---
title: Uninstall the Components and Clean Up the Cluster
slug: kronpam-how-to-guides-180/uninstall-the-components-and-clean-up-the-cluster
docTags: 
createdAt: 2026-09-02T07:50:43.123Z
---

Use this procedure to return the cluster to a clean state, for example before a fresh installation.

:::hint{type="warning"}
Before uninstalling, check whether the release owns any persistent data. In the reference environment there were no PersistentVolumeClaims or externally managed secrets, so uninstall and reinstall were non-destructive. This must be re-verified in every environment.
:::

**Step 1 — Record the current configuration**

```linux
helm list -A
helm get values kron-aapm-agent   -n ns-agent
helm get values aapm-service      -n kron-pam-aapm
helm get values kron-aapm-sidecar -n ns-sidecar
kubectl get all,pvc,secret,cm -n ns-agent
kubectl get all,pvc,secret,cm -n kron-pam-aapm
kubectl get all,pvc,secret,cm -n ns-sidecar
```

**Step 2 — Uninstall the releases (injector first)**

Uninstall in reverse order of installation, so that dependent components are removed before the Agent they rely on.

```linux
helm uninstall kron-aapm-sidecar -n ns-sidecar
helm uninstall aapm-service      -n kron-pam-aapm
helm uninstall kron-aapm-agent   -n ns-agent
```

**Step 3 — Remove leftover cluster-scoped resources**

helm uninstall normally removes these, but they must be verified: a leftover webhook configuration blocks pod creation in labeled namespaces.

```linux
kubectl get mutatingwebhookconfiguration | grep -i aapm
kubectl get clusterrole,clusterrolebinding | grep -i aapm
```

Delete any remaining objects explicitly:

```linux
kubectl delete mutatingwebhookconfiguration <name>
kubectl delete clusterrole <name>
kubectl delete clusterrolebinding <name>
```

**Step 4 — Remove namespaces, labels, and secrets**

```linux
kubectl label namespace <TARGET_NAMESPACE> aapm-injection-
kubectl delete secret aapm-client-secret -n <TARGET_NAMESPACE>
kubectl delete namespace ns-agent kron-pam-aapm ns-sidecar
```

**Step 5 - Stop background port-forwards**

```linux
pkill -f "kubectl port-forward" || true
ss -tlnp | grep -E ':8443|:8080'
```

**Step 6 — Verify the cluster is clean**

```linux
helm list -A
kubectl get ns
kubectl get mutatingwebhookconfiguration
```

**Success criteria:**&#x68;elm list -A returns empty, the three namespaces are gone, and no AAPM-related mutating webhook configuration remains.

:::hint{type="info"}
Uninstalling the Agent doesn't remove its registration from the Kron PAM console. Remove or re-use the agent entry on the Kron PAM side as well; otherwise a reinstallation using the same agentName may conflict.
:::