[EKS] [bug]: efs/ebs csi-drivers sometimes do not remove taints from nodes
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Please tackle what seems to be an ebs and efs csi-driver race condition.
This roadmap request was opened as suggested by AWS support.
**Which service(s) is this request for?**
EKS, more specifically EBS and EFS CSI drivers.
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Sometimes a node remains tainted by the ebs/efs csi-driver taints even after they have successfully been initialized.
In our current setup, we are using EKS, a karpenter managed nodepool, and ebs and efs csi-drivers installed through helm.
We're running:
- EKS `v1.30`
- karpenter chart `v1.0.2`
- ebs-csi-driver chart `v2.36.0`
- efs-csi-driver chart `v3.0.8`
This is the lifecycle of a problematic node:
1. Karpenter starts up a new node with both `efs.csi.aws.com/agent-not-ready:NoExecute` and `ebs.csi.aws.com/agent-not-ready:NoExecute` taints configured as [startupTaints](https://karpenter.sh/v1.0/concepts/nodepools/#spectemplatespecstartuptaints).
2. Both the ebs and efs csi drivers get scheduled on the node and state in their logs that they have removed their respective taint from the node,
3. The issue is that sometimes it indeed gets removed, but sometimes it doesn't. When one, or both of the taints don't get removed we end up with a node that can't have workloads scheduled on and that can't be disrupted by karpenter either since karpenter refuses to disrupt the nodes with the following message:
```
Cannot disrupt Node: state node isn't initialized
```
4. We're left with a stuck node.
I've attached logs for the 2 daemonset pods that were scheduled on an instance where neither the ebs nor the efs taints were removed.
**Are you currently working around this issue?**
We are currently unable to work around this issue in an unattended way and we're left with tainted, unconsolidatable nodes in our pool.
The easiest manual workaround is to cordon the node and untaint it so that karpenter can remove it from the pool.
Unfortunately, due to the scale of our deployments this is not really feasible to perform this manual task multiple times a day.
**Additional context**
This issue was opened as suggested by AWS support.
We have raised this issue with our TAM on the 11th of November.
There are 2 issues on github, one for EBS and another for EFS, the latter is currently closed, but the issue seems very similar:
https://github.com/kubernetes-sigs/aws-ebs-csi-driver/issues/2199
https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/1491
**Attachments**
[ebs-csi-node.log](https://github.com/user-attachments/files/17716821/ebs-csi-node.log)
[efs-csi-node.log](https://github.com/user-attachments/files/17716822/efs-csi-node.log)
Contributor guide
Research direction
Start by reviewing the attached ebs-csi-node.log and efs-csi-node.log, then reproduce or investigate the interaction between EKS, Karpenter startupTaints, and the EBS/EFS CSI drivers. No source file or test is named; done would require an agreed explanation and fix for the intermittent taint-removal failure, with evidence that affected nodes can be initialized and disrupted normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, helm, kubernetes
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100