Unused Is Not a Kubernetes Field: Platform Hygiene Is Not Cleanup

Cloud-native teams eventually run into the same problem: clusters accumulate resources that nobody fully understands anymore. Old namespaces, unattached volumes, stale services, abandoned Helm releases, deprecated APIs, manually created incident artifacts, and resources that are no longer clearly owned. The usual instinct is to write a cleanup script. This talk argues that this is the wrong starting point.

Kubernetes does not have a native field called “unused.” A resource can look stale because it is genuinely abandoned, but it can also look stale because ownership metadata is missing, a controller created it, GitOps no longer tracks it, observability is incomplete, or an inventory script failed during discovery. Treating “unknown” as “safe to delete” is how platform hygiene turns into a production incident.

This talk presents a practical workflow for safer cloud-native hygiene: Capture, Detect, Classify, Prove, Act.

Capture means making resources explain themselves through labels, annotations, ownership metadata, lifecycle state, and policy-as-code. Detect means continuously finding drift, deprecated APIs, orphaned resources, missing metadata, idle workloads, and configuration decay using open source tools. Classify means separating active, idle, unowned, controller-generated, incident-created, and unknown resources instead of treating them all as cleanup candidates. Prove means collecting evidence before mutation through GitOps state, owner references, metrics, logs, traces, diffs, and backups. Act means making cleanup staged, reviewable, observable, and reversible.

The talk will map this workflow to practical FOSS tools and patterns, including Kubernetes recommended labels, Argo CD orphaned resource monitoring, Flux or Argo CD GitOps workflows, Kyverno or OPA Gatekeeper for admission policies, Pluto or kubent for deprecated API detection, Trivy, Polaris, kube-state-metrics, Prometheus, Grafana, OpenTelemetry, Velero, and policy checks in CI.

Drawn from personal learning experiences, the goal is not to teach people how to delete more resources. The goal is to help platform, DevOps, and SRE teams improve their existing workflows so they can understand their clusters better, reduce operational risk, and make infrastructure changes safer.

Attendees will learn:

1. Why “unused” is not a reliable Kubernetes concept, and why cleanup should be treated as an evidence-gathering workflow rather than a one-pass script.

2. A reusable framework for platform hygiene: Capture, Detect, Classify, Prove, Act.

3. How to capture ownership and lifecycle metadata using Kubernetes labels, annotations, Backstage-style service ownership, and admission policies with Kyverno or OPA Gatekeeper.

4. How to detect drift, stale resources, deprecated APIs, and configuration decay using FOSS tools such as Argo CD, Flux, Pluto, kubent, Trivy, Polaris, kube-state-metrics, Prometheus, and Grafana.

5. How to classify resources before acting, including owned-active, owned-idle, unowned-active, unowned-idle, controller-generated, incident residue, and unknown resources.

6. How to prove safety before mutation using GitOps state, owner references, service endpoints, metrics, logs, traces, diffs, backups, and restore plans.

7. How to design safer cleanup workflows with dry runs, explain mode, owner review, grace periods, quarantine, rollback artifacts, and post-cleanup validation.

8. Why the safest platform cleanup is the cleanup you can explain, pause, review, replay, and roll back.