<p>I have an instance of CRD <code>A</code> and an instance of CRD <code>B</code>. <code>B</code> has an owner reference to <code>A</code> with <code>BlockOwnerDeletion</code> set to <code>true</code>. Both instances have a finalizer.</p>
<p>When I delete <code>A</code> a <code>DeletionTimestamp</code> is set but no <code>foregroundDeletion</code> finalizer is present. Even when I explicitly add the <code>foregroundDeletion</code> finalizer to <code>A</code> before deleting. This all happens before <code>B</code> has been deleted.</p>
<p>The documentation says:</p>
<blockquote>
<p>In foreground cascading deletion, the root object first enters a “deletion in progress” state. In the “deletion in progress” state, the following things are true:</p>
<ul>
<li>The object is still visible via the REST API</li>
<li>The object’s deletionTimestamp is set</li>
<li>The object’s metadata.finalizers contains the value “foregroundDeletion”.</li>
</ul>
<p>Once the “deletion in progress” state is set, the garbage collector deletes the object’s dependents. Once the garbage collector has deleted all “blocking” dependents (objects with ownerReference.blockOwnerDeletion=true), it deletes the owner object.</p>
<p>Note that in the “foregroundDeletion”, only dependents with ownerReference.blockOwnerDeletion=true block the deletion of the owner object. Kubernetes version 1.7 added an admission controller that controls user access to set blockOwnerDeletion to true based on delete permissions on the owner object, so that unauthorized dependents cannot delay deletion of an owner object.</p>
<p>If an object’s ownerReferences field is set by a controller (such as Deployment or ReplicaSet), blockOwnerDeletion is set automatically and you do not need to manually modify this field</p>
</blockquote>
<p>This, to me, suggests that if <code>B</code> has an owner reference to <code>A</code> with <code>BlockOwnerDeletion==true</code> the finalizer <code>foregroundDeletion</code> should be added to <code>A</code>.</p>
<p>Am I completely misunderstanding this?</p>

granra
<p><strong>According to:</strong></p>

<blockquote>
  <p>This, to me, suggests that if <code>B</code> has an owner reference to <code>A</code> with <code>BlockOwnerDeletion==true</code> the finalizer <code>foregroundDeletion</code> should be added to <code>A</code>.</p>
</blockquote>

<p>You are understanding it correctly according to documentation. </p>

<p>If you think that observed behavior is different from what the official documentation says it should be reported as an issue on github page. </p>

<p>Link: <a href="https://github.com/kubernetes/kubernetes/issues" rel="nofollow noreferrer">Github.com: Kubernetes issues</a></p>

<hr>

<p>I've tried to reproduce some parts of it on basic examples and here's what I found: </p>

<p><strong>Taking:</strong></p>

<ul>
<li>basic pod with <code>NGINX</code> image as a <strong>parent</strong></li>
<li>basic pod with <code>NGINX</code> image as a <strong>child</strong> </li>
</ul>

<p><strong>Steps:</strong> </p>

<ul>
<li>Create a <strong>parent</strong> </li>
<li>Copy <code>uid</code> of parent to <code>ownerReference</code> of <strong>child</strong> and create it</li>
<li><p>Check the behavior:</p>

<ul>
<li><code>kubectl delete</code></li>
<li>default <code>curl</code> </li>
<li><code>curl</code> with <code>foregroundDeletion</code> option</li>
</ul></li>
</ul>

<h2>Create a <strong>parent</strong></h2>

<p>Here is example <code>YAML</code> definition of basic pod: </p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: nginx-owner
  namespace: default
spec:
  containers:
  - image: nginx
    imagePullPolicy: IfNotPresent
    name: nginx-owner
</code></pre>

<h2>Copy <code>uid</code> of parent to <code>ownerReference</code> of <strong>child</strong> and create it</h2>

<p>Get the <code>uid</code> of <strong>parent</strong> pod by running command: </p>

<p><code>$ kubectl get pods nginx-owner -o yaml | grep uid | cut -d ":" -f 2</code></p>

<p>Paste it inside of <code>YAML</code> definition of <strong>child</strong> </p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: nginx-child
  namespace: default
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    kind: Pod
    name: nginx-owner
    uid: HERE!
spec:
  containers:
  - image: nginx
    imagePullPolicy: IfNotPresent
    name: nginx-child
</code></pre>

<p>Save and run it. </p>

<h2>Check the behavior</h2>

<p>Check if both pods are running and if <strong>child</strong> has <code>ownerReference</code> to <strong>parent</strong> </p>

<h3><code>kubectl delete</code></h3>

<p>Deleting <strong>parent</strong> pod with <code>$ kubectl delete pod nginx-owner</code>  deletes:</p>

<ul>
<li><code>nginx-owner</code> <strong>(parent)</strong> </li>
<li><code>nginx-child</code> <strong>(child)</strong> 
without any issues. </li>
</ul>

<p>Annotations in <strong>parent</strong> pod right after deleting it: </p>

<pre><code>  deletionGracePeriodSeconds: 30
  deletionTimestamp: "2020-02-27T14:17:48Z"
</code></pre>

<h3>default <code>curl</code></h3>

<p>Assuming access to Kubernetes API on <code>localhost</code> and port <code>8080</code> with deletion command: 
<code>$ curl -X DELETE localhost:8080/api/v1/default/pod/nginx-owner</code></p>

<p>Deleting <strong>parent</strong> pod by API access with default options: </p>

<ul>
<li>deletes <strong>parent</strong> first </li>
<li>deletes <strong>child</strong> second </li>
</ul>

<p>The same annotations are present in <strong>parent</strong> as in <code>kubectl delete</code></p>

<pre><code>  deletionGracePeriodSeconds: 30
  deletionTimestamp: "2020-02-27T15:33:18Z"
</code></pre>

<h3><code>curl</code> with <code>foregroundDeletion</code> option</h3>

<p>Assuming access to Kubernetes API on <code>localhost</code> and port <code>8080</code> with modified deletion command to include <code>foregroundDeletion</code> option: </p>

<pre class="lang-sh prettyprint-override"><code>$ curl -X DELETE localhost:8080/api/v1/namespaces/default/pods/nginx-owner -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Foreground"}' -H "Content-Type: application/json"
</code></pre>

<p><code>curl</code> based on <a href="https://kubernetes.io/docs/concepts/workloads/controllers/garbage-collection/" rel="nofollow noreferrer">Kubernetes.io: Garbage collection</a></p>

<p>Will: </p>

<ul>
<li>force <strong>parent</strong> into <code>Terminating</code> state </li>
<li>do not delete <strong>child</strong> (<code>Running</code> state) </li>
<li>stuck <strong>parent</strong> pod in <code>Terminating</code> state </li>
</ul>

<p>Annotations for <strong>parent</strong> pod: </p>

<pre><code>  deletionGracePeriodSeconds: 30
  deletionTimestamp: "2020-02-27T15:44:52Z"
  finalizers:
  - foregroundDeletion
</code></pre>

<p>It added <code>finalizers</code> argument with <code>foregroundDeletion</code> but pod does not get deleted for a reason unknown to me. </p>

<p><strong>EDIT:</strong></p>

<p>I found the error why <code>foreGroundDeletion</code> wasn't working. There was an issue with:</p>

<pre><code>  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    kind: Pod
    name: nginx-owner
    uid: HERE!
</code></pre>

<p>It should be:</p>

<pre><code>  ownerReferences:
  - apiVersion: v1
    blockOwnerDeletion: true
    kind: Pod
    name: nginx-owner
    uid: HERE!
</code></pre>
