diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 4997e4b..a554373 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -28,6 +28,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go
index 6ee754e..46c3120 100644
--- a/internal/controller/irsasetup_controller.go
+++ b/internal/controller/irsasetup_controller.go
@@ -48,6 +48,7 @@ type IRSASetupReconciler struct {
 //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=irsa.kkb0318.github.io,resources=irsasetups/finalizers,verbs=update
 //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="apps",resources=deployments,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=clusterroles,verbs=get;list;watch;create;update;patch;delete
@@ -122,6 +123,9 @@ func (r *IRSASetupReconciler) reconcile(ctx context.Context, obj *irsav1alpha1.I
 }
 
 func (r *IRSASetupReconciler) reconcileDelete(ctx context.Context, obj *irsav1alpha1.IRSASetup, kubeClient *kubernetes.KubernetesClient) error {
+	if !obj.Spec.Cleanup {
+		return nil
+	}
 	factory, err := newOIDCIdpFactory(ctx, obj, nil, r.AwsClient)
 	if err != nil {
 		return err
@@ -130,7 +134,7 @@ func (r *IRSASetupReconciler) reconcileDelete(ctx context.Context, obj *irsav1al
 	if err != nil {
 		return err
 	}
-	kubeHandler := handler.NewKubernetesHandler(kubeClient, obj.Spec.Cleanup)
+	kubeHandler := handler.NewKubernetesHandler(kubeClient)
 	kubeHandler.Append(secret)
 	webhookSetup, err := webhook.NewWebHookSetup()
 	if err != nil {
@@ -180,7 +184,7 @@ func reconcileSelfhosted(ctx context.Context, obj *irsav1alpha1.IRSASetup, awsCl
 	if err != nil {
 		return err
 	}
-	kubeHandler := handler.NewKubernetesHandler(kubeClient, obj.Spec.Cleanup)
+	kubeHandler := handler.NewKubernetesHandler(kubeClient)
 	kubeHandler.Append(secret)
 
 	// for webhook setup
diff --git a/internal/controller/irsasetup_controller_test.go b/internal/controller/irsasetup_controller_test.go
index 7bd8b5b..ab5646b 100644
--- a/internal/controller/irsasetup_controller_test.go
+++ b/internal/controller/irsasetup_controller_test.go
@@ -210,6 +210,84 @@ var _ = Describe("IRSASetup Controller", func() {
 					}
 				},
 			},
+			{
+				name: "no cleanup",
+				obj: &irsav1alpha1.IRSASetup{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "test-resource2",
+						Namespace: "default",
+					},
+					Spec: irsav1alpha1.IRSASetupSpec{
+						Cleanup: false,
+						Mode:    "selfhoted",
+						Discovery: irsav1alpha1.Discovery{
+							S3: irsav1alpha1.S3Discovery{
+								Region:     "ap-northeast-1",
+								BucketName: "irsa-manager-kkb-1",
+							},
+						},
+					},
+				},
+				f: func(r *IRSASetupReconciler, obj *irsav1alpha1.IRSASetup) {
+					expected := []expectedResource{
+						{
+							NamespacedName: types.NamespacedName{Name: "irsa-manager-key", Namespace: "kube-system"},
+							f:              newSecret,
+						},
+						// webhook
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newDeployment,
+						},
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newService,
+						},
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newMutatingWebhookConfiguration,
+						},
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newServiceAccount,
+						},
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newClusterRole,
+						},
+						{
+							NamespacedName: types.NamespacedName{Name: "pod-identity-webhook", Namespace: "kube-system"},
+							f:              newClusterRoleBinding,
+						},
+					}
+					typeNamespacedName := types.NamespacedName{
+						Name:      obj.Name,
+						Namespace: obj.Namespace,
+					}
+					_, err := r.Reconcile(ctx, reconcile.Request{
+						NamespacedName: typeNamespacedName,
+					})
+					Expect(err).NotTo(HaveOccurred())
+					_, err = r.Reconcile(ctx, reconcile.Request{
+						NamespacedName: typeNamespacedName,
+					})
+					Expect(err).NotTo(HaveOccurred())
+					for _, expect := range expected {
+						checkExist(expect)
+					}
+					By("removing the custom resource (not cleanup)")
+					Eventually(func() error {
+						return k8sClient.Delete(ctx, obj)
+					}, timeout).Should(Succeed())
+					_, err = r.Reconcile(ctx, reconcile.Request{
+						NamespacedName: typeNamespacedName,
+					})
+					Expect(err).To(Not(HaveOccurred()))
+					for _, expect := range expected {
+						checkExist(expect)
+					}
+				},
+			},
 		}
 		for _, tt := range tests {
 			It(tt.name, func() {
@@ -225,22 +303,7 @@ var _ = Describe("IRSASetup Controller", func() {
 				By("creating the custom resource for the Kind IRSASetup")
 				err := k8sClient.Get(ctx, typeNamespacedName, tt.obj)
 				if err != nil && errors.IsNotFound(err) {
-					resource := &irsav1alpha1.IRSASetup{
-						ObjectMeta: metav1.ObjectMeta{
-							Name:      typeNamespacedName.Name,
-							Namespace: typeNamespacedName.Namespace,
-						},
-						Spec: irsav1alpha1.IRSASetupSpec{
-							Mode: "selfhoted",
-							Discovery: irsav1alpha1.Discovery{
-								S3: irsav1alpha1.S3Discovery{
-									Region:     "ap-northeast-1",
-									BucketName: "irsa-manager-kkb-1",
-								},
-							},
-						},
-					}
-					Expect(k8sClient.Create(ctx, resource)).To(Succeed())
+					Expect(k8sClient.Create(ctx, tt.obj)).To(Succeed())
 				}
 				_, err = controllerReconciler.Reconcile(ctx, reconcile.Request{
 					NamespacedName: typeNamespacedName,
diff --git a/internal/handler/kubernetes.go b/internal/handler/kubernetes.go
index ad9cb67..61906dd 100644
--- a/internal/handler/kubernetes.go
+++ b/internal/handler/kubernetes.go
@@ -10,16 +10,14 @@ import (
 )
 
 type KubernetesHandler struct {
-	client  KubernetesClient
-	objs    []client.Object
-	cleanup bool
+	client KubernetesClient
+	objs   []client.Object
 }
 
-func NewKubernetesHandler(c KubernetesClient, cleanup bool) *KubernetesHandler {
+func NewKubernetesHandler(c KubernetesClient) *KubernetesHandler {
 	return &KubernetesHandler{
-		client:  c,
-		objs:    []client.Object{},
-		cleanup: cleanup,
+		client: c,
+		objs:   []client.Object{},
 	}
 }