kubernetes device or resource busy的问题

最近kubernetes遇到了无法删除pod的问题，日志如下：

10月 17 13:29:09 k8s-node kubelet[16145]: I1017 13:29:09.034868   16145 reconciler.go:186] operationExecutor.UnmountVolume started for volume "default-token-pzyxh" (UniqueName: "kubernetes.io/secret/81791176-a505-11e7-accf-5254fe5a9007-default-token-pzyxh") pod "81791176-a505-11e7-accf-5254fe5a9007" (UID: "81791176-a505-11e7-accf-5254fe5a9007")
10月 17 13:29:09 k8s-node kubelet[16145]: E1017 13:29:09.035292   16145 nestedpendingoperations.go:262] Operation for "\"kubernetes.io/secret/81791176-a505-11e7-accf-5254fe5a9007-default-token-pzyxh\" (\"81791176-a505-11e7-accf-5254fe5a9007\")" failed. No retries permitted until 2017-10-17 13:31:11.035205617 +0800 CST (durationBeforeRetry 2m2s). Error: UnmountVolume.TearDown failed for volume "default-token-pzyxh" (UniqueName: "kubernetes.io/secret/81791176-a505-11e7-accf-5254fe5a9007-default-token-pzyxh") pod "81791176-a505-11e7-accf-5254fe5a9007" (UID: "81791176-a505-11e7-accf-5254fe5a9007") : remove /var/lib/kubelet/pods/81791176-a505-11e7-accf-5254fe5a9007/volumes/kubernetes.io~secret/default-token-pzyxh: device or resource busy

解决方法:

使用脚本检查目录被谁占用

#!/bin/bash
declare -A map
for i in `find /proc/*/mounts -exec grep $1 {} + 2>/dev/null | awk '{print $1"#"$2}'`
do
    pid=`echo $i | awk -F "[/]" '{print $3}'`
    point=`echo $i | awk -F "[#]" '{print $2}'`
    mnt=`ls -l /proc/$pid/ns/mnt |awk '{print $11}'`
    map["$mnt"]="exist"
    cmd=`cat /proc/$pid/cmdline`
    echo -e "$pid\t$mnt\t$cmd\t$point"
done

for i in `ps aux|grep docker-containerd-shim |grep -v "grep" |awk '{print $2}'`
do
    mnt=`ls -l /proc/$i/ns/mnt  2>/dev/null | awk '{print $11}'`
    if [[ "${map[$mnt]}" == "exist" ]];then
        echo $mnt
    fi
done

sh leak.sh /var/lib/kubelet/pods/81791176-a505-11e7-accf-5254fe5a9007/volumes/kubernetes.io~secret/default-token-pzyxh

可以看到被占用:

8392    mnt:[4026532536]    /bin/bash/start.sh--logtostderr -v=2    /var/lib/kubelet/pods/81791176-a505-11e7-accf-5254fe5a9007/volumes/kubernetes.io~secret/default-token-pzyxh

找到8392的父进程：

[root@k8s-node ~]# ps -ef | grep 8392
root      8392  8345  0 9月30 ?       00:00:00 /bin/bash /start.sh --logtostderr -v=2
root      8420  8392  0 9月30 ?       00:17:19 /usr/bin/python /usr/bin/supervisord -c supervisord.conf
root     13757  7126  0 13:35 pts/2    00:00:00 grep --color=auto 8392
[root@k8s-node ~]#

继续找到8345的父进程:

root      8345   783  0 9月30 ?       00:00:01 docker-containerd-shim 42fe1338a0ebd849630d92f46b4c343376ec7c7ffe9a3666f9725715d4f4d064 /var/run/docker/libcontainerd/42fe1338a0ebd849630d92f46b4c343376ec7c7ffe9a3666f9725715d4f4d064 docker-runc
root      8392  8345  0 9月30 ?       00:00:00 /bin/bash /start.sh --logtostderr -v=2

可以看到是id为42fe1338a0ebd849630d92f46b4c343376ec7c7ffe9a3666f9725715d4f4d064的docker在占用

exec到容器里面df -h看到/var/lib/kubelet也被挂载到容器里面，在容器里面umount以后就可以删除了。

docker exec -it 42fe1338a0ebd849630d92f46b4c343376ec7c7ffe9a3666f9725715d4f4d064 sh

作者：YiQinGuo
链接：https://www.jianshu.com/p/4fc11a0a31da