How to fix finalizer prevents resource deletion in Kubernetes

List finalizers:

kubectl get <resource-type> <name> -o yaml | grep finalizers -A 10

Or more directly:

kubectl get <resource-type> <name> -o jsonpath="{.metadata.finalizers}"

This shows you exactly which finalizers are preventing deletion.

Check if the controller that owns the finalizer is healthy:

kubectl get pods -n <namespace> | grep <controller-name>
kubectl describe pod <controller-pod> -n <namespace>  # Check for errors
kubectl logs <controller-pod> -n <namespace> --tail=100  # View recent logs

If the controller is down, restart it:

kubectl delete pod <controller-pod> -n <namespace>  # Forces restart

If a validating/mutating webhook is involved, check its logs:

kubectl get validatingwebhookconfigurations  # List all webhooks
kubectl describe validatingwebhookconfig <name>

Find the webhook's pod and check logs:

kubectl logs <webhook-pod> -n <namespace> --tail=100 | grep -i finalizer

If the webhook is timing out, verify it's reachable and responsive.

Some finalizers need dependent resources to complete cleanup. Verify they exist:

# Example: If finalizer references a ConfigMap
kubectl get configmap <name> -n <namespace>

If missing, create a dummy resource or remove the finalizer manually (see step 5).

If the finalizer controller is permanently gone, remove the finalizer manually:

kubectl patch <resource-type> <name> -p '{"metadata":{"finalizers":null}}' --type merge
# Or for specific finalizer:
kubectl patch <resource-type> <name> -p '{"metadata":{"finalizers":["other-finalizer"]}}' --type merge

WARNING: Only do this if you understand the cleanup impact. Removing a finalizer bypasses cleanup logic.

Alternatively, use kubectl edit:

kubectl edit <resource-type> <name>
# Remove the finalizer from metadata.finalizers list, save and exit

Force deletion after a timeout:

kubectl delete <resource-type> <name> --ignore-finalizers=true
# Or with grace period:
kubectl delete <resource-type> <name> --grace-period=0 --force

This bypasses finalizers entirely and immediately removes the resource. Use only if the resource is confirmed stuck.

Review the controller or operator managing the finalizer:

# Check operator logs
kubectl logs -n <operator-namespace> -l app=<operator-name> --tail=200

# Check if webhooks are misconfigurations
kubectl get validatingwebhookconfigurations -o yaml | grep -i finalizer

Common fixes:
- Increase webhook timeout: timeoutSeconds: 30 in webhook config
- Add a failure policy: failurePolicy: Ignore if cleanup isn't critical
- Fix controller restart issues by increasing memory/CPU limits
- Add better error handling in custom controller code

Use kubectl to watch what's happening:

kubectl get events -n <namespace> --field-selector involvedObject.name=<resource-name> --sort-by='.lastTimestamp'

This shows errors from controllers trying to process the deletion. Look for:
- Webhook timeout errors
- Resource not found errors
- Permission denied errors (RBAC issue)
- Communication failures (network, DNS)

Addressing these specific errors guides the fix.