kubectl drain "cannot delete DaemonSet-managed Pods" in CI

By Kaveh Alemi·Latchkey

kubectl drain refuses by default when a node hosts DaemonSet-managed pods or pods using local (emptyDir) storage, because those cannot be cleanly rescheduled. It aborts and tells you which flags acknowledge that.

What this error means

kubectl drain <node> exits non-zero immediately with cannot delete DaemonSet-managed Pods and/or cannot delete Pods with local storage, listing the pods. Nothing is evicted until you pass the acknowledging flags.

error: unable to drain node "ip-10-0-1-5": cannot delete DaemonSet-managed Pods
(use --ignore-daemonsets to ignore): kube-system/aws-node-xyz, kube-system/kube-proxy-abc;
cannot delete Pods with local storage (use --delete-emptydir-data to override)

Common causes

DaemonSet pods cannot be evicted normally

DaemonSet pods are re-created on the node by their controller, so drain refuses to delete them unless you explicitly ignore them with --ignore-daemonsets.

Pods using emptyDir local storage

Evicting a pod with an emptyDir discards that data. Drain refuses unless you confirm with --delete-emptydir-data.

How to fix it

Drain with the acknowledging flags

Tell drain to ignore DaemonSets and to accept emptyDir data loss, which is normal for node maintenance.

kubectl drain ip-10-0-1-5 \
  --ignore-daemonsets \
  --delete-emptydir-data \
  --timeout=120s

Respect PodDisruptionBudgets during drain

1. Use --timeout so a stuck eviction does not hang CI forever.
2. If drain blocks on a PDB, fix the budget rather than forcing eviction.
3. Use --grace-period to give pods time to shut down cleanly.

How to prevent it

• Always pass --ignore-daemonsets for node maintenance drains in CI.
• Know which pods use emptyDir before adding --delete-emptydir-data.
• Keep PDBs satisfiable so drains can complete.

Frequently asked questions

Related guides

References

• Kubernetes documentation
• GitHub Actions documentation