deleting stuck namespace in kubernetes

When you create and delete resources and according objects in a namespace in your kubernetes cluster, you might just want to delete your namespace after your tests: kubectl delete ns test

stuck namespace

When namespace deletion seems stuck in a Terminating status, check if there are any object left over in your namespace:

• kubectl get all -n test
• for CRD you need to check for each type: kubectl api-resources --verbs=list --namespaced -o name | xargs -n 1 kubectl get --show-kind --ignore-not-found -n <terminating-namespace> (I found this snipped and also hints for the API calls here)

If all is clean, but the namespace is stuck in Terminating, check (kubectl get ns test -o yaml) for Finalizers.

spec:
  finalizers:
  - kubernetes

Options from here:

• kubectl delete ns test --force no graceful deletion, if the call does not fail to terminate
• the semi manual approach kubectl edit ns test and overwriting the finalizers there finalizers: []
  • no help if the metadata.annotations.kubectl.kubernetes.io/last-applied-configuration then has "spec":{"finalizers":[]} but the namespace (kubectl get ns test -o yaml) still has the spec: as before
• talk direct to the KubeAPI

delete the kubernetes namespace over API

(If you use the API direct, you loose all the checking usually done by kubectl!)

start the proxy to access the API

• kubectl proxy

get the namespac json, overwrite the finalizers (just as we have done above with kubectl edit …) and store it in a temporary file

• kubectl get namespace test -o json | jq '.spec = {"finalizers":[]}' >test-ns.json

send the created test-ns.json to the KubeAPI

• curl -k -H "Content-Type: application/json" -X PUT --data-binary @test-ns.json http://127.0.0.1:8001/api/v1/namespaces/test/finalize

verify success

kubectl get ns test returns Error from server (NotFound): namespaces "test" not found

The namespace is now gone.

(un)expected side effects

Martin Heinz wrote with much greater detail, why messing with finalizers is a bad idea most of the time. So only use --force --grace-period=0 if you also take care of the resources which might stray around afterwards.