Delete workspace

Tear down an e6data workspace in your AKS cluster with kubectl and az, and what to intentionally leave in place.

Removing a workspace deletes its Kubernetes resources but leaves the cluster's base setup (Karpenter, cert-manager, CRDs, operator) intact for other workspaces. Set WORKSPACE_NAME, PREFIX, and RESOURCE_GROUP to the values you used to deploy it.

Step 1: Delete the namespace

Deleting the namespace removes the namespaced resources - the NamespaceConfig, QueryRouter, AccessToken, service accounts, namespaced RBAC, console, Envoy, xDS, metadata services, compaction job, and the load balancer service. The operator tears down internal services as the NamespaceConfig is removed.

kubectl delete namespace ${WORKSPACE_NAME}

Step 2: Delete cluster-scoped resources

Some workspace resources are cluster-scoped and are not removed with the namespace:

# Workspace cluster-scoped RBAC
kubectl delete clusterrole ${WORKSPACE_NAME}-monitoring-role ${WORKSPACE_NAME}-console-warmnodepools-role --ignore-not-found
kubectl delete clusterrolebinding ${WORKSPACE_NAME}-monitoring-role-binding ${WORKSPACE_NAME}-console-warmnodepools-role-binding --ignore-not-found

# Engine NodeClass and NodePool (Karpenter)
kubectl delete nodepool.karpenter.sh ${WORKSPACE_NAME}-nodepool --ignore-not-found
kubectl delete aksnodeclass.karpenter.azure.com ${WORKSPACE_NAME}-nodeclass --ignore-not-found

Step 3: Delete the DNS record

az network dns record-set a delete \
  --resource-group <dns-zone-rg> \
  --zone-name <your-dns-zone> \
  --name "<hostname-without-zone>" --yes

What's not deleted

These are preserved by default - they may be shared, expensive to recreate, or hold data:

Resource

Why preserved

What to do

Workspace Managed Identity

May be reused if you recreate the workspace

Delete manually if no longer needed (below).

ADLS Gen2 storage account

Often shared; may contain data you want

Delete manually if no longer needed.

Role assignments on storage

Tied to the Managed Identity

Removed when you delete the identity.

TLS certificate secret

Removed with the namespace

Recreate it when you redeploy.

To remove the workspace Managed Identity and its federated credentials (if nothing else uses it):

az identity delete \
  --name ${PREFIX}-${WORKSPACE_NAME}-engine-identity \
  --resource-group ${RESOURCE_GROUP}

Verify deletion

kubectl get namespace ${WORKSPACE_NAME}

This should return NotFound once cleanup completes (removal can take 1–2 minutes if finalizers are processing). If the namespace stays in Terminating, see Troubleshooting.

Re-creating a deleted workspace

Redeploy from Deploy workspace and e6data. If the Managed Identity still exists it is reused; otherwise recreate it (Part 1 Step 8). Catalogs and clusters from the previous workspace are not restored - they're rebuilt as part of normal usage after re-creation.