Function source_mutates_live_volume 

pub fn source_mutates_live_volume(
    copy_method: CopyMethod,
    source: &Source,
) -> bool

Whether this source’s mount lets the kubelet rewrite the live workload volume: a writable mount with no staging in front of it.

copyMethod: Snapshot/Clone interpose a throwaway staged PVC, so the kubelet’s recursive fsGroup chgrp lands on a copy that is deleted when the run ends. Only Direct mounts the workload’s own PVC, where that same walk permanently rewrites group ownership on production data. Pure, and the single definition of the hazard.

An nfs source is excluded, and not merely because validate_source rejects a writable one anyway: the kubelet does not apply fsGroup to in-tree NFS volumes at all, so no walk ever happens and this predicate’s premise is simply false there. Answering true would also make admission emit two errors for one mistake, the second of them advice — “set acknowledgeLiveMutation” — that could never make the configuration valid.