Uninstall Config Sync

This page shows you how to uninstall Config Sync from your cluster,disable the Config Management fleet feature on your fleet, anduninstall the ConfigManagement Operator.

This page is for IT administrators and Operators who managethe lifecycle of the underlying tech infrastructure. To learn more about commonroles and example tasks that we reference in Google Cloud content, seeCommon GKE user roles and tasks.

The Config Management fleet feature manages Config Syncusing the ConfigManagement Operator.Because of this architecture, the uninstall steps must be completed in thefollowing order:

  1. Uninstall Config Sync from your cluster
  2. Disable the Config Management feature on your fleet
  3. Uninstall the ConfigManagement Operator from your cluster
Note: If you use Config Controller to install and manage Config Sync,don't use the instructions on this page. Instead, follow the instructions inDelete your Config Controller instanceto uninstall Config Controller.

Uninstall Config Sync from your cluster

Note: Uninstalling Config Sync will delete allRootSync andRepoSyncobjects on the cluster. Before you continue, you should check the deletionpropagation policies on yourRootSync andRepoSync objects. For moreinformation, seeBulk delete objects.

Console

You can't uninstall Config Sync with only the Google Cloud console. UseGoogle Cloud CLI instead.

gcloud

  1. Open theapplySpec manifestthat you created during installation with the Google Cloud CLI.

  2. In the applySpec manifest, setspec.configSync.enabled tofalse:

    applySpecVersion:1spec:configSync:enabled:false...
  3. Apply the changes:

    gcloudbetacontainerfleetconfig-managementapply\--membership=MEMBERSHIP_NAME\--config=CONFIG_YAML\--project=PROJECT_ID

    Replace the following:

    • MEMBERSHIP_NAME: add the registered cluster that you want toapply this configuration to. If you registered the cluster in theGoogle Cloud console, the membership name is the same as the name of yourcluster.

    • CONFIG_YAML: add the path to yourapply-spec.yaml file.

    • PROJECT_ID: add your project ID.

Terraform

If you usedTerraformto install Config Sync using agke_hub_feature_membershipresource from theGoogle Cloud Platform Provider,then update that resource to uninstall Config Sync. Don't usetheterraform destroy command. Theterraform destroy command doesn't fullyuninstall Config Sync. Some components remain.

  1. Identify thegke_hub_feature_membership resource in your Terraformconfiguration files that has aconfigmanagement argument populated.

  2. Update thegke_hub_feature_membership resource to remove theconfig_sync argument from theconfigmanagement.

    For example:

    resource"google_gke_hub_feature_membership""feature_member"{location="global"feature=google_gke_hub_feature.feature.namemembership=google_gke_hub_membership.membership.membership_idmembership_location=google_gke_hub_membership.membership.locationconfigmanagement{version="1.21.0"}}
  3. Apply the Terraform configuration:

    terraformapply

    Confirm you want to apply the actions described by enteringyes.

Config Connector

If you usedConfig Connectorto install Config Sync using aGKEHubFeatureMembershipresource, then update that resource to uninstall Config Sync.

  1. Identify theGKEHubFeatureMembership resource object on your clusterthat has a.spec.configmanagement.configSync field populated.

  2. Patch theGKEHubFeatureMembership resource object to remove the.spec.configmanagement.configSync field by setting it to null:

    kubectlpatchGKEHubFeatureMembershipFEATURE_MEMBERSHIP_OBJECT_NAME\--namespaceFEATURE_MEMBERSHIP_OBJECT_NAMESPACE\-p'{"spec":{"configmanagement":{"configSync": null}}}'

    Replace the following:

    • FEATURE_MEMBERSHIP_OBJECT_NAME: add the name of theGKEHubFeatureMembership resource object that you previously created.

    • FEATURE_MEMBERSHIP_OBJECT_NAMESPACE: add the namespace thatcontains theGKEHubFeatureMembership resource object that youpreviously created.

Disable Config Management on your fleet

Note: If you still want to use Config Management on other clusters inthe Fleet, you can skip this step, but you won't be able to uninstall theConfigManagement Operator until after the Config Management feature is disabledon the fleet or the cluster is removed from the fleet.

Console

  1. In the Google Cloud console, go to theFeature Manager page.

    Go to Feature Manager

  2. In theConfig Management row of theFeatures table, clickDetails. TheStatus summary page appears.

  3. ClickDisable Config Management. A confirmation page appears.

  4. On the confirmation page, clickDisable Config Management.

gcloud

  1. To disable Config Management on all clusters in the fleet, runthe following command:

    gcloudbetacontainerfleetconfig-managementdisable
    Note: The preceding commands don't stop status reporting. If you want tostop status reporting, you need tounregister your cluster.

Terraform

If you usedTerraformto enable the Config Management feature on your fleet using agoogle_gke_hub_featureresource from the from theGoogle Cloud Platform Provider,then update that resource to disable Config Management on allclusters in the fleet.

  1. Update the HCL file that contains yourgoogle_gke_hub_featureresource to remove thegoogle_gke_hub_feature resource.

  2. If you still have agke_hub_feature_membership resource defined with afeature field that references the removedgoogle_gke_hub_feature,remove thatgke_hub_feature_membership resource too.

  3. Apply the Terraform configuration:

    terraformapply

    Confirm you want to apply the actions described by enteringyes.

Config Connector

If you usedConfig Connectorto enable the Config Management feature on your fleet using aGKEHubFeatureresource, then update that resource to disable Config Management onall clusters in the fleet.

  1. Identify theGKEHubFeature resource object on your cluster that has a.spec.resourceID value ofconfigmanagement.

  2. If you still have aGKEHubFeatureMembership resource object defined witha.spec.featureRef field that references thatGKEHubFeature resourceobject, delete it:

    kubectldeleteGKEHubFeatureMembershipFEATURE_MEMBERSHIP_OBJECT_NAME\--namespaceFEATURE_MEMBERSHIP_OBJECT_NAMESPACE

    Replace the following:

    • FEATURE_MEMBERSHIP_OBJECT_NAME: add the name of theGKEHubFeatureMembership resource object that you previously created.

    • FEATURE_MEMBERSHIP_OBJECT_NAMESPACE: add the namespace thatcontains theGKEHubFeatureMembership resource object that youpreviously created.

  3. Delete theGKEHubFeature resource from your cluster:

    kubectldeleteGKEHubFeatureFEATURE_OBJECT_NAME\--namespaceFEATURE_OBJECT_NAMESPACE

    Replace the following:

    • FEATURE_OBJECT_NAME: add the name of theGKEHubFeatureresource object that you previously created.

    • FEATURE_OBJECT_NAMESPACE: add the namespace that contains theGKEHubFeature resource object that you previously created.

Note: Disabling the Config Management feature on your fleet does notautomatically uninstall the ConfigManagement Operator from the clusters in the fleet.Proceed to the next section to uninstall the ConfigManagement Operator on each cluster.

Uninstall the ConfigManagement Operator

Usekubectl to delete the ConfigManagement Operator after you disableConfig Management feature on the fleet orunregister your clusterfrom the fleet.

To remove the ConfigManagement Operator, run the following commands:

  1. Delete the ConfigManagement object from the cluster:

    kubectldeleteconfigmanagement--all

    After you run this command, the following things happen:

    • Any ClusterRoles and ClusterRoleBindings created in the cluster byConfigManagement Operator are deleted from the cluster.
    • Any admission controller configurations installed byConfigManagement Operator are deleted.
    • The contents of theconfig-management-system namespace are deleted, with theexception of thegit-creds Secret, and for versions of Config Sync beginning in 1.9.0, theconfig-management-operator Deployment, and theconfig-management-operator Pod.ConfigManagement Operator cannot function without theconfig-management-systemnamespace. Any CustomResourceDefinitions (CRDs) created or modified byConfigManagement Operator controller are removed from the clusters wherethey were created or modified. The CRD required to runConfigManagement Operator still exists because from the point of view ofKubernetes, they were added by the user whoinstalled ConfigManagement Operator. Informationabout removing these components is covered in the next step.
  2. If you need to retain thegit-creds Secret, do that now:

    kubectl-nconfig-management-systemgetsecretgit-creds-oyaml
  3. Delete theconfig-management-system namespace:

    kubectldeletensconfig-management-system
  4. Delete theconfig-management-monitoring namespace:

    kubectldeletensconfig-management-monitoring
  5. Delete the ConfigManagement CustomResourceDefinition:

    kubectldeletecrdconfigmanagements.configmanagement.gke.io

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.