Clean up the Amazon EKS installation
Human verified
A human reviewed this page, but it may be out of date. Later edits may not have been reviewed.
Remove the quickstart installation, then retire its dedicated AWS resources through the provisioning workflow that created them. Keep the recorded AWS account, region and EKS cluster name from setup.
Remove the Installation
From the checkout containing these instructions, keep the saved session and complete Delete Agent first. Verify that this dedicated quickstart installation has no other Agents to retain. The following removes the recorded OCE release and the OpenShell release installed for it:
source /path/to/private/run/session.shsource docs/snippets/openshell-quickstart/platform-kubernetes.shhelm --kubeconfig "$KUBECONFIG" --kube-context "$CONTEXT" -n "$PLATFORM_NS" listhelm --kubeconfig "$KUBECONFIG" --kube-context "$CONTEXT" -n "$PLATFORM_NS" uninstall "$RELEASE"helm --kubeconfig "$KUBECONFIG" --kube-context "$CONTEXT" -n "$PLATFORM_NS" uninstall openshell-gatewaykube -n "$PLATFORM_NS" delete deployment oce-owner-listener --ignore-not-foundkube -n "$PLATFORM_NS" delete configmap oce-owner-listener --ignore-not-foundkube -n "$PLATFORM_NS" delete secret oce-owner-browser-tls --ignore-not-foundStop the laptop port-forward. For each run directory used by this installation, source its session and the checkout’s platform helper as above, then run delete_service_peers. It removes every service policy set recorded before deployment or Add Git applied it. In the setup session, also remove the listener and bootstrap policies:
delete_service_peersif [[ -f $RUN_DIR/listener.json ]]; then kube delete -f "$RUN_DIR/listener.json" --ignore-not-found; fikube -n "$PLATFORM_NS" delete networkpolicy oce-initialization-dns-vip oce-controller-openshell-management --ignore-not-found| Created or used during setup | Cleanup outcome |
|---|---|
| OCE and OpenShell Helm releases, private listener and recorded network policies | Commands above remove their managed resources. |
| Versioned Installation Secrets, database/authentication/client-TLS Secrets, browser bootstrap claim and Git registry/key inputs | Operator-created inputs remain; remove only this installation's recorded objects after deciding retention. |
| Backing tenant namespace, tenant RoleBindings and retained workspace/PVC storage | Inspect after Agent deletion; remove only this installation's remaining objects. |
Kubernetes cluster, shared oce-system namespace, GatewayClass, controllers and StorageClasses |
Retained for other installations and workloads. |
| External database, roles, backups and image registry | Retained; use their owners' provisioning records for separate removal. |
Helm does not remove all operator-created inputs or retained storage. Inventory the selected namespace before removing the quickstart's versioned Installation Secrets, registry ConfigMaps, App/custody/TLS Secrets, bootstrap claim and other retained volumes:
kube -n "$PLATFORM_NS" get secrets,configmaps,persistentvolumeclaimskube get namespaces -l "openclaw.dev/namespace=$namespace"Remove only resources recorded as belonging to this installation. Keep shared controllers, GatewayClasses, namespaces, storage and other users' workloads. Confirm the storage reclaim policy before deleting a claim; preserve required backups first. The external PostgreSQL database and its backups are managed separately. Retire only this installation's database, roles and secrets through the database owner's provisioning procedure.
Issued GitHub tokens can remain valid until expiry after the worker disappears. Installation removal does not revoke the service-account PAT or uninstall the GitHub App. Remove private run-owned credential copies when they are no longer needed; retain the required recovery and deletion records.
Retire dedicated AWS resources
Verify aws sts get-caller-identity and the saved AWS_REGION and EKS_CLUSTER before any cloud deletion. Use the owning infrastructure stack to remove only this quickstart's node groups and EKS cluster after its Kubernetes workloads and any load balancers are gone. Do not delete an EKS cluster shared with other installations.
Review retained EBS volumes and snapshots, the dedicated RDS database/instance and backups, ECR images, load balancers, NAT gateways and other dedicated network resources. Cluster deletion alone does not retire these resources. Remove them through their owning provisioning records, preserving required backups and shared resources. Confirm deletion or intentional retention in the AWS inventory; otherwise charges can continue.
Stop the laptop forward and remove its private CA from the browser trust store when no longer used. Keep only the required recovery/deletion records from RUN_DIR.
Next steps
- Deploy on Kubernetes for an existing cluster.
- Browse Reference for CLI commands, API operations, permissions and configuration.
- Browse the product guides for Agent management and observability.