Flux Kustomization "pruning failed" in CI

By Kaveh Alemi·Latchkey

With spec.prune: true, kustomize-controller deletes resources that were removed from the source. A delete failed, usually because a finalizer is holding the object or the service account lacks delete permission, so pruning did not complete.

What this error means

A Kustomization reports "False" with "pruning failed" naming a resource it could not delete, while the rest of the apply succeeds.

pruning failed: unable to delete PersistentVolumeClaim/apps/data: object is being deleted: PersistentVolumeClaim "data" is stuck

Common causes

A finalizer blocks deletion

The resource has a finalizer that has not completed (a stuck PVC or a namespace with lingering resources), so the delete stays pending and pruning fails.

The service account cannot delete the resource

The reconciler's RBAC lacks delete permission on that kind, so pruning is forbidden.

How to fix it

Clear the finalizer or grant delete RBAC

1. Describe the stuck resource to see the finalizer or the forbidden error.
2. Resolve the finalizer condition, or grant the reconciler delete permission on that kind.
3. Reconcile the Kustomization so pruning completes.

kubectl -n apps describe pvc data
flux reconcile kustomization apps

Verify prune is intended

Confirm spec.prune should be on for this Kustomization before forcing deletions.

kubectl -n flux-system get kustomization apps -o jsonpath='{.spec.prune}'

How to prevent it

• Grant the reconciler delete permission on the kinds it manages.
• Resolve finalizer-holding resources before removing them from the source.
• Keep prune enabled deliberately so removed manifests are cleaned up.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation