How to Fix Stuck Resources in Kubernetes

Ever tried deleting a namespace or a resource in Kubernetes, only to find it stuck in a terminating state? You run kubectl delete namespace argocd, and instead of disappearing, it just hangs there—indefinitely.

This happens due to finalizers, which are Kubernetes’ way of ensuring that dependent resources are cleaned up before deletion. However, if the cleanup fails or a resource is unresponsive, the finalizer prevents deletion — leaving your resources stuck.

In this guide, you’ll learn:
Why resources get stuck in Kubernetes
How to check and remove finalizers
Commands to force-delete stuck resources

The problem

Understanding Why Resources Get Stuck

Kubernetes uses finalizers to prevent premature deletion of resources. These finalizers ensure that:

• All child resources (e.g., PVCs, pods) are cleaned up.
• Controllers (e.g., ArgoCD, Istio) have time to perform necessary cleanup.

The problem? If the controller responsible for a resource is missing, broken, or unresponsive, the finalizer never gets removed, and the resource stays in a terminating state forever.

The solution

Check If Finalizers Are Blocking Deletion

Run this command to inspect the finalizers on the stuck namespace (e.g., argocd):

kubectl get namespace argocd -o json | jq '.spec.finalizers'

If you see a response like this:

[
  "kubernetes"
]

It means that a finalizer is preventing deletion.

Remove the Finalizers to Force Deletion

To remove finalizers and force-delete the stuck namespace, run:

kubectl patch ns argocd -p '{"metadata": {"finalizers": null}}' --type merge

This removes all finalizers and allows the namespace to be deleted immediately.

This can also be used to remove finalizer from a resource, not only namespaces, for instance:

kubectl patch ingress -n argocd argocd-ingress  -p '{"metadata": {"finalizers": null}}' --type merge

kubectl patch secret -n argocd argocd-initial-admin-secret  -p '{"metadata": {"finalizers": null}}' --type merge

Check for Stuck Resources Inside the Namespace

Sometimes, even after removing the finalizer, dependent resources inside the namespace prevent deletion. To list all namespaced resources in argocd, use:

kubectl api-resources --verbs=list --namespaced -o name | xargs -n 1 kubectl -n argocd get --ignore-not-found

This command will list all remaining resources inside argocd, helping you identify what’s still pending.

Manually Delete Stuck Resources

Once you identify stuck resources (e.g., pods, CRDs, services), try deleting them individually:

kubectl delete <resource-type> <resource-name> -n argocd --force --grace-period=0

For example, to delete a stuck pod:

kubectl delete pod my-stuck-pod -n argocd --force --grace-period=0

Preventing Future Stuck Resources in EKS

Ensure Controllers Are Running

• If a controller (e.g., ArgoCD, Istio) is responsible for cleaning up resources, ensure it is running before deleting namespaces.

Use Finalizers Only When Necessary

• If you manage CRDs, avoid unnecessary finalizers unless cleanup is critical.

Monitor Namespace Deletions

• Run kubectl get ns <namespace> -o json before deletion to check for problematic finalizers in advance.

Conclusion

If your EKS resources are stuck in a terminating state, finalizers are usually the culprit.

You can quickly regain control and force-delete stuck resources.

Want more insights on DevOps, security, and automation? Don’t miss out — Follow me!

Connect with me on Linkedin!