# Orphaned Resources Monitoring {#orphaned-resources-monitoring}




> [!WARNING]
> Enabling orphaned resource monitoring has performance implications. If an AppProject monitors a namespace containing many resources not managed by Argo CD (e.g. `kube-system`), it can significantly impact your Argo CD instance. Enable this feature only on projects with well-scoped namespaces.



An [orphaned Kubernetes resource](https://kubernetes.io/docs/concepts/architecture/garbage-collection/#orphaned-dependents) is a top-level namespaced resource that does not belong to any Argo CD Application. The Orphaned Resources Monitoring feature allows detecting
orphaned resources, inspecting/removing resources using the Argo CD UI, and generating a warning.

The Orphaned Resources monitoring is enabled in the [Project](https://sourcey-argocd.pages.dev/user-guide/projects/index.md) settings.
Below is an example of enabling the feature using the AppProject custom resource.

```yaml
kind: AppProject
metadata:
  ...
spec:
  ...
  orphanedResources:
    warn: true
...
```

Once the feature is enabled, each project application that has any orphaned resources in its target namespace
will get a warning. The orphaned resources can be located using the application details page by enabling the "Show Orphaned" filter:

![orphaned resources](/_media/abc69ff60162865ded72.png)

When enabling the feature, you might want to consider disabling warnings at first.

```yaml
spec:
  orphanedResources:
    warn: false # Disable warning
```

When warnings are disabled, application users can still view orphaned resources in the UI.


## Exceptions {#exceptions}


Not every resource in the Kubernetes cluster is controlled by the end user and managed by Argo CD. Other operators in the cluster can automatically create resources (e.g., the cert-manager creating secrets), which are then considered orphaned.

The following resources are never considered orphaned:

- Namespaced resources denied in the project. Usually, such resources are managed by cluster administrators and are not supposed to be modified by a namespace user.
- `ServiceAccount` with the name `default` (and the corresponding auto-generated `ServiceAccountToken`).
- `Service` with the name `kubernetes` in the `default` namespace.
- `ConfigMap` with the name `kube-root-ca.crt` in all namespaces.

You can prevent resources from being declared orphaned by providing a list of ignore rules, each defining a Group, Kind, and Name.

```yaml
spec:
  orphanedResources:
    ignore:
      - kind: ConfigMap
        name: orphaned-but-ignored-configmap
```

The `name` can be a [glob pattern](https://github.com/gobwas/glob), e.g.:

```yaml
spec:
  orphanedResources:
    ignore:
    - kind: Secret
      name: *.example.com
```