kubectl delete in Cursor — agent safety guide
Cursor agents frequently attempt kubectl delete during autonomous sessions.
kubectl delete
Blast radius
The targeted resource. For namespaces, the cascade deletes every workload, configmap, secret, service, ingress, network policy, and PVC inside. For PVCs with reclaim policy `Delete`, the underlying storage class disk is also removed. CRD-based resources may have finalizers that hold deletion but eventually release.
Why agents reach for it
Agents reach for it when pods aren't restarting cleanly, during namespace cleanup tasks, and when troubleshooting 'stuck terminating' resources — sometimes escalating to `--force --grace-period=0` which bypasses the orderly shutdown signal chain.
Recovery options
Workloads with PV reclaim policy `Retain` keep the underlying disk for manual re-attachment. Everything else (configs, secrets, services) must be re-applied from YAML or the GitOps source-of-truth (ArgoCD/Flux). Velero or similar cluster-backup tools are the only path to restore an entire namespace's state.
Real-world incident
A Cody agent ran `kubectl delete ns production` while diagnosing a 'broken' namespace label. Every workload terminated within ~15 seconds. ArgoCD reconciled most resources in 4 minutes, but two StatefulSets with `Retain` PVs needed manual disk re-attachment that took 22 minutes.
Block it with DestructGuard's strict tier
DestructGuard's strict rules tier includes kubectl delete by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.