---
title: "Delete resources safely with --prune"
description: "Delete ACLs and role bindings your manifests no longer list with apply --prune, and see what pruning leaves in place."
url: https://monedula.dev/flock/docs/gitops/how-to/delete-resources-safely/
---
`apply --prune` deletes ACLs and Confluent role bindings that your manifests no longer list, within the [managed scope](/flock/docs/gitops/concepts/safety-gates/): ACLs per principal and resource pattern, role bindings per principal, role and scope. The CLI never deletes a topic, a user or a quota you remove from Git.

## Steps

### 1. Narrow the grant in the manifest

This topic grants `User:svc-prune` the operations `Write` and `Describe`. Save it as `manifests/topic.yaml` and apply it:

```yaml
apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaTopic
metadata:
  name: prune-demo
spec:
  clusterRef:
    name: shared
  topicName: prune.demo
  partitions: 1
  access:
    producers:
      - principal: "User:svc-prune"
        operations:
          - Write
          - Describe
```

Now remove `Describe` from the producer entry:

```yaml
spec:
  access:
    producers:
      - principal: "User:svc-prune"
        operations:
          - Write
```

The entry still declares `User:svc-prune` on `prune.demo`, so the pair stays in scope, and the live `Describe` ACL becomes a prune candidate.

### 2. Apply without pruning first

```bash
monedula-gitops apply -f ./manifests --cluster-config-file ./cluster.yaml
```

The result lists the candidate as `PruneDisabled DeleteAcl`: visible, but not deleted, and `apply` exits 0. `diff` marks the same operation as a prune candidate, and `verify` counts it as drift until it is gone.

### 3. Prune

<Callout type="warning">
Pruning deletes every live ACL in a declared principal and resource pair that your manifests do not list, including grants someone made by hand before the manifest existed. For role bindings, it deletes every live binding that shares its principal, role and scope with a declared binding but is not listed itself, on any resource.
</Callout>

With the CLI, apply again with `--prune`:

```bash
monedula-gitops apply -f ./manifests --cluster-config-file ./cluster.yaml --prune
```

The result lists `Succeeded DeleteAcl`, and the `Describe` ACL is gone. With the operator, set `spec.prune: true` on the `KafkaTopic`, `KafkaAccessPolicy` or `KafkaRoleBinding` instead; a candidate is deleted only when every resource whose scope covers it has opted in.

`--prune` approves nothing else, and `--allow-destructive` never enables pruning.

### 4. Know what pruning leaves in place

Pruning never reaches outside the managed scope. These deletions in Git leave Kafka unchanged, even with `--prune`:

- A whole access entry, policy rule or role binding. When you delete an entry and no other manifest declares that principal on that resource, the pair leaves the managed scope. Its ACLs stay in Kafka, and monedula-gitops no longer reports them. The same holds for a `KafkaRoleBinding` whose principal, role and scope no manifest declares any more. Delete such grants outside monedula-gitops, for example with Kafka's `kafka-acls` tool; with the operator, delete the `KafkaAccessPolicy` or `KafkaRoleBinding` resource under its deletion policy instead.
- Topics, SCRAM users and quotas. The CLI never deletes a topic, a SCRAM credential or a quota entity that you remove from your manifests. With the operator, deleting the resource removes them: a topic needs `deletionPolicy: Delete` and the `allow-delete` annotation, as [Delete topics from Kubernetes](/flock/docs/gitops/how-to/delete-topics-from-kubernetes/) shows.
- Schema subjects. Removing `spec.schema` from a topic leaves its subjects in Schema Registry.

## Check it worked

```bash
monedula-gitops verify -f ./manifests --cluster-config-file ./cluster.yaml
```

`verify` exits 0: the live ACLs for `User:svc-prune` on `prune.demo` match the manifest, with `Write` only, and no prune candidate is left.

## Related

- The [apply command reference](/flock/docs/gitops/reference/cli/apply/) lists every flag.
- [Grant producers and consumers access](/flock/docs/gitops/how-to/grant-topic-access/) and [Manage Confluent RBAC role bindings](/flock/docs/gitops/how-to/manage-confluent-rbac/) show pruning for each kind of grant.
- Runnable version: [scenarios/12-opt-in-prune](https://github.com/monedula-dev/monedula-gitops/tree/main/scenarios/12-opt-in-prune)