Uninstallation

1. Configure kubectl and uninstall the Helm release

Configure kubectl for the cluster where AI Gateway is installed:

• AWS
• Azure

aws eks update-kubeconfig \
  --region {{AWS_REGION}} \
  --name {{CLUSTER_NAME}}

az aks get-credentials \
  --resource-group "{{RESOURCE_GROUP}}" \
  --name "{{CLUSTER_NAME}}"

Verify that the current context points to the intended cluster:

kubectl config current-context
kubectl get nodes

Remove the AI Gateway Helm release and all bundled sub-charts from the cluster:

helm uninstall federated-guardrails -n federated-guardrails

Optionally, delete the namespace after the Helm release is removed:

kubectl delete namespace federated-guardrails

2. Wait for AWS Karpenter to remove provisioned nodes

This step applies only to AWS deployments. Uninstalling the Helm release removes the gateway workloads, but the nodes that Karpenter provisioned for them still exist as NodeClaim resources. Karpenter must terminate these nodes and delete their NodeClaim resources before you destroy the NodePool and EC2NodeClass with OpenTofu. Azure deployments do not use this AWS Karpenter cleanup step.

Important: If you run tofu destroy while NodeClaim resources still exist, Karpenter can no longer reconcile them. This can orphan the backing cloud instances and leave NodeClaim resources stuck on finalizers, requiring manual cleanup.

1. Delete the NodeClaim resources provisioned for AI Gateway so Karpenter drains and terminates the backing nodes:

kubectl delete nodeclaims -l federated-guardrails.protegrity.com/deployment=true

2. Wait until no matching NodeClaim resources remain:

kubectl wait --for=delete nodeclaims -l federated-guardrails.protegrity.com/deployment=true --timeout=10m

Alternatively, confirm manually that the following command returns No resources found:

kubectl get nodeclaims -l federated-guardrails.protegrity.com/deployment=true

Proceed to the next step only after all matching NodeClaim resources are deleted.

3. Destroy OpenTofu infrastructure

Run tofu destroy from the same directory that contains the main.tf and OpenTofu state used during installation. Use the same variable values as the installation.

• AWS
• Azure

tofu destroy \
  -var="cluster_name={{CLUSTER_NAME}}" \
  -var="environment=production" \

az login
az account set --subscription "{{SUBSCRIPTION_ID}}"
export ARM_SUBSCRIPTION_ID="{{SUBSCRIPTION_ID}}"

tofu destroy \
  -var="cluster_name={{CLUSTER_NAME}}" \
  -var="resource_group_name={{RESOURCE_GROUP}}"

Review the destroy plan before approving the operation. By default, tofu destroy prompts for confirmation before deleting resources. Add -auto-approve to skip the prompt.