Fixing AKS MemoryPressure Eviction and Azure Disk CSI Deadlock
How AKS MemoryPressure evictions cause Azure Disk CSI VolumeAttachment deadlocks, plus root-cause fixes: QoS, KubeletConfig, PDBs, and CI/CD guardrails.
When an AKS node crosses its memory eviction threshold, kubelet evicts BestEffort pods first — typically stateful workloads that never got explicit resource requests. Because the pod is force-killed, the Azure Disk CSI driver's external-attacher sidecar can't cleanly detach the volume, leaving a VolumeAttachment stuck in Terminating and blocking the pod from starting on any new node with a 'Multi-Attach' error.
Without a PodDisruptionBudget, this cascades into a full Deployment outage even as the node pool autoscaler adds capacity, since the stuck VolumeAttachment prevents the PV from binding to the new node. The durable fix is setting requests/limits on every container (Guaranteed QoS via requests==limits is recommended for critical workloads), tuning AKS KubeletConfig soft/hard eviction thresholds to match actual node headroom, and adding a PDB.
For prevention, an OPA/Gatekeeper admission policy can reject pods missing memory requests, Checkov can scan IaC in CI/CD for the same gaps, and node pools should be sized so total pod memory requests stay under roughly 70% of allocatable memory. Manually clearing a stuck VolumeAttachment's finalizer should only be done after confirming in the Azure Portal that the disk isn't actually attached to a running VM.