diff --git a/api/v1alpha1/irsasetup_types.go b/api/v1alpha1/irsasetup_types.go
index 54af3b9..29e7c72 100644
--- a/api/v1alpha1/irsasetup_types.go
+++ b/api/v1alpha1/irsasetup_types.go
@@ -29,6 +29,11 @@ const (
 
 // IRSASetupSpec defines the desired state of IRSASetup
 type IRSASetupSpec struct {
+	// Cleanup, when enabled, allows the IRSASetup to perform garbage collection
+	// of resources that are no longer needed or managed.
+	// +required
+	Cleanup bool `json:"cleanup"`
+
 	// Mode specifies the mode of operation. Can be either "selfhosted" or "eks".
 	Mode string `json:"mode"`
 
diff --git a/config/crd/bases/irsa.kkb0318.github.io_irsasetups.yaml b/config/crd/bases/irsa.kkb0318.github.io_irsasetups.yaml
index 8b10df2..41c75e0 100644
--- a/config/crd/bases/irsa.kkb0318.github.io_irsasetups.yaml
+++ b/config/crd/bases/irsa.kkb0318.github.io_irsasetups.yaml
@@ -63,6 +63,11 @@ spec:
                 required:
                 - secretRef
                 type: object
+              cleanup:
+                description: |-
+                  Cleanup, when enabled, allows the IRSASetup to perform garbage collection
+                  of resources that are no longer needed or managed.
+                type: boolean
               discovery:
                 description: |-
                   Discovery configures the IdP Discovery process, essential for setting up IRSA by locating
@@ -90,6 +95,7 @@ spec:
                   or "eks".
                 type: string
             required:
+            - cleanup
             - discovery
             - mode
             type: object
diff --git a/docs/api.md b/docs/api.md
index 63a6c18..1743b0f 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -77,6 +77,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
+| `cleanup` _boolean_ | Cleanup, when enabled, allows the IRSASetup to perform garbage collection<br />of resources that are no longer needed or managed. |  |  |
 | `mode` _string_ | Mode specifies the mode of operation. Can be either "selfhosted" or "eks". |  |  |
 | `discovery` _[Discovery](#discovery)_ | Discovery configures the IdP Discovery process, essential for setting up IRSA by locating<br />the OIDC provider information. |  |  |
 | `auth` _[Auth](#auth)_ | Auth contains authentication configuration details. |  |  |
diff --git a/examples/selfhosted.yaml b/examples/selfhosted.yaml
new file mode 100644
index 0000000..532ceeb
--- /dev/null
+++ b/examples/selfhosted.yaml
@@ -0,0 +1,12 @@
+apiVersion: irsa.kkb0318.github.io/v1alpha1
+kind: IRSASetup
+metadata:
+  name: irsa-init
+  namespace: irsa-manager-system
+spec:
+  cleanup: false
+  mode: selfhosted
+  discovery:
+    s3:
+      region: ap-northeast-1
+      bucketName: irsa-manager-test-kkb0010101
diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go
index efe2fd2..6ee754e 100644
--- a/internal/controller/irsasetup_controller.go
+++ b/internal/controller/irsasetup_controller.go
@@ -130,7 +130,7 @@ func (r *IRSASetupReconciler) reconcileDelete(ctx context.Context, obj *irsav1al
 	if err != nil {
 		return err
 	}
-	kubeHandler := handler.NewKubernetesHandler(kubeClient)
+	kubeHandler := handler.NewKubernetesHandler(kubeClient, obj.Spec.Cleanup)
 	kubeHandler.Append(secret)
 	webhookSetup, err := webhook.NewWebHookSetup()
 	if err != nil {
@@ -180,7 +180,7 @@ func reconcileSelfhosted(ctx context.Context, obj *irsav1alpha1.IRSASetup, awsCl
 	if err != nil {
 		return err
 	}
-	kubeHandler := handler.NewKubernetesHandler(kubeClient)
+	kubeHandler := handler.NewKubernetesHandler(kubeClient, obj.Spec.Cleanup)
 	kubeHandler.Append(secret)
 
 	// for webhook setup
diff --git a/internal/controller/irsasetup_controller_test.go b/internal/controller/irsasetup_controller_test.go
index ff809e3..7bd8b5b 100644
--- a/internal/controller/irsasetup_controller_test.go
+++ b/internal/controller/irsasetup_controller_test.go
@@ -52,7 +52,8 @@ var _ = Describe("IRSASetup Controller", func() {
 						Namespace: "default",
 					},
 					Spec: irsav1alpha1.IRSASetupSpec{
-						Mode: "selfhosted",
+						Cleanup: true,
+						Mode:    "selfhosted",
 						Discovery: irsav1alpha1.Discovery{
 							S3: irsav1alpha1.S3Discovery{
 								Region:     "ap-northeast-1",
@@ -132,7 +133,8 @@ var _ = Describe("IRSASetup Controller", func() {
 						Namespace: "default",
 					},
 					Spec: irsav1alpha1.IRSASetupSpec{
-						Mode: "selfhoted",
+						Cleanup: true,
+						Mode:    "selfhoted",
 						Discovery: irsav1alpha1.Discovery{
 							S3: irsav1alpha1.S3Discovery{
 								Region:     "ap-northeast-1",
diff --git a/internal/handler/kubernetes.go b/internal/handler/kubernetes.go
index 61906dd..ad9cb67 100644
--- a/internal/handler/kubernetes.go
+++ b/internal/handler/kubernetes.go
@@ -10,14 +10,16 @@ import (
 )
 
 type KubernetesHandler struct {
-	client KubernetesClient
-	objs   []client.Object
+	client  KubernetesClient
+	objs    []client.Object
+	cleanup bool
 }
 
-func NewKubernetesHandler(c KubernetesClient) *KubernetesHandler {
+func NewKubernetesHandler(c KubernetesClient, cleanup bool) *KubernetesHandler {
 	return &KubernetesHandler{
-		client: c,
-		objs:   []client.Object{},
+		client:  c,
+		objs:    []client.Object{},
+		cleanup: cleanup,
 	}
 }