Uninstall & Cleanup

Set Variables

Export the Helm release name and namespace so the commands below can be pasted verbatim. Both default to boltmcp — adjust if you installed under different names (run helm list -A to look them up).

export RELEASE=boltmcp
export NAMESPACE=boltmcp

Uninstall the Helm Release

helm uninstall ${RELEASE} -n ${NAMESPACE}

Delete Persistent Data

This deletes all persistent volume claims in the namespace, including the database. All data will be lost.

kubectl delete pvc -n ${NAMESPACE} --all

Delete Secrets

The three application secrets and the image pull secret were created manually during Cluster Prep and are not managed by Helm, so helm uninstall does not remove them. Delete them explicitly:

kubectl delete secret \
  ${RELEASE}-auth \
  ${RELEASE}-database \
  ${RELEASE}-oidc \
  boltmcp-pull-secret \
  -n ${NAMESPACE}

The three application secrets default to <release>-auth, <release>-database, <release>-oidc. The pull secret defaults to boltmcp-pull-secret — adjust the command above if you created it under a different name in cluster prep.

Remove Ingress Resources

If you configured Ingress & TLS, remove those resources:

# Ingress and TLS secret (names come from boltmcp-ingress.yaml — adjust if you renamed them)
kubectl delete ingress boltmcp-ingress -n ${NAMESPACE}
kubectl delete secret boltmcp-tls -n ${NAMESPACE}

# Certificate (may return NotFound if already cleaned up by cert-manager)
kubectl delete certificate boltmcp-tls -n ${NAMESPACE}

# ClusterIssuers
kubectl delete clusterissuer letsencrypt-staging
kubectl delete clusterissuer letsencrypt-production

# cert-manager (helm uninstall intentionally keeps CRDs — delete them manually)
helm uninstall cert-manager -n cert-manager
kubectl delete namespace cert-manager

# Deleting these CRDs is cluster-wide: it removes every cert-manager
# resource in the cluster, not just BoltMCP's. Skip if other workloads use cert-manager.
kubectl delete crd \
  challenges.acme.cert-manager.io \
  orders.acme.cert-manager.io \
  certificaterequests.cert-manager.io \
  certificates.cert-manager.io \
  clusterissuers.cert-manager.io \
  issuers.cert-manager.io

# NGINX Ingress Controller
helm uninstall ingress-nginx -n ingress-nginx

# The cloud load balancer is deleted asynchronously when the LoadBalancer
# Service is removed. Wait until this returns no controller Service before
# continuing — re-run as needed:
kubectl get svc -n ingress-nginx

kubectl delete namespace ingress-nginx

Release Static IP

REGION=$(gcloud container clusters describe <cluster-name> \
  --format="get(location)" | sed 's/-[a-z]$//')

gcloud compute addresses delete boltmcp-ingress-ip --region $REGION

# Find the allocation ID(s) for the Elastic IP(s) you allocated
ALLOCATION_ID=$(aws ec2 describe-addresses \
  --filters "Name=tag:Name,Values=boltmcp-*" \
  --query 'Addresses[0].AllocationId' --output text)

aws ec2 release-address --allocation-id $ALLOCATION_ID

NODE_RG=$(az aks show \
  --resource-group boltmcp-rg \
  --name boltmcp-cluster \
  --query nodeResourceGroup -o tsv)

az network public-ip delete \
  --resource-group $NODE_RG \
  --name boltmcp-ingress-ip

Remove the DNS records you created in Configure DNS — either the single wildcard or the four web, auth, server, and inspector records for your global.domain (e.g. web.<domain>) — from your DNS provider. These are A records on GKE and AKS (and on an EKS NLB+EIP), or CNAME records pointing at the load balancer hostname on the default EKS Classic ELB.

Delete the Namespace

If you no longer need the namespace, delete it:

kubectl delete namespace ${NAMESPACE}

Skip this step if you plan to reinstall BoltMCP into the same namespace.

Delete the StorageClass (EKS)

On EKS you created a gp3 StorageClass during Cluster Prep. It is cluster-scoped and was applied directly with kubectl, so neither helm uninstall nor deleting the namespace removes it. (GKE and AKS used their built-in default — there is nothing to delete.)

kubectl delete storageclass gp3

Delete the Cluster

If you no longer need the Kubernetes cluster:

gcloud container clusters delete boltmcp-cluster --zone europe-west2-a

eksctl delete cluster --name boltmcp-cluster --region eu-west-2

az aks delete \
  --resource-group boltmcp-rg \
  --name boltmcp-cluster

# Optionally delete the resource group
az group delete --name boltmcp-rg

Clean Up Local Workstation (Optional)

kubeconfig

Deleting the cluster in your cloud provider does not touch your local ~/.kube/config. The stale context, cluster, and user entries will remain until you remove them explicitly:

kubectl config delete-context <context-name>
kubectl config delete-cluster <cluster-name>
kubectl config delete-user <user-name>

Run kubectl config get-contexts first to find the exact names. If the deleted context was your active one, set a new active context afterwards:

kubectl config use-context <other-context-name>

Local YAML manifests

Remove any files you created locally during install — for example values-prod.yaml, storageclass-gp3.yaml (EKS), cluster-issuer-staging.yaml, cluster-issuer-production.yaml, and boltmcp-ingress.yaml — from the directory where you ran the install.

Helm registry credentials

Following these docs, you pointed Helm at the BoltMCP key file via the HELM_REGISTRY_CONFIG environment variable rather than running helm registry login, so there is no cached credential to remove — just discard the env var (it disappears when you close the shell) and delete the key file if you no longer need it:

rm keys/boltmcp-key.json

Only if you explicitly ran helm registry login against the registry do you need to log out to clear the cached credential at ~/.config/helm/registry/config.json:

helm registry logout europe-west2-docker.pkg.dev