Delete workspace

Removing a workspace deletes its Kubernetes resources but leaves the cluster’s base setup (Karpenter, cert-manager, CRDs, operator) intact for other workspaces. Set WORKSPACE_NAME, PREFIX, and RESOURCE_GROUP to the values you used to deploy it.

Step 1: Delete the namespace

Deleting the namespace removes the namespaced resources - the NamespaceConfig, QueryRouter, AccessToken, service accounts, namespaced RBAC, console, Envoy, xDS, metadata services, compaction job, and the load balancer service. The operator tears down internal services as the NamespaceConfig is removed.

kubectl delete namespace ${WORKSPACE_NAME}

Step 2: Delete cluster-scoped resources

Some workspace resources are cluster-scoped and are not removed with the namespace:

# Workspace cluster-scoped RBAC
kubectl delete clusterrole ${WORKSPACE_NAME}-monitoring-role ${WORKSPACE_NAME}-console-warmnodepools-role --ignore-not-found
kubectl delete clusterrolebinding ${WORKSPACE_NAME}-monitoring-role-binding ${WORKSPACE_NAME}-console-warmnodepools-role-binding --ignore-not-found

# Engine NodeClass and NodePool (Karpenter)
kubectl delete nodepool.karpenter.sh ${WORKSPACE_NAME}-nodepool --ignore-not-found
kubectl delete aksnodeclass.karpenter.azure.com ${WORKSPACE_NAME}-nodeclass --ignore-not-found

Step 3: Delete the DNS record

az network dns record-set a delete \
  --resource-group <dns-zone-rg> \
  --zone-name <your-dns-zone> \
  --name "<hostname-without-zone>" --yes

What’s not deleted

These are preserved by default - they may be shared, expensive to recreate, or hold data:

Resource	Why preserved	What to do
Workspace Managed Identity	May be reused if you recreate the workspace	Delete manually if no longer needed (below).
ADLS Gen2 storage account	Often shared; may contain data you want	Delete manually if no longer needed.
Role assignments on storage	Tied to the Managed Identity	Removed when you delete the identity.
TLS certificate secret	Removed with the namespace	Recreate it when you redeploy.

To remove the workspace Managed Identity and its federated credentials (if nothing else uses it):

az identity delete \
  --name ${PREFIX}-${WORKSPACE_NAME}-engine-identity \
  --resource-group ${RESOURCE_GROUP}

Verify deletion

kubectl get namespace ${WORKSPACE_NAME}

This should return NotFound once cleanup completes (removal can take 1–2 minutes if finalizers are processing). If the namespace stays in Terminating, see Troubleshooting.

Re-creating a deleted workspace

Redeploy from Deploy workspace and e6data. If the Managed Identity still exists it is reused; otherwise recreate it (Part 1 Step 8). Catalogs and clusters from the previous workspace are not restored - they’re rebuilt as part of normal usage after re-creation.

Platform

Get started

Deploy a workspace

Manage workspaces

Identity and access

Tokens and support access

Operate

Automate

Security and trust

Reference

Step 1: Delete the namespace

Step 2: Delete cluster-scoped resources

Step 3: Delete the DNS record

What’s not deleted

Verify deletion

Re-creating a deleted workspace

See also

​Step 1: Delete the namespace

​Step 2: Delete cluster-scoped resources

​Step 3: Delete the DNS record

​What’s not deleted

​Verify deletion

​Re-creating a deleted workspace

​See also

Step 1: Delete the namespace

Step 2: Delete cluster-scoped resources

Step 3: Delete the DNS record

What’s not deleted

Verify deletion

Re-creating a deleted workspace

See also