Skip to content

Document deleting orphaned Kubernetes objects - #3413

Open
flin-8 wants to merge 8 commits into
mainfrom
frank/pruning-docs
Open

Document deleting orphaned Kubernetes objects#3413
flin-8 wants to merge 8 commits into
mainfrom
frank/pruning-docs

Conversation

@flin-8

@flin-8 flin-8 commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Documents the new orphaned-object deletion feature in Kubernetes Live Object Status (Octopus Server 2026.3).

  • New page: Deleting orphaned objects — how to delete one object or several at once, the deletion task, the two permission surfaces (Octopus and cluster), auditing, and known limitations
  • Live Object Status: adds the Deleting sync status, clarifies when an object becomes orphaned, and updates the excluded-steps limitation for newer agents
  • Troubleshooting: new entries for orphaned objects and failed deletions
  • Cross-references from the Argo CD live status page and the Kubernetes agent permissions controller
  • Default permissions: adds DeployedResourceAdminister to the four built-in roles that get it

🤖 Generated with Claude Code

flin-8 and others added 6 commits August 21, 2026 12:32
The trailing space would fail the markdownlint check (MD009).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Open your project and select **Live Status** for the environment (and tenant) you want. The table offers a delete action on every orphaned row, and when an application has orphaned objects the page also shows a card counting them. To list only orphaned objects, use the **Sync status** filter and select **Orphaned**.

:::figure

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need a screenshot without names etc.

| Out of Sync | <i class="fa-solid fa-arrow-up orange"></i> | Object manifest is not the same as what was applied |
| Unknown | <i class="fa-solid fa-question grey"></i> | We don't have information about the live status of this object |
| Orphaned | <i class="fa-solid fa-link-slash orange"></i> | Object was deployed in a previous release but is no longer part of the latest deployment process |
| Deleting | <i class="fa-solid fa-hourglass blue"></i> | Octopus is deleting this orphaned object. Select the status to open the task doing the work |

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Slightly off - the UI shows "Deleting" but the sync status doesn't actually change over the wire

@team-marketing-branch-protections

Copy link
Copy Markdown

Pull request environment is available at https://stoctodocspr3413.z22.web.core.windows.net.

You can view the ephemeral environment status in Octopus Deploy.

This environment will be automatically deprovisioned when the pull request is closed, or after 7 days of inactivity.

@flin-8 flin-8 self-assigned this Aug 21, 2026

@tleed5 tleed5 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, just some small changes to make things clearer

@@ -85,24 +85,27 @@ Sync Status tracks whether the changes Octopus deployed still matches the resour
| Out of Sync | <i class="fa-solid fa-arrow-up orange"></i> | Object manifest is not the same as what was applied |
| Unknown | <i class="fa-solid fa-question grey"></i> | We don't have information about the live status of this object |
| Orphaned | <i class="fa-solid fa-link-slash orange"></i> | Object was deployed in a previous release but is no longer part of the latest deployment process |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we wanted to make this icon's color match the portal you can add style="color: var(--colorIconWarning);" and get rid of the orange class since it doesn't actually exist for fa-link-slash


### An object stays orphaned after I re-added the step \{#orphan-persists-after-re-adding-a-step}

Octopus clears the orphan state when a deployment deploys the object again. Re-adding a step that is disabled does not deploy anything, so the object stays orphaned. Enable the step and deploy, or [delete the orphaned object](/docs/kubernetes/live-object-status/deleting-orphaned-objects) if you no longer want it.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-adding a step that is disabled does not deploy anything

I think this is a little bit confusing, it kinda conflicts with what is mentioned below

Skipping or disabling a step does not orphan its objects

I think it needs to be explicit about re-adding a step that was removed from the process

Suggested change
Octopus clears the orphan state when a deployment deploys the object again. Re-adding a step that is disabled does not deploy anything, so the object stays orphaned. Enable the step and deploy, or [delete the orphaned object](/docs/kubernetes/live-object-status/deleting-orphaned-objects) if you no longer want it.
Octopus clears the orphan state when a deployment deploys the object again. Re-adding a step that was removed from the process does not deploy anything, so the object stays orphaned. Enable the step and deploy, or [delete the orphaned object](/docs/kubernetes/live-object-status/deleting-orphaned-objects) if you no longer want it.


An object is marked [Orphaned](/docs/kubernetes/live-object-status#orphaned-objects) when a deployment succeeds and no longer produces an object that a previous release deployed. The usual causes are removing the object from a manifest, or removing the step that deployed it from the deployment process. Skipping or disabling a step does not orphan its objects, and a failed deployment never orphans anything.

If you expected an object to be orphaned and it isn't, check that every Kubernetes monitor in the application is on agent version 2.38.3 or later (v2) / 3.0.1 or later (v3). Orphan tracking is all-or-nothing across the application, so one older agent disables it everywhere and dropped objects are silently removed from the table instead.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By application do you mean Octopus Deploy itself or an application instance? Seems a bit weird if one outdated agent that might be in a completely different space could disable orphan tracking for the entire Octopus instance

@flin-8 flin-8 Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

monitors deployed to from the P/E/T - so application instance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants