DevOps / ArgoCD interview questions
How does ArgoCD handle resource pruning and what risks does enabling it carry?
Resource pruning in ArgoCD refers to the automatic deletion of Kubernetes resources that exist in the cluster but are no longer present in the Git repository. When you sync an application with pruning enabled, ArgoCD compares the live cluster state against the desired Git state and removes any resources that have been deleted from Git.
By default, pruning is disabled. You enable it per sync operation via the CLI (argocd app sync <app> --prune) or by setting syncPolicy.automated.prune: true in the Application manifest for fully automated flows.
| Aspect | Detail |
|---|---|
| Accidental deletion | A mistaken removal from Git triggers permanent cluster deletion; rollback requires re-adding the resource and syncing. |
| Out-of-band resources | Resources created manually or by other controllers outside Git are pruned if ArgoCD tracks the namespace. |
| Cascading deletes | Pruning a parent resource (e.g., a Namespace) can cascade-delete child resources even if the children are still needed. |
| Finalizer loops | Resources with deletion finalizers may block sync and leave the application in a degraded state. |
To mitigate risk, use the argocd.argoproj.io/managed-by label carefully and consider combining pruning with Sync Windows to limit when automated pruning can fire. The PruneLast=true sync option instructs ArgoCD to delete resources only after all other sync steps complete successfully, reducing mid-sync inconsistency.
syncPolicy: automated: prune: true selfHeal: true syncOptions: - PruneLast=true
More Related questions...