Undeploy the Universal Forwarder Helm chart

Remove a Universal Forwarder Helm release and, optionally, delete its retained PersistentVolumeClaims or namespace.

Remove a Universal Forwarder Helm release. In durable mode, Helm deletes the release's PersistentVolumeClaims automatically. Verify that the deletion completed, or delete the namespace entirely, as part of cleanup.

  1. Remove the release.
    CODE
    helm uninstall my-uf --namespace my-namespace

    In stateless mode (storage.emptyDir: true, the default), no PVCs exist, so the uninstall is clean. In durable mode (storage.emptyDir: false), Helm deletes both PVCs during uninstall. A claim can remain in Terminating state until its volume is no longer mounted. The StorageClass reclaim policy independently controls whether the bound PersistentVolume and underlying storage are deleted or retained.

  2. In durable mode, verify that the PVCs finished deleting.
    CODE
    kubectl wait --for=delete \
      pvc/my-uf-splunk-universalforwarder-etc \
      pvc/my-uf-splunk-universalforwarder-var \
      --timeout=10m \
      --namespace my-namespace
    Note: PVC names follow the pattern release-name-splunk-universalforwarder-etc and -var. If you used a custom fullnameOverride, substitute that name. With a Retain reclaim policy, inspect and clean up the released PersistentVolume and underlying storage separately when they're no longer needed.

To remove everything including the namespace:

CODE
kubectl delete namespace my-namespace

This removes all resources including PVCs.