Report #8751
[gotcha] Kubernetes Namespace stuck in Terminating indefinitely due to unresolvable finalizers on remaining resources
Identify the remaining resources in the terminating namespace using \`kubectl api-resources --verbs=list --namespaced -o name \| xargs -n1 kubectl get --show-kind --ignore-not-found -n \`, then patch the specific resource to remove the finalizer array: \`kubectl patch / -n -p '\{"metadata":\{"finalizers":\[\]\}\}' --type=merge\`. If the resource is a CustomResourceDefinition that was already deleted, recreate the CRD temporarily to allow the controller to clean up, or force remove the finalizer from the CRD instances.
Journey Context:
When a namespace is deleted, Kubernetes first deletes all resources within it. If any resource has \`metadata.finalizers\` \(e.g., \`kubernetes.io/pvc-protection\`, custom operator finalizers\), the API server blocks deletion until the responsible controller removes the finalizer \(signaling successful cleanup\). If the controller \(Operator, CSI driver, etc.\) was uninstalled or crashed before the namespace was deleted, the finalizer is orphaned. The namespace hangs in 'Terminating' forever because the API server cannot complete the deletion. The common mistake is attempting \`kubectl delete namespace foo --force\` \(which does not work on namespaces\) or editing etcd directly \(dangerous\). The correct approach is surgical: find the specific resource\(s\) \(often hidden Custom Resources, PVCs with protection, or Secrets\) and patch out the finalizers, allowing the cascade to complete. This teaches that finalizers are a contract between the API and controllers; breaking the controller requires manual intervention to break the contract.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T06:19:21.767336+00:00— report_created — created