Skip to main content

Uninstall

What you are about to delete​

Default--keep-data--keep-crds
The three Helm releasesRemovedRemovedRemoved
Objects the operators created outside the releasesRemovedRemovedRemoved
Kafka topic finalizersClearedClearedCleared
Namespaces gen0sec and gen0sec-systemDeletedKeptDeleted
Volumes: Postgres, Kafka, object storeDeletedKeptDeleted
Secrets, including the database passwordsDeletedKeptDeleted
Operator CRDsRemovedRemovedKept
The default deletes your data, and it asks you to prove you mean this cluster

Without --keep-data the databases and the object store go, and nothing can undo that. So that run also asks you to type the current context name back, and refuses to run at all with no terminal attached.

--keep-crds does not trigger that prompt, because a schema the next install reinstalls anyway is no reason to skip asking about the databases.

Remove everything​

$KIT/scripts/uninstall.sh --yes

It prints the cluster context, the release list and the volume count, then waits for you to type the context name. Read what it prints before you type.

Keep the data​

$KIT/scripts/uninstall.sh --yes --keep-data

Stops after clearing the topic finalizers. The namespaces stay, and so do the volumes and the secrets in them. No context confirmation, because nothing irreversible happens.

Why the secrets have to stay with the volumes

A reinstall over retained volumes needs the original database passwords: the data was written with them and a fresh Postgres operator generates different ones. Keeping the volumes without the secrets leaves you with data you cannot open.

Keep the CRDs​

$KIT/scripts/uninstall.sh --yes --keep-crds

Use this when something else in the cluster runs the same operators, or when you want the next install to skip reinstalling schemas.

How CRD removal is made safe​

CRDs are cluster-scoped, and deleting one deletes every resource of that kind in every namespace. Another Postgres or Kafka cluster run by the same operators would go with them.

So the script checks first: if any of those kinds is in use outside the two namespaces it is removing, it skips the CRDs and tells you. --keep-crds skips them unconditionally.

That check is why removing CRDs by default is safe. It is not a blanket delete.

If you want to see what would be affected before you run anything:

kubectl get postgresqls,kafkas,kafkatopics,kafkanodepools -A 2>/dev/null | grep -v 'gen0sec'

Any output there means the script will leave the CRDs alone.

The Kafka finalizer, and why order matters​

Strimzi puts a strimzi.io/topic-operator finalizer on all 23 KafkaTopics. Once the operator is gone, nothing clears it, and deleting the namespace leaves it in Terminating indefinitely.

The script uninstalls the releases first, then clears the finalizers, then deletes the namespaces. That order is the whole reason the script exists.

If you already deleted the namespace and it is stuck, this is the fix:

NS=gen0sec-system

kubectl get kafkatopics.kafka.strimzi.io -n $NS -o name \
  | xargs -r -n1 kubectl patch -n $NS --type=merge \
      -p '{"metadata":{"finalizers":null}}'

Reinstalling over retained volumes​

Two things bite here.

Kafka. The volumes survive on purpose, and a recreated cluster generates a new identity. Brokers then crash loop with Invalid cluster.id. See Kafka will not start.

Postgres. You need the original role passwords. If you kept the secrets, the operator adopts the existing data. If you did not, the volumes are unreadable.

Uninstalling by hand​

The script does more than these commands: it also removes objects the operators created outside the releases, and it handles the CRD safety check. Use it if you can.

helm uninstall g0s      -n gen0sec
helm uninstall g0s-data -n gen0sec-system
helm uninstall g0s-infra -n gen0sec-system

# clear the finalizers before touching the namespaces
kubectl get kafkatopics.kafka.strimzi.io -n gen0sec-system -o name \
  | xargs -r -n1 kubectl patch -n gen0sec-system --type=merge \
      -p '{"metadata":{"finalizers":null}}'

kubectl delete namespace gen0sec
kubectl delete namespace gen0sec-system

Do not pass --wait to helm uninstall. The Kafka topics cannot finish deleting until the finalizers above are cleared, so waiting only burns the timeout.