fix: strip finalizers before controller deletion to prevent stuck resources

Move finalizer stripping before controller/manager deletion in CLI
uninstall, and add a Helm pre-delete hook Job that strips finalizers
from all Sympozium CRDs before the release is torn down. This prevents
skillpacks, personapacks, and other resources from hanging in
Terminating state during uninstall.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: AlexsJones

charts/sympozium/templates/pre-delete-finalizers.yaml

@@ -0,0 +1,107 @@
+{{- if .Values.rbac.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sympozium-pre-delete
+  namespace: {{ include "sympozium.namespace" . }}
+  labels:
+    {{- include "sympozium.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "sympozium.fullname" . }}-pre-delete
+  labels:
+    {{- include "sympozium.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+rules:
+  - apiGroups: ["sympozium.ai"]
+    resources:
+      - skillpacks
+      - personapacks
+      - sympoziuminstances
+      - agentruns
+      - sympoziumpolicies
+      - sympoziumschedules
+      - sympoziumconfigs
+    verbs: ["get", "list", "patch"]
+  - apiGroups: ["sympozium.ai"]
+    resources:
+      - skillpacks/finalizers
+      - personapacks/finalizers
+      - sympoziuminstances/finalizers
+      - agentruns/finalizers
+      - sympoziumpolicies/finalizers
+      - sympoziumschedules/finalizers
+      - sympoziumconfigs/finalizers
+    verbs: ["update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "sympozium.fullname" . }}-pre-delete
+  labels:
+    {{- include "sympozium.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "-10"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "sympozium.fullname" . }}-pre-delete
+subjects:
+  - kind: ServiceAccount
+    name: sympozium-pre-delete
+    namespace: {{ include "sympozium.namespace" . }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: sympozium-pre-delete-finalizers
+  namespace: {{ include "sympozium.namespace" . }}
+  labels:
+    {{- include "sympozium.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 60
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sympozium-pre-delete
+    spec:
+      serviceAccountName: sympozium-pre-delete
+      restartPolicy: Never
+      containers:
+        - name: strip-finalizers
+          image: bitnami/kubectl:latest
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+              RESOURCES="skillpacks.sympozium.ai personapacks.sympozium.ai sympoziuminstances.sympozium.ai agentruns.sympozium.ai sympoziumpolicies.sympozium.ai sympoziumschedules.sympozium.ai sympoziumconfigs.sympozium.ai"
+              for res in $RESOURCES; do
+                echo "Stripping finalizers from $res..."
+                items=$(kubectl get "$res" --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null || true)
+                for item in $items; do
+                  [ -z "$item" ] && continue
+                  ns="${item%%/*}"
+                  name="${item#*/}"
+                  echo "  Patching $res $ns/$name"
+                  kubectl patch "$res" "$name" -n "$ns" --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null || true
+                done
+              done
+              echo "Done stripping finalizers."
+{{- end }}

cmd/sympozium/main.go

@@ -1246,10 +1246,17 @@ func runInstall(ver, imageTag string) error {
 func runUninstall() error {
 	fmt.Println("  Removing Sympozium...")
 
-	// Delete default SkillPacks from sympozium-system first (before CRDs go away).
-	fmt.Println("  Removing default SkillPacks...")
-	_ = kubectl("delete", "skillpacks.sympozium.ai", "--ignore-not-found",
-		"-n", "sympozium-system", "-l", "sympozium.ai/builtin=true")
+	// Strip finalizers from all Sympozium CRD instances BEFORE deleting the
+	// controller, so resources don't get stuck in Terminating state.
+	fmt.Println("  Removing finalizers from Sympozium resources...")
+	resources := []string{"agentruns", "sympoziuminstances", "sympoziumpolicies", "skillpacks", "sympoziumschedules", "personapacks"}
+	for _, res := range resources {
+		stripFinalizers(res)
+	}
+	fmt.Println("  Deleting Sympozium custom resources...")
+	for _, res := range resources {
+		_ = kubectl("delete", res+".sympozium.ai", "--all", "--all-namespaces", "--ignore-not-found", "--timeout=60s")
+	}
 
 	// Delete in reverse order.
 	manifests := []string{
@@ -1267,18 +1274,6 @@ func runUninstall() error {
 		_ = kubectl("delete", "--ignore-not-found", "-f", m)
 	}
 
-	// Strip finalizers from all Sympozium CRD instances so CRD deletion doesn't
-	// hang waiting for the (now-deleted) controller to reconcile them.
-	fmt.Println("  Removing finalizers from Sympozium resources...")
-	resources := []string{"agentruns", "sympoziuminstances", "sympoziumpolicies", "skillpacks", "sympoziumschedules", "personapacks"}
-	for _, res := range resources {
-		stripFinalizers(res)
-	}
-	fmt.Println("  Deleting Sympozium custom resources...")
-	for _, res := range resources {
-		_ = kubectl("delete", res+".sympozium.ai", "--all", "--all-namespaces", "--ignore-not-found", "--timeout=60s")
-	}
-
 	// CRDs last.
 	crdBase := "https://raw.githubusercontent.com/" + ghRepo + "/main/config/crd/bases/"
 	crds := []string{