When Image Registry management state is set to Removed the IR gets removed, however the SAs created persist and contain a finalizer which prohibits their removal. As a result namespaces cannot be cleaned up when the namespace was created before the IR was removed.    

All current releases, requesting fix in 4.16.z and newer    

100%    

    1. Install a cluster w/ ImageRegistry on Azure
    2. Create some workload namespaces, ensure that IR pull secrets are created
    3. Set Image Registry ManagementState to Removed
    

    Pull secrets persist and have a finalizer inhibiting their removal

    Pull secrets at least have their finalizer from IR removed allowing them to be deleted, if it makes sense to remove them on IR transitioning to removed state that may make sense too but need to make sure that there's no risk of the pull secrets being used for other purposes. If that's a risk then it seems like we could leave them in place but ensure the finalizer is removed.