wtf is finalizer-doctor?

When you delete a namespace or other resource in Kubernetes and it gets stuck in a "Terminating" state for a long time, the usual cause is a finalizer. A finalizer is a marker that tells Kubernetes to hold off on actually deleting the resource until some controller does cleanup work. If that controller has crashed or been uninstalled, nothing ever finishes the cleanup, and the resource hangs in Terminating indefinitely. The common workarounds for this problem, like manually editing the finalizer out, forcing deletion with special flags, or blindly clearing the finalizers list, all carry real risk: they can orphan actual infrastructure such as load balancers, cloud volumes, or operator-managed databases that the finalizer was protecting. The problem is that these approaches make no distinction between a controller that is completely gone versus one that is just slow or temporarily unavailable. Finalizer-doctor is a kubectl plugin that diagnoses this situation carefully. Before touching anything, it inspects the stuck resource, identifies which specific finalizer is blocking deletion, and checks whether the owning controller is actually gone rather than just slow. It only marks a finalizer as safe to clear when there is hard evidence the controller is gone. By default it runs in dry-run mode and makes no changes at all, printing a summary of what it found and what it would do. To apply changes, you pass a confirmation token that is tied to the exact state it showed you, preventing changes from being applied to a different state than the one you reviewed. Installation is available via Homebrew, krew (the kubectl plugin manager), or standalone binaries. The tool can also scan an entire cluster for all stuck resources in read-only mode, which is useful for CI checks. It is licensed under Apache 2.0.