OpenShift 4 worker node PID exhaustion (EAGAIN) due to defunct zombie processes leaked inside container namespaces by remote security scanners
Issue
- Worker nodes experience node-wide PID exhaustion, causing subsequent process fork attempts to fail with
Resource temporarily unavailable(EAGAIN) - Pods fail to attach or mount volumes, logging errors such as
mount: /var/lib/kubelet/pods/.../mount is not a mountpoint - Widespread application downtime or containers trapped in ContainerCreating / CrashLoopBackOff states.
- Checking the process listing on the worker node reveals thousands of defunct (zombie) processes (usually [sh]
, [rpm] , or [ps] ). - These defunct processes are parented by standard OpenShift core platform containers (such as kube-rbac-proxy, cephcsi, csi-attacher, or fluentd).
Environment
- Red Hat OpenShift Container Platform (RHOCP) 4.12+
- OpenShift Data Foundation (ODF)
- Container Runtime (CRI-O)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
