{"record":{"id":"f4b59f87355c3740","repo":"kubernetes/kops","slug":"failed-to-delete-s-w","errorCode":null,"errorMessage":"failed to delete %s: %w","messagePattern":"failed to delete (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"channels/pkg/channels/prune.go","lineNumber":144,"sourceCode":"\t\tnamespace := actualObject.GetNamespace()\n\t\tkey := namespace + \"/\" + name\n\t\tif _, found := keepMap[key]; found {\n\t\t\t// Object is in manifest, don't delete\n\t\t\tcontinue\n\t\t}\n\n\t\tklog.Infof(\"pruning %s %s\", gvr, key)\n\n\t\tvar resource dynamic.ResourceInterface\n\t\tif namespace != \"\" {\n\t\t\tresource = p.Client.Resource(gvr).Namespace(namespace)\n\t\t} else {\n\t\t\tresource = p.Client.Resource(gvr)\n\t\t}\n\n\t\tvar opts v1.DeleteOptions\n\t\tif err := resource.Delete(ctx, name, opts); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to delete %s: %w\", key, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":126,"sourceCodeEnd":150,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/channels/pkg/channels/prune.go#L126-L150","documentation":"pruneObjects deletes each live object whose namespace/name key is not in the manifest keep-set. A failed Delete call is wrapped as `failed to delete <namespace/name>`, aborting the prune of that kind at the first failure.","triggerScenarios":"The dynamic client Delete of a stale object fails: RBAC denies delete, the object has a finalizer blocking deletion (deletion timestamp set but object persists), the object was concurrently modified/removed (409/404), or admission webhooks reject deletion.","commonSituations":"Objects stuck in Terminating due to orphaned finalizers; missing delete permission for the pruned kind; webhook (e.g. validating admission webhook) unavailable so DELETE is rejected; race with another controller recreating/editing the object.","solutions":["Read the wrapped inner error: 403 → add delete RBAC; 409 → retry; webhook error → fix or remove the blocking webhook","Clear stuck finalizers on the object (`kubectl patch <obj> -p '{\"metadata\":{\"finalizers\":[]}}' --type=merge`) then re-run prune","Delete the object manually with kubectl to confirm the cause, then re-run the channel update","Ensure no other controller is fighting over the object during prune"],"exampleFix":"// before (object stuck with finalizer)\nmetadata:\n  finalizers:\n  - example.com/blocker\n// after\nkubectl patch myresource -n ns name --type=merge -p '{\"metadata\":{\"finalizers\":null}}'\n# then re-run kops update","handlingStrategy":"try-catch","validationCode":"// pre-check delete permission for the pruned kind\nok, _ := authClient.SelfSubjectAccessReviews().Create(ctx, &authorizationv1.SelfSubjectAccessReview{\n    Spec: authorizationv1.SelfSubjectAccessReviewSpec{\n        ResourceAttributes: &authorizationv1.ResourceAttributes{\n            Verb: \"delete\", Group: gk.Group, Resource: resourceName}},\n})\nif !ok.Status.Allowed {\n    return fmt.Errorf(\"RBAC denies delete on %s\", resourceName)\n}","typeGuard":null,"tryCatchPattern":"if err := pruner.Prune(ctx, manifest, spec); err != nil {\n    var delErr error\n    if strings.Contains(err.Error(), \"failed to delete \") {\n        delErr = errors.Unwrap(err)\n        if apierrors.IsConflict(delErr) {\n            return retryPrune(err) // 409: transient, safe to retry\n        }\n        return fmt.Errorf(\"object stuck (finalizer/webhook?): %w\", delErr)\n    }\n    return err\n}","preventionTips":["Monitor for objects stuck with foreign finalizers before running prune","Grant delete permission on all pruned kinds to the kops identity","Ensure validating/mutating webhooks are highly available so DELETE is not rejected","Run prune during a window with no concurrent controllers modifying the same objects"],"tags":["delete","prune","finalizer","kubernetes"],"backgroundTag":"delete-object-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}