强制删除命名空间（K8S 强制删除卡在Terminating状态的namespaces 记录）

董林夕

已于 2024-04-10 14:24:48 修改

阅读量488

点赞数 2

文章标签： kubernetes 容器云原生

于 2024-04-10 14:06:10 首次发布

本文链接：https://blog.csdn.net/qq_44663072/article/details/137594437

版权

参考：https://blog.csdn.net/lxy___/article/details/106644302

调用API接口删除

[root@master ~]# netstat -ntlp | grep kube-apiserve
tcp6       0      0 :::6443                 :::*                    LISTEN      7737/kube-apiserver 
#API接口查询 
[root@master ~]# kubectl get ns monitoring -ojson > tmp.json
#导出信息

修改如下内容

[root@master ~]# cat tmp.json
{
    "apiVersion": "v1",
    "kind": "Namespace",
    "metadata": {
        "annotations": {
            "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Namespace\",\"metadata\":{\"annotations\":{},\"name\":\"monitoring\"}}\n"
        },
        "creationTimestamp": "2020-04-24T01:39:40Z",
        "deletionTimestamp": "2020-06-09T07:22:46Z",
        "name": "monitoring",
        "resourceVersion": "30261",
        "selfLink": "/api/v1/namespaces/monitoring",
        "uid": "3fdd71e6-9693-4d44-bd8a-f1e54799cde4"
    },
    "spec": {
        "finalizers": [
            "kubernetes"
        ]
    },
    "status": {
        "phase": "Terminating"
    }
}

删除以下代码段

"spec": {
    "finalizers": [
        "kubernetes"
    ]
},

权限问题

修改完成后，直接调用API接口会有报错如下


curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json https://127.0.0.1:6443/api/v1/namespaces/monitoring(替换成自己要删除的ns)/finalize
{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {
    
  },
  "status": "Failure",
  "message": "namespaces \"monitoring\" is forbidden: User \"system:anonymous\" cannot update resource \"namespaces/finalize\" in API group \"\" in the namespace \"monitoring\"",
  "reason": "Forbidden",
  "details": {
    "name": "monitoring",
    "kind": "namespaces"
  },
  "code": 403

此时需要创建匿名用户的权限，命令如下

kubectl create clusterrolebinding test:anonymous --clusterrole=cluster-admin --user=system:anonymous

再次调用

curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json https://127.0.0.1:6443/api/v1/namespaces/monitoring(替换成自己要删除的ns)/finalize
{
  "kind": "Namespace",
  "apiVersion": "v1",
  "metadata": {
    "name": "monitoring",
    "selfLink": "/api/v1/namespaces/monitoring/finalize",
    "uid": "3fdd71e6-9693-4d44-bd8a-f1e54799cde4",
    "resourceVersion": "30261",
    "creationTimestamp": "2020-04-24T01:39:40Z",
    "deletionTimestamp": "2020-06-09T07:22:46Z",
    "annotations": {
      "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"Namespace\",\"metadata\":{\"annotations\":{},\"name\":\"monitoring\"}}\n"
    }
  },
  "spec": {
    
  },
  "status": {
    "phase": "Terminating"
  }

删除成功

[root@master ~]# kubectl get ns
NAME              STATUS   AGE
default           Active   46d
kube-node-lease   Active   46d
kube-public       Active   46d
kube-system       Active   46d