Persistent data
When uninstalling OpsChain using the helm uninstall command, some persistent data will remain in your Kubernetes cluster to make a recovery easier. This data can be deleted manually if desired. These resources may contain secrets or data that you wish to capture before proceeding with the uninstallation. Once you are satisfied that you have captured the necessary data, you can delete these resources.
Removing all persistent data
You can remove all persistent data by deleting the namespace:
kubectl delete namespace ${KUBERNETES_NAMESPACE}
This command will remove all resources in the namespace, making the steps below no longer necessary.
Secrets
The following Kubernetes secrets are also not removed during the uninstallation process and contain the configuration to access the OpsChain secret vault, database credentials and/or secure information used to build and run your OpsChain actions:
| Secret name | Description |
|---|---|
opschain-vault-config | Contains the connection configuration for the OpsChain secret vault. The root token of the OpsChain secret vault is not kept here: it is stored, encrypted, in the OpsChain database. |
opschain-secret-vault-seal-key | If OpsChain was configured to use the OpsChain secret vault, the unseal key for the vault will be contained in this secret. This is required to unseal the vault prior to accessing the vaults contents using the vault token. |
opschain-build-env | This secret contains environment variables supplied to the OpsChain runner image build. |
opschain-runner-env | This secret contains environment variables supplied to the OpsChain runner when executing actions. |
opschain-db-credentials | This secret contains the credentials to access the OpsChain database. |
opschain-secret-env | This secret contains the encryption keys and passwords from the env section of your values.yaml. |
opschain-mintmodel-api-token | This secret contains the token the OpsChain API uses to call the MintModel API. |
mintpress-transportable-key | This secret contains the MintPress transportable key that encrypts your properties, settings and secrets. If you reinstall OpsChain in the same namespace, it reuses this key, so the data you restore stays readable. |
If you reinstall OpsChain in the same namespace without removing them, use the same release name, secretVault.unsealKey, PGPASSWORD and encryption keys as before. The install fails otherwise.
If you'd like to also remove these secrets, you can do so by running the following command:
kubectl -n ${KUBERNETES_NAMESPACE} delete secret opschain-vault-config opschain-secret-vault-seal-key opschain-build-env opschain-runner-env opschain-db-credentials opschain-secret-env opschain-mintmodel-api-token mintpress-transportable-key
Persistent volumes
If you enabled automated database backups, the opschain-db-backup persistent volume claim is deliberately retained on uninstall so that your database backups are not lost. It is also preserved when a cluster changes role during failover or failback.
If you have captured your backups elsewhere and want to remove the volume, delete the claim:
kubectl -n ${KUBERNETES_NAMESPACE} delete pvc opschain-db-backup
Deleting this volume permanently removes every database backup stored on it. Make sure you have copied any backups you need to a safe location first.