Uninstall / Teardown

Use this page to decommission a Nexa deployment cleanly and stop the associated cloud billing. Teardown happens in two layers: the workloads (Kubernetes objects delivered through ArgoCD/Kustomize) and the infrastructure (EKS/AKS, the application database, secret store, registry, DNS — provisioned by Terraform in your IaC repo). Remove them in order so ArgoCD doesn’t fight you by re-syncing, and so nothing is orphaned.

Nexa is customer-managed, so you run every step in your own account. DataReadyAI has no access and cannot remove anything for you.

This deletes data

Tearing down the application database, the raw-data lake bucket, and secret-store entries permanently deletes their contents. Your Snowflake or Databricks warehouse — where curated and consumption data actually lives — is a separate account that this teardown does not touch, but the Nexa metadata (glossary, pipeline definitions, agent configs, cost history) lives in the application database and is lost when it is dropped. Take and verify backups (step 1) before deleting anything.

What is and isn’t deleted

Resource	Layer	Deleted by teardown?	Notes
Nexa service workloads (Deployments, Services, ConfigMaps, HTTPRoutes)	Kubernetes	Yes	Removed when the ArgoCD apps and namespaces are deleted.
ArgoCD Applications & namespaces (web-*, backend-*, databricks-*, agents-*, etc.)	Kubernetes	Yes	Delete the App-of-Apps first to stop re-sync.
Application Postgres database (RDS on AWS / managed Postgres on Azure)	Infrastructure	Yes, if you destroy it	Holds all Nexa metadata. Back up first.
Cloud secret-store entries (AWS Secrets Manager / Azure Key Vault)	Infrastructure	Yes, if you destroy it	Connection creds, tokens. Export any you still need.
Raw-data lake bucket (S3 / equivalent)	Infrastructure	Yes, if you destroy it	Landing/raw files. Preserve if you need the source data.
Container images in your registry (ECR / ACR)	Infrastructure	Optional	Delete repos separately if you want the images gone.
EKS/AKS cluster, node groups, VPC, DNS records, certificates	Infrastructure	Yes, via terraform destroy	This is where most ongoing billing stops.
Snowflake / Databricks warehouse and its data	External account	No	Separate account you own; manage/retain independently.
Terraform state backend (state bucket / lock table)	Infrastructure	No (keep until last)	Needed to run destroy; remove manually afterward if desired.

Teardown steps

1. Back up everything you want to keep — and verify the backups restore. Snapshot the application database, export any secret-store entries you still need, and copy out raw-lake objects you must retain. Use the procedures in the Operations Guide. Do not proceed until a test restore of the database succeeds.

2. Stop GitOps from re-syncing. Delete the App-of-Apps so ArgoCD stops recreating workloads you are about to remove:

   kubectl delete -f argocd/bootstrap/app-of-apps-prod.yaml
   # repeat for the other environments you are removing (dev/test)

   Confirm the child Applications are gone:

   kubectl get applications -n argocd

3. Delete the service namespaces. Removing each namespace drops that environment’s Deployments, Services, ConfigMaps, Secrets, and routes together:

   for ns in web-prod backend-prod databricks-prod agents-prod actg-ai-prod; do
     kubectl delete namespace "$ns" --ignore-not-found=true --timeout=180s
   done

   If a namespace hangs in Terminating, a finalizer is usually waiting on an ArgoCD resource — confirm the App-of-Apps deletion in step 2 completed, then retry.

4. Remove the platform add-ons you installed into the cluster (ArgoCD, ArgoCD Image Updater, cert-manager, the gateway/ingress, secrets-store CSI driver) if you are decommissioning the whole cluster. If you are destroying the cluster with Terraform in step 6, you can skip this — destroying the cluster removes them.

5. Confirm the cluster is clear of Nexa workloads:

   kubectl get all -A | grep -E 'nexa|actg' || echo "No Nexa workloads remaining"

6. Destroy the infrastructure with Terraform from your IaC repo, per environment. This removes the cluster, application database, secret store, DNS, and certificates — and is where ongoing compute/database billing stops:

   terraform workspace select prod
   terraform plan -destroy    # review carefully — this is irreversible
   terraform destroy

   Review the destroy plan

   terraform plan -destroy lists every resource that will be deleted, including the database and any buckets. Read it in full before confirming. If a resource has deletion protection or a retained snapshot, Terraform will tell you — resolve those deliberately, don’t force past them.

7. Delete the container-registry repositories if you want the images removed (optional; they incur only storage cost):

   aws ecr delete-repository --repository-name aws-iac-nexa-databricks-api --force --region <region>
   # repeat per service repository

8. Remove the Terraform state backend last. Once destroy has completed for all environments, delete the state bucket and lock table if you no longer need the history. Keep it until you are certain nothing else references it.

Confirm nothing is left and billing has stopped

1. Kubernetes: the cluster is gone, or kubectl get all -A | grep nexa returns nothing.

2. Terraform: terraform state list returns empty for each destroyed workspace.

3. Cloud console: verify no lingering EKS/AKS cluster, node groups, load balancers, database instances, buckets, or DNS records remain — orphaned load balancers and unattached volumes are the usual sources of surprise charges.

4. Billing: check the cloud billing/cost view after 24 hours; the Nexa-tagged resources should show no new usage. Snowflake/Databricks billing is on your separate warehouse account and stops only when you pause or drop that warehouse.

Related

Operations GuideBackup and restore procedures to run before teardown.

Deployment modelWhat DataReadyAI ships vs. what lives in your cloud.