Delete resources safely with --prune

apply --prune deletes ACLs and Confluent role bindings that your manifests no longer list, within the managed scope: ACLs per principal and resource pattern, role bindings per principal, role and scope. The CLI never deletes a topic, a user or a quota you remove from Git.

Steps

1. Narrow the grant in the manifest

This topic grants User:svc-prune the operations Write and Describe. Save it as manifests/topic.yaml and apply it:

apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaTopic
metadata:
  name: prune-demo
spec:
  clusterRef:
    name: shared
  topicName: prune.demo
  partitions: 1
  access:
    producers:
      - principal: "User:svc-prune"
        operations:
          - Write
          - Describe

Now remove Describe from the producer entry:

spec:
  access:
    producers:
      - principal: "User:svc-prune"
        operations:
          - Write

The entry still declares User:svc-prune on prune.demo, so the pair stays in scope, and the live Describe ACL becomes a prune candidate.

2. Apply without pruning first

monedula-gitops apply -f ./manifests --cluster-config-file ./cluster.yaml

The result lists the candidate as PruneDisabled DeleteAcl: visible, but not deleted, and apply exits 0. diff marks the same operation as a prune candidate, and verify counts it as drift until it is gone.

3. Prune

With the CLI, apply again with --prune:

monedula-gitops apply -f ./manifests --cluster-config-file ./cluster.yaml --prune

The result lists Succeeded DeleteAcl, and the Describe ACL is gone. With the operator, set spec.prune: true on the KafkaTopic, KafkaAccessPolicy or KafkaRoleBinding instead; a candidate is deleted only when every resource whose scope covers it has opted in.

--prune approves nothing else, and --allow-destructive never enables pruning.

4. Know what pruning leaves in place

Pruning never reaches outside the managed scope. These deletions in Git leave Kafka unchanged, even with --prune:

• A whole access entry, policy rule or role binding. When you delete an entry and no other manifest declares that principal on that resource, the pair leaves the managed scope. Its ACLs stay in Kafka, and monedula-gitops no longer reports them. The same holds for a KafkaRoleBinding whose principal, role and scope no manifest declares any more. Delete such grants outside monedula-gitops, for example with Kafka’s kafka-acls tool; with the operator, delete the KafkaAccessPolicy or KafkaRoleBinding resource under its deletion policy instead.
• Topics, SCRAM users and quotas. The CLI never deletes a topic, a SCRAM credential or a quota entity that you remove from your manifests. With the operator, deleting the resource removes them: a topic needs deletionPolicy: Delete and the allow-delete annotation, as Delete topics from Kubernetes shows.
• Schema subjects. Removing spec.schema from a topic leaves its subjects in Schema Registry.

Check it worked

monedula-gitops verify -f ./manifests --cluster-config-file ./cluster.yaml

verify exits 0: the live ACLs for User:svc-prune on prune.demo match the manifest, with Write only, and no prune candidate is left.

Related

• The apply command reference lists every flag.
• Grant producers and consumers access and Manage Confluent RBAC role bindings show pruning for each kind of grant.
• Runnable version: scenarios/12-opt-in-prune