Persistent Volume reclaims in k8s — what actually works at scale?

We run a multi-tenant k8s cluster (1.28) with ~200 PVCs across EBS and NFS. After deleting stateful workloads, we see PersistentVolumes stuck in Released state because the reclaimPolicy is Retain and the PV still carries the old claimRef. Automating the cleanup (patching claimRef to null) works but feels fragile — if a new pod claims the PV during the window, data can leak between tenants. How does your team handle PV lifecycle after namespace teardown? Are you using a controller (like the external-provisioner sidecar), a cron-based reaper script, or just accepting manual intervention? What's worked reliably in production with mixed storage classes?