add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential

Author: tkashem

content/en/docs/reference/command-line-tools-reference/feature-gates/allow-unsafe-malformed-object-deletion.md

@@ -0,0 +1,16 @@
+---
+title: AllowUnsafeMalformedObjectDeletion
+content_type: feature_gate
+_build:
+  list: never
+  render: false
+
+stages:
+  - stage: alpha
+    defaultValue: false
+    fromVersion: "1.32"
+---
+Enables the cluster operator to identify corrupt resource(s) using the **list**
+operation, and introduces an option `ignoreStoreReadErrorWithClusterBreakingPotential`
+that the operator can set to perform unsafe and force **delete** operation of
+such corrupt resource(s) using the Kubernetes API.

content/en/docs/reference/using-api/api-concepts.md

@@ -847,6 +847,35 @@ not vulnerable to ordering changes in the list.
 
 Once the last finalizer is removed, the resource is actually removed from etcd.
 
+### Force deletion
+
+{{< feature-state feature_gate_name="AllowUnsafeMalformedObjectDeletion" >}}
+
+{{< caution >}}
+This may break the workload associated with the resource being force deleted, if it
+relies on the normal deletion flow, so cluster breaking consequences may apply.
+{{< /caution >}}
+
+By enabling the delete option `ignoreStoreReadErrorWithClusterBreakingPotential`, the
+user can perform an unsafe, and force **delete** operation of an undecryptable/corrupt
+resource. This option is behind a new ALPHA feature gate, and it is disabled by
+default. In order to use this option, the cluster operator must enable the feature by
+setting the command line option `--feature-gates=AllowUnsafeMalformedObjectDeletion=true`.
+
+{{< note >}}
+The user performing the force **delete** operation must have the
+`unsafe-delete-ignore-read-errors` permission on the resource.
+{{< /note >}}
+
+A resource is considered corrupt if it can not be successfully retrieved from the
+storage due to a) transformation error e.g. decryption failure, or b) the object
+failed to decode. Normal deletion flow is attempted first, and if it fails with
+a `corrupt resource` error then it triggers the unsafe, and force delete. A force
+**delete** operation ignores finalizer constraints, and skips precondition checks.
+
+The default value for this option is `false`, this maintains backward compatibility.
+When this field is set to `true`, the fields `dryRun`, `gracePeriodSeconds`,
+`orphanDependents`, `preconditions`, and `propagationPolicy` must be left unset.
 
 ## Single resource API