Finalizers for clean external cleanup
pre-deletion hooks.
a finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
What's really being asked
Whether you understand Kubernetes deletion mechanics and how to hook in cleanup of resources that live outside the cluster.
The full answer
A finalizer is a string entry in an object's metadata.finalizers list that tells the API server not to physically delete the object until that entry is removed. This converts deletion into a two-phase process. When a user deletes the custom resource, the API server does not remove it; instead it stamps metadata.deletionTimestamp and leaves the object present. The operator's reconcile loop detects the non-nil deletionTimestamp, knows it is in teardown, and performs the external cleanup, for example calling the cloud API to delete the managed database. Only after cleanup succeeds does the operator remove its finalizer from the list; the API server then sees an empty finalizer list on a terminating object and completes deletion. Implementation: on first reconcile of a live object, add your finalizer if absent. On reconcile of a terminating object, run cleanup idempotently, and if it fails, requeue and retry so you never drop the finalizer prematurely. This guarantees no orphaned external resources.
The mistakes people make
Doing cleanup in normal reconcile without a finalizer, so deletion races ahead and orphans the database; removing the finalizer before cleanup succeeds; or assuming Kubernetes cleans external resources automatically.
What usually comes next
What is a stuck finalizer and how do you recover? Why must cleanup be idempotent? How does deletionTimestamp interact with reconcile? What about ownerReferences cascade?
A concrete example
Your operator manages an RDS instance via a Database custom resource. On create, reconcile adds the finalizer db.example.com/cleanup. When the user runs kubectl delete, the object gets a deletionTimestamp but stays. Reconcile sees this, calls the AWS API to delete the RDS instance, confirms success, then removes the finalizer. The API server now purges the Database object, leaving no orphaned cloud database.
Interview question
After a user deletes a custom resource that has a finalizer, what does the API server do?
- a.Immediately purges the object and notifies the operator afterward
- b.Deletes the object but recreates it on the next reconcile
- c.Rejects the deletion request entirely until the finalizer is removed by an admin
- d.Sets a deletionTimestamp and keeps the object until the finalizer is removedCorrect
Why? this is the answer
A finalizer makes deletion two-phase: the object is marked with a deletionTimestamp and retained so the operator can clean up external resources, then it is purged once the finalizer is removed. The deletion is not rejected, just deferred.
Just read this? Test yourself on what you have been reading.
Read the original → kubernetes.io
- #kubernetes
- #finalizers
- #operators
- #deletion
- #cleanup
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles