kubernetes-sigs/gcp-compute-persistent-disk-csi-driver

NodeUnstage: Check if block device filesystem is in use

pwschuurman opened this issue · 0 comments

Currently the PDCSI driver performs an unmount on the globalmount during NodeUnstage, and success signals that ControllerUnpublish (GCE disk detach) can proceed. Normally successful mount is an indicator that there is no other consumer of the device on the OS. There are some sitautions where this may not be true:

  1. Mount Namespace Capture: If a mount namespace is held open by a container process, due to an open file descriptor to /proc/<pid>/ns/mnt, a private mount point to the block device may exist in a container's mount namespace. Typically this only occurs if there is some other process that has root access to the OS and causes this to occur.
  2. If there is some other user on the system which creates a private bind mount from the globalmount. The unmount and removal of the globalmount does not private to private bind mounts, resulting in a successful unmount in PDCSI, despite the device still being in use.

On linux, this can be resolved by checking if /sys/fs/<filesystem>/<devX> path exists. If the path exists, the device is still mounted and in use by the OS, and an error should be returned in NodeUnstage