Skip to main content
You have two ways to take an executor out of service. Revoke its API key is a quick, reversible cut: the executor can no longer reach Novacula and goes offline, but its row and history stay. Delete the executor is permanent and only works once the executor hosts no nodes. When in doubt, revoke the key. You can always issue a new one. A deleted executor is gone for good. Deactivated executors are hidden by default in the Executors list so the view stays focused on what’s in service. Turn on the explicit filter to show them again.

​
Before you start

  • You need the owner or admin role.
  • To delete an executor, first delete every node it hosts.

​
Revoke the API key

Use this when you want the executor to stop reaching Novacula right away — a compromised host, a colo you’re shutting down — without losing the executor or its history.
1

Open API keys

In the sidebar, open API keys.
2

Find the key

Locate the key the executor uses. The last used column helps you match it to the right executor.
3

Revoke it

Open the key’s menu and choose Revoke. Its status changes to Revoked.
What happens next:
  • The executor immediately reads as deactivated — it has no active credential, which is a different thing from an executor that merely stopped checking in. It’s hidden from the Executors list by default; turn on the explicit filter to see it.
  • It can no longer reach Novacula, and its next sync attempt is refused.
  • Its nodes stay in Novacula in their last reported state. They show as unreachable; any lifecycle action you queue applies only once the executor reconnects.
  • The processes on the host keep running — the executor doesn’t stop just because it can’t reach Novacula.
To bring the executor back later, issue a new key from API keys and apply it on the host. See Update an executor key for the no-downtime swap.

​
Delete the executor

Use this when you’re decommissioning the host for good.

​
1. Drain its nodes

You can’t delete an executor that still hosts nodes. For each node, stop it, then delete it — see the node lifecycle. Deleting a node removes its data, and there’s no automatic transfer to another executor. If you need to keep the data, copy the node’s data directory off the host before you delete it.

​
2. Delete the row

Open Executors, select the executor, and choose Delete. The row is removed and the name frees up — you can reuse it for a new executor. The API key tied to the executor is revoked at the same time.

​
3. Clean up your infrastructure

Novacula can’t reach into your infrastructure — the executor’s daemon and the node processes keep running until you remove them yourself.
Remove the nodes before the executor. Draining them in step 1 already does this. If you remove the operator first, its BlockchainNode objects get stuck Terminating — nothing is left to drop their novacula.io/blockchainnode-cleanup finalizer.

​
Agent (bare metal / VM)

Run on the host as root. The agent’s built-in uninstall removes only its own daemon — the per-node units, data directory, and firewall table survive it, so remove those too.
1

Stop the per-node units

They keep running after the agent is gone. List them, then disable and remove the unit files:
2

Remove the agent, its firewall table, and its files

3

Verify it's clean

Each command should return nothing (or “not found”):
If the agent fronted RPC with a managed Caddy, its Caddy config and sites for those nodes may remain — remove them separately.

​
Operator (Kubernetes)

The CRD and per-node resources outlive a plain helm uninstall, so clean up in order.
1

Delete the nodes

Do this while the operator is still running — its finalizer tears down each node’s StatefulSet, PVC, Service, Ingress, and NetworkPolicy:
2

Remove the operator release

Removes the Deployment, ServiceAccount, RBAC, Secret, and Service:
3

Delete the CRD

The operator created it itself, so Helm never managed it:
4

Verify it's clean

Each should return empty; optionally drop the namespace too:
Stuck in Terminating? If the operator was removed before its nodes, clear the finalizer by hand:
Node PVCs are deleted with the StatefulSet (persistentVolumeClaimRetentionPolicy.whenDeleted: Delete); if a PV uses the Retain reclaim policy, delete the released PVs separately.
Neither uninstall nor helm uninstall revokes the executor’s API key or notifies Novacula — deleting the executor row (step 2) is what revokes the key. For the full install/uninstall walkthrough, see the bare metal or Kubernetes recipe.