Skip to content

Conversation

@RishabhKodes
Copy link
Collaborator

The script cleans up OpenShift projects stuck in the Terminating stage by removing resource and project finalizers, then initiating deletion.

  • Detects dangling resources/finalizers from project status
  • Patches each remaining resource to remove /metadata/finalizers
  • Removes project-level finalizers
  • Triggers non-blocking project deletion

Signed-off-by: RishabhKodes <rishabhbhandari6@gmail.com>
@RishabhKodes
Copy link
Collaborator Author

Note: This is the first version of the script and has been tested only with ELM (not EIC); do not merge it yet.

Signed-off-by: RishabhKodes <rishabhbhandari6@gmail.com>
Signed-off-by: RishabhKodes <rishabhbhandari6@gmail.com>
Signed-off-by: RishabhKodes <rishabhbhandari6@gmail.com>
@RishabhKodes RishabhKodes requested review from kksat and mjiao October 16, 2025 13:25
fi

# As a safety net, sweep all namespaced resource types: remove finalizers and attempt force deletion
echo "Sweeping all namespaced resource types in '$PROJECT' to remove finalizers and delete..."
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this the same code as in the previous paragraph just for namespaced resources? Can we combine the two paragraphs and reuse the code?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not exactly the same however the idea behind both the sections of code is the same. I would not combine the two because their functionalities are different and we might need to modify each of them later depending on the types of resources that we might come across that need to be deleted later (for an edge case).

oc patch namespace "$PROJECT" --type json -p '[{"op": "remove", "path": "/spec/finalizers"}]' || true

echo "Deleting project '$PROJECT'..."
oc delete project "$PROJECT" --wait=false || true
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to be very catious about || true in the code. From my point of view we expect these commands not fail. So why do we need || true - looks like a path to not to remove some resources and skip errors. What do you think?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, the || true ensures that the script continues even if a command fails; these commands don't usually fail because it's just patching, but even if they do, it doesn't hamper the execution of the script. This is to ensure maximum resource removal even if some parts fail.

echo "Deleting project '$PROJECT'..."
oc delete project "$PROJECT" --wait=false || true

echo "Cleanup initiated for project: $PROJECT"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we add maybe check that there are not dangling resources at the end? and fail if there are still some resources.

…e integration

Signed-off-by: RishabhKodes <rishabhbhandari6@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants