Remove KubeOn
Uninstall the agent, revoke cloud access, clear snapshots and remove the hub or gateway, with what stays behind and how to verify.
On this page
Your workloads are not affected
The agent only reads, and every change from a proposal was applied by your own pipeline. Removing KubeOn changes nothing that runs in your clusters. Export any reports you want to keep first, as CSV or through the API.
1. Remove the agent from each cluster
Helm
helm uninstall kubeon-agent --namespace kubeonkubectl delete namespace kubeon- Flux or Argo CD: delete the HelmRelease or Application from your repository and let the controller prune it.
- Terraform: remove the agent's
helm_releaseresource and apply.
Verify
kubectl get namespace kubeon # NotFoundkubectl get clusterrole,clusterrolebinding kubeon-agent-reader # NotFound2. Revoke cloud access
AWS
# Billing role, deployed with CloudFormationaws cloudformation delete-stack --stack-name kubeon-billing-accessaws cloudformation wait stack-delete-complete --stack-name kubeon-billing-access# Agent role, one per cluster: remove its policies, then the roleaws iam list-role-policies --role-name <cluster>-kubeon-agent # inline policiesaws iam delete-role-policy --role-name <cluster>-kubeon-agent --policy-name <policy-name>aws iam list-attached-role-policies --role-name <cluster>-kubeon-agent # managed policiesaws iam detach-role-policy --role-name <cluster>-kubeon-agent --policy-arn <policy-arn>aws iam delete-role --role-name <cluster>-kubeon-agentOn-premises clusters: delete the credentials you created for the agent's snapshot upload. Your billing exports, the CUR, Glue and Athena tables, BigQuery datasets and Azure exports were created by you and are left as they are.
3. Clear snapshots
The snapshot bucket's lifecycle rule deletes every snapshot within 14 days. To remove them now from your own bucket:
Amazon S3
aws s3 rm s3://<snapshot-bucket>/<prefix>/ --recursive4. Remove the hub
| Hub | How to remove it | Your data |
|---|---|---|
| KubeOn Cloud | Ask us to close the workspace | Deleted or kept as agreed in your evaluation or contract |
| Self-hosted on AWS | Run terraform destroy in the hub's Terraform directory | Take a final database snapshot first if you want to keep cost history |
| Self-hosted on Kubernetes or on-premises | helm uninstall kubeon-hub --namespace kubeon-hub, then remove the database, Redis and buckets you created for it | Yours, until you delete it |
5. Remove the KubeOn AI gateway
- Point each application back at its provider's endpoint, or another route, and deploy. Revoking keys first would make those requests fail.
- Revoke the gateway's team and application keys.
- Self-hosted:
helm uninstall kubeon-ai-gateway --namespace kubeon-ai. - Remove the provider credentials created for the gateway, such as the Bedrock role or the Azure OpenAI workload identity, and the read-only billing access for AI tokenomics.
What stays
| After removal | |
|---|---|
| Your clusters and workloads | Unchanged. KubeOn never modified them |
| Changes applied from proposals | In your repository's history, like any other change |
| Your billing exports and datasets | Unchanged, and still delivered by your cloud provider |
| Reports you exported or scheduled to email | Wherever you saved or sent them |
Need help with this guide?Contact support