<p>I deleted a namespace that has a service that is exposed with nginx-ingress with a Let's Encrypt certificate controlled by cert-manager. Deletion of the namespace is hanging with status Terminating.</p>

<p>It is likely a problem with the internal API as explained <a href="https://github.com/kubernetes/kubernetes/issues/60807#issuecomment-429754733" rel="nofollow noreferrer">here</a>. When I run:</p>

<pre><code>kubectl api-resources
</code></pre>

<p>it returns that the certmanager webhook API isn't reachable:</p>

<blockquote>
  <p>error: unable to retrieve the complete list of server APIs: webhook.certmanager.k8s.io/v1beta1: the server is currently unable to handle the request</p>
</blockquote>

<p>When I run <code>kubectl get apiservices v1beta1.webhook.certmanager.k8s.io -o yaml</code>, for checking its status conditions:</p>

<pre><code>...
service:
    name: cert-manager-webhook
    namespace: nginx-ingress
    port: 443
version: v1beta1
versionPriority: 15
status:
conditions:
- lastTransitionTime: "2020-01-21T15:02:23Z"
    message: 'failing or missing response from https://10.24.32.6:10250/apis/webhook.certmanager.k8s.io/v1beta1:
    bad status from https://10.24.32.6:10250/apis/webhook.certmanager.k8s.io/v1beta1:
    404'
    reason: FailedDiscoveryCheck
    status: "False"
    type: Available
</code></pre>

<p>All nginx-ingress and cert-manager pods are in good health. I have done an update on certmanager in the time that I have deployed and deleted this namespace, which might be an explanation of the issue. How can this problem be solved?</p>

<p>versions:</p>

<ul>
<li>Kubernetes: v1.15.4-gke.22</li>
<li><a href="https://cert-manager.io/docs/" rel="nofollow noreferrer">cert-manager</a> v0.12.0</li>
<li><a href="https://github.com/helm/charts/tree/master/stable/nginx-ingress" rel="nofollow noreferrer">nginx-ingress</a>:  1.29.3</li>
</ul>

Joost Döbken
<p>A simle solution to solve the issue is presented <a href="https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.1/troubleshoot/ns_terminating.html" rel="nofollow noreferrer">here</a>. But this does not describe how such a problem arises or can be prevented.</p>

<p>Create a temporary JSON file that describes the terminating namespace:</p>

<pre><code>kubectl get namespace &lt;terminating-namespace&gt; -o json &gt;tmp.json
</code></pre>

<p>Edit the file <code>tmp.json</code> by removing the <code>kubernetes</code> value from the <code>finalizers</code> field and save the file.</p>

<p>Set a temporary proxy IP and port:</p>

<pre><code>kubectl proxy
</code></pre>

<p>From a new terminal window, make an API call with your temporary proxy IP and port:</p>

<pre><code> curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json http://127.0.0.1:8001/api/v1/namespaces/&lt;terminating-namespace&gt;/finalize
</code></pre>
