount is unmounted",
+			setup: func(t *testing.T, target string) mount.Interface {
+				return newMountedFakeMounter(target)
+			},
+			wantMounted:      false,
+			wantErr:          false,
+			wantStillMounted: false,
+		},
+		{
+			name: "target is mounted but empty and unmount fails — error is propagated",
+			setup: func(t *testing.T, target string) mount.Interface {
+				m := newMountedFakeMounter(target)
+				m.UnmountFunc = func(path string) error {
+					return fmt.Errorf("simulated unmount failure")
+				}
+				return m
+			},
+			wantMounted:      true,
+			wantErr:          true,
+			wantStillMounted: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			target := t.TempDir()
+			mounter := tt.setup(t, target)
+			ns := &nodeServer{mounter: mounter}
+
+			got, err := ns.ensureMountPoint(target)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("ensureMountPoint err = %v, wantErr %v", err, tt.wantErr)
+			}
+			if got != tt.wantMounted {
+				t.Errorf("ensureMountPoint mounted = %v, want %v", got, tt.wantMounted)
+			}
+
+			notMnt, nmErr := mounter.IsLikelyNotMountPoint(target)
+			if nmErr != nil {
+				t.Fatalf("IsLikelyNotMountPoint after: %v", nmErr)
+			}
+			if stillMounted := !notMnt; stillMounted != tt.wantStillMounted {
+				t.Errorf("still mounted after = %v, want %v", stillMounted, tt.wantStillMounted)
+			}
+		})
+	}
+}
+
 func TestCreateOrUpdateSecretProviderClassPodStatus(t *testing.T) {
 	tests := []struct {
 		name   string