So it turns out , the root cause was that Custom resources with finalizers can "deadlock". The CustomResource "functions.kubeless.io" had a

Finalizers:
    customresourcecleanup.apiextensions.k8s.io

and this is can leave it in a bad state when deleting.

https://github.com/kubernetes/kubernetes/issues/60538

# kubectl --kubeconfig /tmp/config  get customresourcedefinitions.apiextensions.k8s.io  | grep cattle

for i in $(kubectl --kubeconfig /tmp/config  get customresourcedefinitions.apiextensions.k8s.io 2>/dev/null | grep cattle | awk '{print $1}')
do
    echo "# ------------ $i "
    kubectl --kubeconfig /tmp/config  patch crd/${i} -p '{"metadata":{"finalizers":[]}}' --type=merge
    kubectl --kubeconfig /tmp/config  delete customresourcedefinitions.apiextensions.k8s.io ${i}
done