Uninstalling Instana Custom Edition manually

You can manually uninstall IBM Instana Custom Edition from a Kubernetes or Red Hat OpenShift environment by removing custom resources, operators, data stores, and associated namespaces in reverse installation order.

Before you begin the uninstallation, ensure that the following prerequisites are met:

Cluster administrator privileges are available.
Any required monitoring data has been backed up.
Instana agents are stopped or disconnected from the backend.
Custom configuration files, certificates, and license information are exported if they will be reused.
A maintenance window is approved, if applicable.

This procedure applies to deployments that were installed manually using the Instana Enterprise Operator, Core, and Unit custom resources. The uninstallation process follows the reverse order of the installation sequence to ensure that all dependent resources are removed cleanly and to prevent orphaned Kubernetes objects.

The steps must be completed in the following order:

Remove Unit custom resources
Remove the Core custom resource
Remove the Instana Enterprise Operator
Remove data store components
Uninstall cert-manager
Delete Instana CRDs
Delete SCCs (Red Hat OpenShift only)
Delete cluster roles, cluster role bindings, and webhook configurations

From your terminal, verify the existing Unit resources in the instana-units namespace.
Unit resources represent tenant-specific Instana services and depend on the Core resource. Unit resources must be removed before you delete the Core.
```
kubectl get units -n instana-units
```
Example output:
```
NAME              VERSION   INSTANA VERSION   DB MIGRATION STATUS   COMPONENTS STATUS
tenant0-unit0     1.2.0     3.289.589-0       Ready                 Ready
```

Delete the Unit resources.

To delete a Unit resource by name, run:

kubectl delete unit <unit-name> -n instana-units

To delete a Unit resource using a configuration file, run:
```
kubectl delete -f path/to/unit.yaml
```

unit.instana.io "tenant0-unit0" deleted from instana-units namespace

Verify that all Unit resources are removed.
```
kubectl get units -n instana-units
```
The command returns No resources found.

List the secrets in the instana-units namespace.

kubectl get secrets -n instana-units

Example output:

instana-registry    kubernetes.io/dockerconfigjson   1      5h23m
tenant0-unit0       Opaque                           1      3h31m

Delete the instana-registry and tenant0-unit0 secrets.

kubectl delete secret instana-registry tenant0-unit0 -n instana-units

Delete the instana-units namespace.

kubectl delete namespace instana-units

namespace "instana-units" deleted

Verify the existing Core resources in the instana-core namespace.
The Core resource provides the shared backend services used by all Units.
```
kubectl get core -n instana-core
```
Example output:
```
instana-core   1.2.0     3.289.589-0       Ready                 Ready
```
Delete the Core resource by using one of the following methods.
- Delete the Core resource by name:
```
kubectl delete core <core-name> -n instana-core
```
- Delete the Core resource by using a configuration file:
```
kubectl delete -f path/to/core.yaml
```
```
core.instana.io "instana-core" deleted from instana-core namespace
```
Verify that the Core resource is removed.
```
kubectl get core -n instana-core
```
The command returns No resources found. Wait until all Core-related pods and services are terminated before proceeding.

List the secrets in the instana-core namespace.

kubectl get secrets -n instana-core

Example output:

instana-core       Opaque                           1      3h42m
instana-registry   kubernetes.io/dockerconfigjson   1      5h34m
instana-tls        kubernetes.io/tls                2      4h1m

Delete the instana-registry, instana-core, and instana-tls secrets.

kubectl delete secret instana-registry instana-core instana-tls -n instana-core

Optional: If your deployment is on a Red Hat OpenShift cluster, delete the routes in the instana-core namespace.

Run the following command to list the routes:

oc get routes -n instana-core

Example output:

NAME          HOST/PORT                              PATH   SERVICES   PORT    TERMINATION   WILDCARD
acceptor      acceptor                                      acceptor   8443    passthrough   None
base-domain   base-domain.instana.fyre.ibm.com               gateway    https   passthrough   None

Delete the routes by specifying each route name:

oc delete route <route-name-1> <route-name-2> -n instana-core

Example:

oc delete route acceptor base-domain opamp-acceptor otlp-grpc-acceptor otlp-http-acceptor unit0-tenant0-ui -n instana-core

Delete the instana-core namespace.
```
kubectl delete namespace instana-core
```

Verify the operator deployments in the instana-operator namespace.

The Enterprise Operator manages the lifecycle of Instana Core and Unit resources. After those resources are deleted, the operator can be safely removed.

kubectl get deployments -n instana-operator

Example output:

NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
instana-operator           1/1     1            1           5h44m
instana-operator-webhook   1/1     1            1           5h44m

Delete the operator deployments.

kubectl delete deployment instana-operator -n instana-operator
kubectl delete deployment instana-operator-webhook -n instana-operator

List the services in the instana-operator namespace.

kubectl get svc -n instana-operator

Example output:

NAME                       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
instana-operator-webhook   ClusterIP   172.30.115.218   <none>        443/TCP   5h46m

Delete the instana-operator-webhook service.

kubectl delete svc instana-operator-webhook -n instana-operator

Verify that all resources in the instana-operator namespace are removed.
```
kubectl get all -n instana-operator
```
The command returns No resources found. Wait until all operator and webhook pods are terminated before proceeding.

Delete the instana-registry secret from the instana-operator namespace.

kubectl get secrets -n instana-operator

Example output:

instana-registry   kubernetes.io/dockerconfigjson   1      5h55m

kubectl delete secret instana-registry -n instana-operator

Delete the instana-operator namespace.

kubectl delete namespace instana-operator

Remove the data store components depending on the deployment architecture.

Instana Custom Edition relies on several backend data store services. Remove these components only after the Core and Unit resources are deleted.

Remove Beeinstana and the Beeinstana operator.

Replace /path/to/configuration/file.yaml with the path to the configuration file that you used to deploy Beeinstana.

kubectl delete -f /path/to/configuration/file.yaml -n beeinstana

After Beeinstana pods are deleted, uninstall the Beeinstana operator:

helm uninstall beeinstana -n beeinstana

Wait until all Beeinstana and Beeinstana operator pods are terminated. Then, delete the secrets:

kubectl get secrets -n beeinstana

Example output:

beeinstana-admin-creds     Opaque                           2      31h
beeinstana-cas             Opaque                           0      31h
beeinstana-kafka-creds     Opaque                           2      30h
instana-registry           kubernetes.io/dockerconfigjson   1      31h

kubectl delete secret instana-registry beeinstana-admin-creds beeinstana-kafka-creds beeinstana-cas -n beeinstana

Delete the persistent volume claims (PVCs) and the namespace:

kubectl get pvc -n beeinstana
kubectl delete pvc --all -n beeinstana
kubectl delete namespace beeinstana

Remove ClickHouse, ClickHouse Keeper, and the ClickHouse operator.

kubectl delete -f clickhouse_installation.yaml -n instana-clickhouse

After ClickHouse pods are deleted, uninstall ClickHouse Keeper:

kubectl delete -f clickhouse_keeper.yaml -n instana-clickhouse

After both ClickHouse and ClickHouse Keeper are deleted, uninstall the ClickHouse operator:

helm uninstall clickhouse-operator -n instana-clickhouse

Wait until all pods are terminated. Then, delete the instana-registry secret, PVCs, and the namespace:

kubectl delete secret instana-registry -n instana-clickhouse
kubectl get pvc -n instana-clickhouse
kubectl delete pvc --all -n instana-clickhouse
kubectl delete namespace instana-clickhouse

Remove Cassandra and the cass-operator.

kubectl delete -f cassandra.yaml -n instana-cassandra

After Cassandra pods are deleted, uninstall the cass-operator:

helm uninstall cass-operator -n instana-cassandra

Wait until all pods are terminated. Then, delete the secrets, PVCs, and the namespace:

kubectl delete secret instana-registry instana-superuser -n instana-cassandra
kubectl get pvc -n instana-cassandra
kubectl delete pvc --all -n instana-cassandra
kubectl delete namespace instana-cassandra

Remove PostgreSQL and the CNPG operator.

kubectl delete -f postgres.yaml -n instana-postgres

After PostgreSQL pods are deleted, uninstall the CNPG operator:

helm uninstall cnpg -n instana-postgres

Wait until all pods are terminated. Then, delete the secrets, PVCs, and the namespace:

kubectl delete secret instana-registry instanaadmin -n instana-postgres
kubectl get pvc -n instana-postgres
kubectl delete pvc --all -n instana-postgres
kubectl delete namespace instana-postgres

Remove Kafka, the Kafka controller, and the Strimzi operator.

Delete the Kafka data store:

kubectl delete -f kafka.yaml -n instana-kafka

Delete the Kafka controller:

kubectl delete -f kafka-controller.yaml -n instana-kafka

Delete the Kafka user:

kubectl delete -f strimzi-kafka-user.yaml -n instana-kafka

After all Kafka and controller pods are deleted, uninstall the Strimzi operator:

helm uninstall strimzi-kafka-operator -n instana-kafka

Wait until all pods are terminated. Then, delete the secrets, PVCs, and the namespace:

kubectl delete secret instana-registry -n instana-kafka
kubectl get pvc -n instana-kafka
kubectl delete pvc --all -n instana-kafka
kubectl delete namespace instana-kafka

Remove Elasticsearch and the Elastic operator.

kubectl delete -f elastic.yaml -n instana-elastic

After Elasticsearch pods are deleted, uninstall the Elastic operator:

helm uninstall elastic-operator -n instana-elastic

Wait until all pods are terminated. Then, delete the secrets, PVCs, and the namespace:

kubectl delete secret instana-registry -n instana-elastic
kubectl get pvc -n instana-elastic
kubectl delete pvc --all -n instana-elastic
kubectl delete namespace instana-elastic

Verify that all data store namespaces are removed.
```
kubectl get ns
```
Confirm that all data store pods and namespaces are absent from the output.
Uninstall cert-manager by deleting its components and namespace.
```
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml
```
Wait until all resources and the cert-manager namespace are deleted before proceeding.

Delete the Instana Core and Unit custom resource definitions (CRDs).

Verify that the Instana CRDs exist:

kubectl get crd | grep instana

Example output:

cores.instana.io    2026-06-25T06:11:47Z
units.instana.io    2026-06-25T06:11:47Z

Delete the CRDs:

kubectl delete crd cores.instana.io units.instana.io

Delete the data store-related CRDs.

List the CRDs associated with the data stores:

kubectl get crd --show-labels | grep -E 'cassandra|cnpg|kafka|strimzi|clickhouse|elastic|postgres|beeinstana'

Delete the listed CRDs. The following example shows all expected CRDs:

kubectl delete crd \
  agents.agent.k8s.elastic.co \
  apmservers.apm.k8s.elastic.co \
  autoopsagentpolicies.autoops.k8s.elastic.co \
  backups.postgresql.cnpg.io \
  beats.beat.k8s.elastic.co \
  cassandradatacenters.cassandra.datastax.com \
  cassandratasks.control.k8ssandra.io \
  clickhouseinstallations.clickhouse.altinity.com \
  clickhouseinstallationtemplates.clickhouse.altinity.com \
  clickhousekeeperinstallations.clickhouse-keeper.altinity.com \
  clickhouseoperatorconfigurations.clickhouse.altinity.com \
  clusterimagecatalogs.postgresql.cnpg.io \
  clusters.postgresql.cnpg.io \
  databases.postgresql.cnpg.io \
  elasticmapsservers.maps.k8s.elastic.co \
  elasticsearchautoscalers.autoscaling.k8s.elastic.co \
  elasticsearches.elasticsearch.k8s.elastic.co \
  enterprisesearches.enterprisesearch.k8s.elastic.co \
  failoverquorums.postgresql.cnpg.io \
  imagecatalogs.postgresql.cnpg.io \
  kafkabridges.kafka.strimzi.io \
  kafkaconnectors.kafka.strimzi.io \
  kafkaconnects.kafka.strimzi.io \
  kafkamirrormaker2s.kafka.strimzi.io \
  kafkanodepools.kafka.strimzi.io \
  kafkarebalances.kafka.strimzi.io \
  kafkas.kafka.strimzi.io \
  kafkatopics.kafka.strimzi.io \
  kafkausers.kafka.strimzi.io \
  kibanas.kibana.k8s.elastic.co \
  logstashes.logstash.k8s.elastic.co \
  packageregistries.packageregistry.k8s.elastic.co \
  poolers.postgresql.cnpg.io \
  publications.postgresql.cnpg.io \
  scheduledbackups.postgresql.cnpg.io \
  stackconfigpolicies.stackconfigpolicy.k8s.elastic.co \
  subscriptions.postgresql.cnpg.io

Optional: If your deployment is on a Red Hat OpenShift cluster, delete the security context constraints (SCCs).

List the SCCs associated with Instana:

oc get scc | grep -E "cassandra|clickhouse|instana|postgres|cnpg"

Example output:

cassandra-scc    false   <no value>   RunAsAny   MustRunAs   RunAsAny   RunAsAny   <no value>   false
clickhouse-scc   false   <no value>   RunAsAny   MustRunAs   RunAsAny   RunAsAny   <no value>   false

Delete the SCCs:

oc delete scc cassandra-scc clickhouse-scc

Delete the cluster roles, cluster role bindings, and webhook configurations associated with Instana.

List the resources:

kubectl get clusterroles,clusterrolebindings,validatingwebhookconfigurations,mutatingwebhookconfigurations \
  | grep -E "instana|cassandra|kafka|cnpg|postgres|elastic|clickhouse|beeinstana"

Example output:

clusterrole.rbac.authorization.k8s.io/instana-operator                                   2026-06-25T06:11:47Z
clusterrole.rbac.authorization.k8s.io/instana-operator-webhook                           2026-06-25T06:11:47Z
clusterrolebinding.rbac.authorization.k8s.io/instana-operator                             ClusterRole/instana-operator          28h
clusterrolebinding.rbac.authorization.k8s.io/instana-operator-webhook                     ClusterRole/instana-operator-webhook  28h
validatingwebhookconfiguration.admissionregistration.k8s.io/instana-operator-webhook-validating   2   28h

Delete the listed resources:

kubectl delete \
  clusterrole/instana-operator \
  clusterrole/instana-operator-webhook \
  clusterrolebinding/instana-operator \
  clusterrolebinding/instana-operator-webhook \
  validatingwebhookconfiguration/instana-operator-webhook-validating

Custom Edition is uninstalled. All custom resources, operators, data store components, namespaces, CRDs, and RBAC resources are removed from the cluster.