Kubernetes MountVolume.SetUp failed for volume: mount failed: exit status 32

Not specified by the original author.

TL;DR

Exit status 32 from the mount syscall means the kernel rejected the mount: wrong filesystem type or a damaged superblock. Get the device path from the pod event, inspect it on the node, and fix the fstype or reformat. The volume attached fine; the mount step is what failed.

Verbatim error

Warning  FailedMount  [AGE]  kubelet  MountVolume.SetUp failed for volume "[PV-NAME]" : mount failed: exit status 32

Steps

1. Get the full event, which usually names the device and the attempted filesystem type.

kubectl describe pod [POD] -n [NAMESPACE]

Expected: the FailedMount message includes the volume name and sometimes the device path and fstype the kubelet tried. Note both.

2. On the node, check what is actually on the device.

lsblk -f
dmesg | tail -n 30

Expected: lsblk shows the device and its real filesystem type (or none, if unformatted). dmesg shows the kernel's mount complaint, for example wrong fs type or bad superblock. Run these on the node via your node access method.

3. Compare against the PV spec's fstype.

kubectl get pv [PV-NAME] -o yaml

Expected: the fstype field (often ext4 or xfs). If the device was formatted with a different filesystem, update the PV to match reality, or reformat the device to match the PV.

4. If the filesystem is corrupt, check and repair it. This is safe only when you can tolerate the risk; snapshot first if the data matters.

fsck -n [DEVICE]

Expected: fsck reports whether the filesystem is clean or damaged. The -n flag makes it read-only. Repair only after you have a backup or have accepted data loss.

5. If the volume is new and unformatted, format it to the expected type.

mkfs.ext4 [DEVICE]

Expected: the device now carries a fresh filesystem. This destroys any data on the device, so only do it for volumes that are supposed to be empty. Then delete the pod to retry the mount.

kubectl delete pod [POD] -n [NAMESPACE]

Expected: the replacement pod mounts the volume and starts.

When to use

• FailedMount with mount failed: exit status 32 in the message
• A block volume attached successfully but will not mount
• The failure followed a manual format, a PV edit, or a node rebuild

When not to use

• The error is exit status 1 or a permission denied; that is usually a driver or credential issue, not the filesystem
• The volume never attaches; that is an attach-layer problem (FailedAttachVolume)
• The pod uses NFS or another network filesystem; exit 32 there means something different (mount helper or server issue)

Why it happens

Attaching a block device and mounting a filesystem are separate steps. Exit status 32 is the mount helper telling the kubelet the kernel refused the mount, almost always because the fstype given does not match what is on the disk, or the superblock is damaged. The CSI attacher did its job; the filesystem layer did not.

Edge cases

• xfs volumes formatted without the right features can fail on older kernels; check dmesg for the specific xfs complaint.
• A device that previously held a different filesystem (reused cloud disk) mounts only after reformatting; the old superblock confuses the mount.
• ReadOnly mounts of a dirty filesystem can fail where read-write succeeds; fsck first.
• Some CSI drivers set fstype implicitly; if the PV has no fstype field, check the driver's default before reformatting.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstQHcptMjQcxkyEoDEL9uyw

Resolved from the public thread: https://vectle.com/posts/pstQHcptMjQcxkyEoDEL9uyw

Thread query: Kubernetes "MountVolume.SetUp failed for volume: mount failed: exit status 32"

TL;DR: Exit status 32 from the mount syscall means the kernel rejected the mount: wrong filesystem type or a damaged superblock. Get the device path from the pod event, inspect it on the node, and fix the fstype or reformat. The volume attached fine; the mount step is what failed.

Not specified by the original author.

TL;DR

Describe the pod; the FailedMount event names the volume and the reason. Most cases are an unbound PVC, a broken StorageClass provisioner, or a missing CSI driver secret. Fix the volume layer and the pod follows.

Verbatim error

Warning  FailedMount  [AGE]  kubelet  Unable to attach or mount volumes: unmounted volumes=[[VOLUME-NAME]], unattached volumes=[[VOLUME-NAME]]: timed out waiting for the condition

Steps

1. Describe the pod and read the full FailedMount message.

kubectl describe pod [POD] -n [NAMESPACE]

Expected: the event names the volume and gives a reason, for example the PVC is not bound, the attach timed out, or a secret was not found. The reason picks the next step.

2. Check the PVC state.

kubectl get pvc -n [NAMESPACE]
kubectl describe pvc [PVC-NAME] -n [NAMESPACE]

Expected: Bound means the problem is at attach or mount time; Pending means provisioning or binding failed, and the PVC events say why.

3. Check the StorageClass and its provisioner.

kubectl get storageclass
kubectl get storageclass [SC-NAME] -o yaml

Expected: the provisioner field names the CSI driver responsible. If the class is missing or the provisioner string is wrong, fix the PVC to reference a valid class.

4. Verify the CSI driver pods are healthy, including the node plugin on the target node.

kubectl get pods -n [CSI-NAMESPACE] -o wide
kubectl get pods -n [CSI-NAMESPACE] -l app=[CSI-NODE-PLUGIN-LABEL] -o wide

Expected: controller and node-plugin pods are Running on the node where your pod is scheduled. CrashLooping or missing node plugins explain attach timeouts.

5. For secret-based drivers, confirm the referenced secret exists in the expected namespace.

kubectl get secret [SECRET-NAME] -n [NAMESPACE]

Expected: the secret exists with the keys the driver documents. A missing or misspelled secret is a common cause of mount failures.

When to use

• Pods stuck Pending or ContainerCreating with FailedMount warnings
• Events say unable to attach or mount volumes or timed out waiting for the condition
• The failure followed a StorageClass change, CSI upgrade, or new node pool

When not to use

• The pod fails with CreateContainerConfigError (config reference issue, not storage)
• The error is FailedAttachVolume naming a cloud disk that no longer exists; that is a detached-volume cleanup case
• The workload uses hostPath or emptyDir; those never go through attach/mount provisioning

Why it happens

Mounting a volume is a chain: PVC binds to a PV, the external provisioner or attacher prepares the disk, the CSI node plugin mounts it on the node, then the kubelet bind-mounts it into the container. FailedMount is the kubelet reporting that some link in that chain timed out or errored, so debugging means walking the chain from the pod downward.

Edge cases

• The PVC is Bound but to a PV in a different zone than the node; the attach can never succeed. Check node zone labels against the PV nodeAffinity.
• Stale VolumeAttachment objects from a crashed node block re-attach; delete the orphaned attachment after confirming the old node is gone.
• Driver upgrades sometimes rename the provisioner string; old PVCs referencing the old name stay Pending forever.
• Multi-attach errors (volume already attached to another node) need the old attachment released before the new node can mount.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstuhUwSu-hzsSlJOjyN5WvQ

Resolved from the public thread: https://vectle.com/posts/pstuhUwSu-hzsSlJOjyN5WvQ

Thread query: Kubernetes "FailedMount": "unable to attach or mount volumes" debugging

TL;DR: Describe the pod; the FailedMount event names the volume and the reason. Most cases are an unbound PVC, a broken StorageClass provisioner, or a missing CSI driver secret. Fix the volume layer and the pod follows.

Not specified by the original author.

TL;DR

The CSI driver for the secrets store is not installed on the cluster, so the volume cannot mount. Install the Secrets Store CSI driver DaemonSet plus the provider for your secret backend (AWS, Vault, Azure), then recreate the pod.

Error

"driver name secrets-store.csi.k8s.io not found in the list of registered csi drivers"

Steps

1. Confirm the driver is absent: kubectl get csidrivers. Expected: no entry for the secrets-store driver.
2. Install the driver with its Helm chart or manifests, then the provider chart for your backend. Expected: the driver DaemonSet runs on each node.
3. Verify registration: kubectl get csidrivers again. Expected: the secrets-store driver is listed.
4. Check your SecretProviderClass references the right provider and secret names. Expected: the class matches what the backend holds.
5. Delete the failing pod so it reschedules and mounts the volume. Expected: the pod starts with the secret mounted.

When to use

• Pods fail with the unregistered-driver message on volume mount.
• Setting up secrets-store CSI for the first time.

When not to use

• The driver is registered but the mount fails on auth (provider credentials issue).
• You use external-secrets instead of the CSI driver (different component).

Tool compatibility

• Secrets Store CSI Driver; providers for AWS, Azure, Vault, GCP; Kubernetes 1.24+.

Variant phrasings

secretproviderclass failed to mount

Same component; check driver then provider then class.

csi driver not found for secrets store

Identical cause.

Why it happens

The driver is an add-on, not part of Kubernetes. Clusters without it cannot satisfy volume claims that name it.

Edge cases

• The driver and the provider are separate installs; the driver alone does not talk to your secret backend.
• Node OS differences (Windows nodes) need the matching driver image.
• Provider auth (IAM role, Vault auth) is the next failure after the driver registers; fix one layer at a time.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstfHjca1YIL8pAKp853hiuw

Resolved from the public thread: https://vectle.com/posts/pstfHjca1YIL8pAKp853hiuw

Thread query: "driver name secrets-store.csi.k8s.io not found in the list of registered csi drivers"

TL;DR: The CSI driver for the secrets store is not installed on the cluster, so the volume cannot mount. Install the Secrets Store CSI driver DaemonSet plus the provider for your secret backend (AWS, Vault, Azure), then recreate the pod.