VKS Namespace Deletion Hangs Indefinetely When antreaNSX.enable=true is Configured
Article ID: 435039
Updated On:
Products
Issue/Introduction
When deleting a namespace in a VKS cluster with NSX interworking is enabled using antreaNSX.enable=true, the namespace gets stuck in a Terminating state indefinitely.
The Antrea Addons Contorller log will report the following error:
"Error reconciling AntreaConfig to create data value secret" err="Antrea-NSX is enabled but creating or patching ProviderServiceAccount error: VSphereCluster.vmware.infrastructure.cluster.x-k8s.io \"#####-####\" not found"
When describing the namespace stuck deleting it reports deletion failures similar to:
message: All content successfully deleted, may be waiting on finalization
reason: ContentDeleted
status: "False"
type: NamespaceDeletionContentFailure
Environment
vSphere Kubernetes Service (VKS) clusters running on vCenter Version 8.0U3 and NSX Version: 4.2 or higher that have antreaNSX.enable=true
Cause
The namespace deletion hangs due to a known bug where the Antrea Addon Controller fails to log a timestamp for when the AntreaConfig was deleted during the namespace cleanup process, resulting in the Antrea Addon Controller to report "AntreaConfig resource not found" and continuously attempt to reconcile the AntreaConfig. The AntreaConfig reconciliation fails indefinitely which prevents the namespace cleanup process from proceeding with removing the NSXServiceAccounts.
Resolution
Manually remove the NSXServiceaAccounts that are associated to the namespace that is stuck deleting.
1. List the NSX ServiceAccounts inside the stuck namespace:
# kubectl get nsxserviceaccounts -n <name-of-namespace-stuck-deleting>
2. Delete the accounts manually:
# kubectl delete nsxserviceaccounts --all -n <name-of-namespace-stuck-deleting>
3. Confirm the namespace was deleted successfully:
# kubectl get ns
Additional Information
Feedback
