Error: GetDeviceMountRefs check failed for volume

[mstefany]

/kind bug

What happened? We have /mnt/kubelet bind-mounted to /var/lib/kubelet due to capacity reasons (root FS is quite small and empty-dirs can consume lots of space). Sometimes it happens that EBS volume does not unmount properly leaving original mounts with RO flag (this triggers our Icinga check for RO filesystems). The error in log says:

May 26 00:15:32 k8s-worker06 kubelet[42805]: E0526 00:15:32.898054   42805 nestedpendingoperations.go:335] Operation for "{volumeName:kubernetes.io/csi/ebs.csi.aws.com^vol-[REDACTED] podName: nodeName:}" failed. No retries permitted until 2022-05-26 00:17:34.898037761 +0200 CEST m=+2271351.782310494 (durationBeforeRetry 2m2s). Error: GetDeviceMountRefs check failed for volume "pvc-19942473-fee2-45d0-8136-60e31ebfb40a" (UniqueName: "kubernetes.io/csi/ebs.csi.aws.com^vol-[REDACTED]") on node "k8s-worker06.[REDACTED]" : the device mount path "/var/lib/kubelet/plugins/kubernetes.io/csi/pv/pvc-19942473-fee2-45d0-8136-60e31ebfb40a/globalmount" is still mounted by other references [/mnt/kubelet/plugins/kubernetes.io/csi/pv/pvc-19942473-fee2-45d0-8136-60e31ebfb40a/globalmount]

What you expected to happen? EBS volume should unmount properly and should not leave FS pseudo-mounted with RO flag.

How to reproduce it (as minimally and precisely as possible)? Not sure. It happens rarely, we counted approx. 14 occurences since Sep 1st 2021 till May 26th 2022 across different k8s workers.

Anything else we need to know?: Environment is a self-managed kubeadm-installed Kubernetes cluster on AWS EC2 instances. AWS EBS CSI driver is installed from official Helm Chart. /var/lib/kubelet is actually bind mount to /mnt/kubelet which is a separate EBS volume attached to EC2 instance (k8s worker):

/mnt/kubelet	/var/lib/kubelet	none	rw,bind	0	0

[user@k8s-worker06:~] df -h /mnt/kubelet /var/lib/kubelet
Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme1n1    689G   35G  619G   6% /mnt
/dev/nvme1n1    689G   35G  619G   6% /var/lib/kubelet

Environment

• Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.4", GitCommit:"e6c093d87ea4cbb530a7b2ae91e54c0842d8308a", GitTreeState:"clean", BuildDate:"2022-02-16T12:38:05Z", GoVersion:"go1.17.7", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.4", GitCommit:"e6c093d87ea4cbb530a7b2ae91e54c0842d8308a", GitTreeState:"clean", BuildDate:"2022-02-16T12:32:02Z", GoVersion:"go1.17.7", Compiler:"gc", Platform:"linux/amd64"}

(also previous versions like 1.22.6 or 1.21.x).

• Driver version: 1.1.0 & also 1.6.1

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[mstefany]

/remove-lifecycle stale

[torredil]

Hi @mstefany, thanks for reporting this. My understanding is that this is not a CSI driver bug; bind mounting /var/lib/kubelet is not intended behavior. I would suggest changing the Kubelet dir directly. In doing so, be sure to configure the new kubeletPath in the Helm chart: https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/b56e394f4c718d4515958fc03bfd1da5308fea16/charts/aws-ebs-csi-driver/values.yaml#L171

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.