flux diff kustomization reports protected resources as deleted

Describe the bug

flux diff kustomization reports a resource as deleted when it's removed from the local manifests, even if the live resource has kustomize.toolkit.fluxcd.io/prune: disabled. The controller skips it, but the diff reports a deletion and exits with 1.

The same happens with reconcile: disabled, ssa: Ignore, and resources whose ownership labels no longer match the Kustomization.

Steps to reproduce

1. Have a reconciled Kustomization named pruning in flux-system, with spec.prune: true, managing this ConfigMap:

   yaml复制

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: pruned
     namespace: default
     annotations:
       kustomize.toolkit.fluxcd.io/prune: disabled

2. Once the annotation is present on the live object, remove the ConfigMap from the local manifests in ./pruning. Leave a valid kustomization.yaml with resources: []. Don't reconcile the removal yet.

3. Run:

   bash复制

   flux diff kustomization pruning --namespace flux-system --path ./pruning --progress-bar=false

The output includes ► ConfigMap/default/pruned deleted, with exit code 1.

Expected behavior

Report the protected object as skipped, matching the controller. If there are no other changes, exit with 0.

Screenshots and recordings

No response

OS / Distro

Ubuntu 26.04.1 LTS on WSL2, Go 1.26.8.

Flux version

N/A - reproduced from source at upstream commit dede56a8fdcd1e0edca28630a979a51415bb56f8.

Flux check

N/A - reproduced with envtest inventory and live-object fixtures, without a Flux installation.

Git provider

No response

Container Registry provider

No response

Additional context

The pruning loop compares inventory entries without reading the live objects. The controller checks their ownership labels and pruning exclusions before deleting them, as described in the pruning documentation.

Proposed fix: Respect pruning exclusions in kustomization diff.

Code of Conduct

• I agree to follow this project's Code of Conduct