Delete workspace

Tear down an In-VPC e6data workspace and its AWS resources in the reverse order they were created.

Removing a workspace means tearing down its Kubernetes resources and the AWS resources created for it, in roughly the reverse order of deployment.

Deleting a workspace is irreversible. It removes the workspace's clusters, catalog registrations, and the metadata stored in its S3 bucket. Confirm the workspace is no longer in use before you begin.

Step 1: Remove the workspace components

Delete the workspace custom resources by re-rendering the chart and deleting what it produced (or delete the NamespaceConfig and QueryRouter directly):

helm template "${WORKSPACE_NAME}-ws" "${E6_WORKSPACE_CHART}" \
  --namespace "${NAMESPACE}" --values workspace-values.yaml \
  | kubectl delete -f -

# Confirm the custom resources are gone
kubectl get namespaceconfig,queryrouter,monitoringservices -n ${NAMESPACE}

Step 2: Remove the workspace NodePool and namespace

kubectl delete nodepool.karpenter.sh ${WORKSPACE_NAME}-nodepool
kubectl delete ec2nodeclass.karpenter.k8s.aws ${WORKSPACE_NAME}-nodeclass
kubectl delete namespace ${NAMESPACE}

Karpenter terminates the workspace's nodes once the NodePool is gone and no pods remain.

Step 3: Remove the Pod Identity associations

aws eks list-pod-identity-associations \
  --cluster-name ${CLUSTER_NAME}-eks --namespace ${WORKSPACE_NAME} --region ${REGION} \
  --query 'associations[].associationId' --output text \
| xargs -n1 -I{} aws eks delete-pod-identity-association \
  --cluster-name ${CLUSTER_NAME}-eks --association-id {} --region ${REGION}

Step 4: Remove the workspace IAM roles

Delete the inline policies, then the roles:

for role in ${WORKSPACE_NAME}-engine-role ${WORKSPACE_NAME}-console-role ${WORKSPACE_NAME}-app-role; do
  for policy in $(aws iam list-role-policies --role-name "$role" --query 'PolicyNames' --output text); do
    aws iam delete-role-policy --role-name "$role" --policy-name "$policy"
  done
  aws iam delete-role --role-name "$role"
done

Step 5: Remove the metadata bucket

aws s3 rm s3://e6-${WORKSPACE_NAME}-metadata --recursive
aws s3api delete-bucket --bucket e6-${WORKSPACE_NAME}-metadata --region ${REGION}

This removes one workspace. The shared cluster components (EKS, Karpenter, the ALB Controller, cert-manager, the e6-operator) remain in place to serve other workspaces. Remove those only if you are decommissioning the entire EKS cluster.

See also

• Deploy workspace and e6data - what these steps reverse.
• Troubleshooting - resources stuck during teardown.