Uninstall the GitLab Helm chart

To uninstall the GitLab Helm chart, run the following command:

helm uninstall <RELEASE> -n <NAMESPACE>

Depending on your configuration and cloud provider, helm uninstall might leave orphaned resources that require manual cleanup.

Clean up orphaned Gateway API resources

If you use the bundled Envoy Gateway controller, run the following commands to clean up leftover resources:

kubectl patch gatewayclass <RELEASE>-gw \
  -p '{"metadata":{"finalizers":[]}}' --type=merge
kubectl delete secrets \
  -n <NAMESPACE> \
  -l control-plane=envoy-gateway

Clean up orphaned AWS load balancer resources

If you use the bundled NGINX Ingress on AWS, the chart creates a LoadBalancer Service. AWS provisions a load balancer and a k8s-elb-* security group for that Service. AWS also adds an inbound rule to the EKS cluster security group that references the k8s-elb-* security group.

helm uninstall deletes the NGINX Ingress controller and the LoadBalancer Service at the same time. The controller can no longer process the Service deletion, so the load balancer and the security group are left behind.

To avoid this problem, delete the LoadBalancer Service before you uninstall the chart, then wait for AWS to remove the load balancer and the security group:

kubectl delete service <RELEASE>-nginx-ingress-controller -n <NAMESPACE>

If you already uninstalled the chart, remove the orphaned resources manually:

1. Find the load balancer for the deleted Service, then delete it:

   aws elb describe-load-balancers
   aws elb delete-load-balancer --load-balancer-name <load_balancer_name>

2. Revoke the inbound rule in the EKS cluster security group that references the k8s-elb-* security group:

   aws ec2 revoke-security-group-ingress \
     --group-id <cluster_security_group_id> \
     --source-group <k8s_elb_security_group_id> \
     --protocol tcp --port <port>

3. Delete the k8s-elb-* security group:

   aws ec2 delete-security-group --group-id <k8s_elb_security_group_id>

Resources that are intentionally kept

For the purposes of continuity, these charts have some Kubernetes objects that are not removed when performing helm uninstall. These are items we require you to consciously remove them, as they affect re-deployment should you choose to.

• Gitaly PVCs, which hold your repository data.
• Secrets, if generated by our shared-secrets Job. These charts are designed to never generate Kubernetes Secrets via Helm directly. As such, Helm can’t remove them. They contain passwords, encryption secrets, and so on. They should not be callously destroyed.
• ConfigMaps
  • ingress-controller-leader-RELEASE-nginx: This is generated by the NGINX Ingress controller itself, and is outside the control of our chart. It can be safely removed.

The PVCs and Secrets have the release label set, so you can find these with:

kubectl get pvc,secret -n <NAMESPACE> -l release=<RELEASE>