How to fix ArgoCD finalizer stuck in Kubernetes

Verify the Application is stuck and identify which finalizers are present:

kubectl get application <app-name> -n argocd -o yaml | grep -A 5 "metadata:\|finalizers:\|deletionTimestamp"

Look for:
- metadata.deletionTimestamp present (indicates deletion was requested)
- metadata.finalizers containing resources-finalizer.argocd.argoproj.io
- Application status showing "Terminating"

Review ArgoCD controller logs to understand why cascade delete is stuck:

kubectl logs -n argocd deployment/argocd-application-controller -f | grep -i "finalizer\|error\|<app-name>"

Look for:
- "finalizer not removed" messages
- Resource deletion timeouts
- Permission denied errors
- Controller crashes or restarts

If cascade delete is not needed or the controller is unresponsive, remove the finalizer:

kubectl patch application <app-name> -n argocd -p '{"metadata":{"finalizers":null}}' --type merge

Verify removal:

kubectl get application <app-name> -n argocd -o yaml | grep finalizers

Once the finalizer is removed, the Application will be deleted immediately. Note: This does NOT cascade delete the managed resources—they will remain in the cluster.

If you want cascade delete to complete properly, restart the controller:

kubectl rollout restart deployment/argocd-application-controller -n argocd

Wait for the pod to restart:

kubectl rollout status deployment/argocd-application-controller -n argocd

The controller will resume processing the deletion and attempt cascade delete. Monitor logs:

kubectl logs -n argocd deployment/argocd-application-controller -f

If cascade delete completes but the finalizer remains, check for resources with their own finalizers:

# List all resources managed by the Application
kubectl get all -l argocd.argoproj.io/instance=<app-name> -o yaml | grep -B 5 "finalizers:"

# Check for common stuck resources
kubectl get pvc,pv,endpoints -o yaml | grep -B 10 "finalizers:"

Manually remove finalizers from stuck resources:

kubectl patch pvc <pvc-name> -p '{"metadata":{"finalizers":null}}' --type merge

As a last resort, force delete the Application using the grace period override:

kubectl delete application <app-name> -n argocd --grace-period=0 --force

This performs an immediate deletion without waiting for finalizers. Resources will remain in the cluster. Use only when:
- ArgoCD controller is permanently unavailable
- The Application cannot be recovered
- You understand cascade delete will not complete

To avoid finalizer problems in the future:

1. Only add the finalizer if cascade delete is truly needed:

# Good: Add finalizer explicitly when creating app
argocd app create <app-name> --cascade

# Avoid manually adding it without understanding cascade delete

2. Use background cascade deletion (safer than foreground):

argocd app create <app-name> --cascade=background

3. Ensure ArgoCD controller has sufficient resources and is monitored for crashes:

kubectl top pod -n argocd | grep application-controller
kubectl describe deployment/argocd-application-controller -n argocd