K8S 强制删除卡在Terminating状态的namespaces 记录

问题

[root@master ~]# kubectl get ns
NAME              STATUS        AGE
default           Active        46d
kube-node-lease   Active        46d
kube-public       Active        46d
kube-system       Active        46d
monitoring        Terminating   46d

使用 --force 强制删除，比如删除命名空间 test，执行如下命令

kubectl delete ns monitoring --force --grace-period=0

调用API接口删除

[root@master ~]# netstat -ntlp | grep kube-apiserve
tcp6       0      0 :::6443                 :::*                    LISTEN      7737/kube-apiserver 
#API接口查询 
[root@master ~]# kubectl get ns monitoring -ojson > tmp.json
#导出信息

修改文件内容

[root@master ~]# cat tmp.json
{
    "apiVersion": "v1",
    "kind": "Namespace",
    "metadata": {
        "annotations": {
            "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Namespace\",\"metadata\":{\"annotations\":{},\"name\":\"monitoring\"}}\n"
        },
        "creationTimestamp": "2020-04-24T01:39:40Z",
        "deletionTimestamp": "2020-06-09T07:22:46Z",
        "name": "monitoring",
        "resourceVersion": "30261",
        "selfLink": "/api/v1/namespaces/monitoring",
        "uid": "3fdd71e6-9693-4d44-bd8a-f1e54799cde4"
    },
    "spec": {
        "finalizers": [
            "kubernetes"
        ]
    },
    "status": {
        "phase": "Terminating"
    }
}

删除以下代码段

"spec": {
    "finalizers": [
        "kubernetes"
    ]
},

权限问题

修改完成后，直接调用API接口会有报错如下


curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json https://127.0.0.1:6443/api/v1/namespaces/monitoring/finalize
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "namespaces \"monitoring\" is forbidden: User \"system:anonymous\" cannot update resource \"namespaces/finalize\" in API group \"\" in the namespace \"monitoring\"",
  "reason": "Forbidden",
  "details": {
    "name": "monitoring",
    "kind": "namespaces"
  },
  "code": 403

此时需要创建匿名用户的权限，命令如下

kubectl create clusterrolebinding test:anonymous --clusterrole=cluster-admin --user=system:annymous

再次调用

curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json https://127.0.0.1:6443/api/v1/namespaces/monitoring/finalize
{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "monitoring",
    "selfLink": "/api/v1/namespaces/monitoring/finalize",
    "uid": "3fdd71e6-9693-4d44-bd8a-f1e54799cde4",
    "resourceVersion": "30261",
    "creationTimestamp": "2020-04-24T01:39:40Z",
    "deletionTimestamp": "2020-06-09T07:22:46Z",
    "annotations": {
      "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Namespace\",\"metadata\":{\"annotations\":{},\"name\":\"monitoring\"}}\n"
    }
  },
  "spec": {
    
  },
  "status": {
    "phase": "Terminating"
  }

删除成功

[root@master ~]# kubectl get ns
NAME              STATUS   AGE
default           Active   46d
kube-node-lease   Active   46d
kube-public       Active   46d
kube-system       Active   46d