Uninstall
If you no longer need your Gloo Gateway environment, you can uninstall Gloo Gateway components, such as the control plane, agent, gateway proxies, and sample apps.
- Uninstall Gloo Gateway in a single-cluster setup
- Uninstall Gloo Gateway in a multicluster setup
Single-cluster setups
-
Uninstall the Istio control plane and gateway proxies. Note: For demo installations, skip to the next step.
- Delete the
GatewayLifecycleManager
resource for the gateway proxy.kubectl delete GatewayLifecycleManager istio-ingressgateway -n gloo-mesh
- Verify that the gateway resources are removed before you proceed to the next step.
kubectl get all -n gloo-mesh-gateways
- Delete the
IstioLifecycleManager
for theistiod
control plane. Note that your resource might be namedgloo-mesh-enterprise
if you migrated from the legacy Helm charts, oristiod-control-plane
if you manually created the IstioLifecycleManager resource.kubectl delete IstioLifecycleManager gloo-platform -n gloo-mesh
- Verify that the Istio resources are removed before you proceed to the next step.
# Change the revision as needed kubectl get all -n gm-iop-1-19-3 kubectl get all -n istio-system
- Delete the Istio namespaces.
kubectl delete ns istio-system kubectl delete ns gloo-mesh-gateways
-
Find the name of your Istio Helm chart release in the
gloo-mesh-gateways
namespace, such asistio-ingressgateway-1-19-3
.helm ls -n gloo-mesh-gateways
-
Delete the Helm release for the ingress gateway.
helm delete istio-ingressgateway-1-19-3 -n gloo-mesh-gateways
-
Find the name of your Istio Helm chart release in the
istio-system
namespace, such asistiod-1-19-3
.helm ls -n istio-system
-
Delete the Helm release for the
istiod
control plane.helm delete istiod-1-19-3 -n istio-system
-
Delete the Istio namespaces.
kubectl delete ns istio-system kubectl delete ns gloo-mesh-gateways kubectl delete ns istio-config
- Delete the
-
Uninstall Gloo Gateway.
meshctl uninstall --purge
Note: If you see a warning such as
release gloo-platform does not exist, nothing to uninstall
, use the Helm tab instead.- Uninstall the main Gloo Gateway release.
meshctl uninstall
- Uninstall the Gloo Gateway CRDs Helm release.
helm uninstall gloo-platform-crds -n gloo-mesh
Note: If you see a warning such as
release gloo-platform does not exist, nothing to uninstall
, use the Helm tab instead.- Delete the KubernetesCluster resource from the cluster.
kubectl delete kubernetescluster $CLUSTER_NAME -n gloo-mesh
- Uninstall the main Gloo Gateway release. Note that if you migrated from the legacy Helm charts, your Helm release might be named
gloo-mgmt
orgloo-mesh-enterprise
instead.helm uninstall gloo-platform -n gloo-mesh
- If you maintained a separate
gloo-agent-addons
Helm release, uninstall the release.helm uninstall gloo-agent-addons -n gloo-mesh-addons
- Uninstall the Gloo Gateway CRDs Helm release.
helm uninstall gloo-platform-crds -n gloo-mesh
- Uninstall the main Gloo Gateway release.
-
Delete the
gloo-mesh
andgloo-mesh-addons
namespaces.kubectl delete namespace gloo-mesh kubectl delete namespace gloo-mesh-addons
-
Optional: If you installed the Bookinfo and httpbin sample apps, run the following commands to uninstall their resources.
-
Export the Istio version that your cluster runs as an environment variable, such as 1.19.3 in the following example.
export ISTIO_VERSION=1.19.3
-
Remove the Bookinfo application components and service accounts.
kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)' kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account'
-
Delete the
bookinfo
namespace.kubectl delete ns bookinfo
-
Remove the httpbin application components.
kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml
-
Delete the
httpbin
namespace.kubectl delete ns httpbin
-
-
OpenShift installations: Revoke the extra permissions and resources required for OpenShift to run Istio.
- Revoke the Istio namespace ID permissions for the Istio service accounts.
oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways # Update revision as needed oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gm-iop-1-19-3
- Revoke the Istio namespace ID permissions for sample app project service accounts.
oc adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo oc adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-addons
- Delete the NetworkAttachmentDefinition resources and the Istio namespace ID permissions for your workload projects.
oc adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
oc delete network-attachment-definition istio-cni -n <workload_projects>
- Revoke the Istio namespace ID permissions for the Istio service accounts.
Multicluster setups
-
Save the names of your clusters from your infrastructure provider as environment variables.
export REMOTE_CLUSTER1=cluster1 export REMOTE_CLUSTER2=cluster2 ...
-
Save the kubeconfig contexts for your clusters as environment variables. Run
kubectl config get-contexts
, look for your cluster in theCLUSTER
column, and get the context name in theNAME
column.export MGMT_CONTEXT=<management-cluster-context> export REMOTE_CONTEXT1=<remote-cluster1-context> export REMOTE_CONTEXT2=<remote-cluster2-context> ...
-
Uninstall the Istio control plane and gateway proxies. These steps differ depending on how you installed them.
- Delete the
GatewayLifecycleManager
resources for the gateway proxies.kubectl delete GatewayLifecycleManager istio-ingressgateway -n gloo-mesh --context $MGMT_CONTEXT kubectl delete GatewayLifecycleManager istio-eastwestgateway -n gloo-mesh --context $MGMT_CONTEXT
- Verify that the gateway resources are removed before you proceed to the next step.
kubectl get all -n gloo-mesh-gateways --context $REMOTE_CONTEXT1 kubectl get all -n gloo-mesh-gateways --context $REMOTE_CONTEXT2
- Delete the
IstioLifecycleManager
for theistiod
control plane. Note that your resource might be namedgloo-mesh-enterprise
if you migrated from the legacy Helm charts, oristiod-control-plane
if you manually created the IstioLifecycleManager resource.kubectl delete IstioLifecycleManager gloo-platform -n gloo-mesh --context $MGMT_CONTEXT
- Verify that the Istio resources are removed before you proceed to the next step.
# Change the revision as needed kubectl get all -n gm-iop-1-19-3 --context $REMOTE_CONTEXT1 kubectl get all -n istio-system --context $REMOTE_CONTEXT1
- Delete the Istio namespaces from the workload clusters.
kubectl delete ns istio-system --context $REMOTE_CONTEXT1 kubectl delete ns gloo-mesh-gateways --context $REMOTE_CONTEXT1
kubectl delete ns istio-system --context $REMOTE_CONTEXT2 kubectl delete ns gloo-mesh-gateways --context $REMOTE_CONTEXT2
-
Find the name of your Istio Helm chart releases in the
gloo-mesh-gateways
namespace, such asistio-ingressgateway-1-19-3
andistio-eastwestgateway-1-19-3
.helm ls -n gloo-mesh-gateways
-
Delete the Helm release for the ingress and east-west gateways.
helm delete istio-ingressgateway-1-19-3 -n gloo-mesh-gateways helm delete istio-eastwestgateway-1-19-3 -n gloo-mesh-gateways
-
Find the name of your Istio Helm chart release in the
istio-system
namespace, such asistiod-1-19-3
.helm ls -n istio-system
-
Delete the Helm release for the
istiod
control plane.helm delete istiod-1-19-3 -n istio-system
-
Delete the Istio namespaces.
kubectl delete ns istio-system --context $REMOTE_CONTEXT1 kubectl delete ns gloo-mesh-gateways --context $REMOTE_CONTEXT1 kubectl delete ns istio-config --context $REMOTE_CONTEXT1
kubectl delete ns istio-system --context $REMOTE_CONTEXT2 kubectl delete ns gloo-mesh-gateways --context $REMOTE_CONTEXT2 kubectl delete ns istio-config --context $REMOTE_CONTEXT2
- Delete the
-
OpenShift installations: Revoke the extra permissions and resources required for OpenShift to run Istio.
- Revoke the Istio namespace ID permissions for the Istio service accounts.
oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT1 oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways --context $REMOTE_CONTEXT1 # Update revision as needed oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gm-iop-1-19-3 --context $REMOTE_CONTEXT1
oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT2 oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways --context $REMOTE_CONTEXT2 # Update revision as needed oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gm-iop-1-19-3 --context $REMOTE_CONTEXT2
- Revoke the Istio namespace ID permissions for sample app project service accounts.
oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-addons
oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-addons
- Delete the NetworkAttachmentDefinition resources and the Istio namespace ID permissions for your workload projects.
oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects> oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
oc --context $REMOTE_CONTEXT1 delete network-attachment-definition istio-cni -n <workload_projects> oc --context $REMOTE_CONTEXT2 delete network-attachment-definition istio-cni -n <workload_projects>
- Revoke the Istio namespace ID permissions for the Istio service accounts.
-
Uninstall the Gloo agent that runs on each workload cluster.
- Deregister
cluster1
.meshctl cluster deregister \ --kubecontext $MGMT_CONTEXT \ --remote-context $REMOTE_CONTEXT1 \ $REMOTE_CLUSTER1
Example output:
Deregistering cluster: cluster1 Finished uninstalling release gloo-mesh-agent Successfully deregistered cluster: cluster1
- Deregister
cluster2
.meshctl cluster deregister \ --kubecontext $MGMT_CONTEXT \ --remote-context $REMOTE_CONTEXT2 \ $REMOTE_CLUSTER2
- If you maintained a separate
gloo-agent-addons
Helm release, uninstall the release.helm uninstall gloo-agent-addons -n gloo-mesh-addons --kube-context $REMOTE_CONTEXT1 helm uninstall gloo-agent-addons -n gloo-mesh-addons --kube-context $REMOTE_CONTEXT2
- Uninstall the agent Helm releases. Note that if you migrated from the legacy Helm charts, your Helm releases might be named
gloo-agent
orgloo-mesh-agent
instead.helm uninstall gloo-platform -n gloo-mesh --kube-context $REMOTE_CONTEXT1 helm uninstall gloo-platform -n gloo-mesh --kube-context $REMOTE_CONTEXT2
- Delete the corresponding KubernetesCluster resources from the management cluster.
kubectl delete kubernetescluster $REMOTE_CLUSTER1 $REMOTE_CLUSTER2 -n gloo-mesh --context $MGMT_CONTEXT
- Delete the relay secrets from each workload cluster, as you cannot reuse the same secret if you decide to re-register the agent later.
kubectl delete secret -n gloo-mesh relay-client-tls-secret --context $REMOTE_CONTEXT1 kubectl delete secret -n gloo-mesh relay-identity-token-secret --context $REMOTE_CONTEXT1 kubectl delete secret -n gloo-mesh relay-root-tls-secret --context $REMOTE_CONTEXT1
kubectl delete secret -n gloo-mesh relay-client-tls-secret --context $REMOTE_CONTEXT2 kubectl delete secret -n gloo-mesh relay-identity-token-secret --context $REMOTE_CONTEXT2 kubectl delete secret -n gloo-mesh relay-root-tls-secret --context $REMOTE_CONTEXT2
- Deregister
-
Uninstall the Gloo Gateway CRDs Helm releases in each workload cluster.
helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT1 helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT2
-
Delete the
gloo-mesh
andgloo-mesh-addons
namespaces from each workload cluster.kubectl --context $REMOTE_CONTEXT1 delete namespace gloo-mesh kubectl --context $REMOTE_CONTEXT1 delete namespace gloo-mesh-addons kubectl --context $REMOTE_CONTEXT2 delete namespace gloo-mesh kubectl --context $REMOTE_CONTEXT2 delete namespace gloo-mesh-addons
-
Repeat steps 3 - 7 for any other cluster that is registered with Gloo Gateway.
-
Uninstall the Gloo Gateway control plane components.
meshctl uninstall --kubecontext $MGMT_CONTEXT
Note: If you see a warning such as
release gloo-platform does not exist, nothing to uninstall
, use the Helm tab instead.Note that if you migrated from the legacy Helm charts, your Helm release might be named
gloo-mgmt
orgloo-mesh-enterprise
instead.helm uninstall gloo-platform -n gloo-mesh --kube-context $MGMT_CONTEXT
-
Uninstall the Gloo Gateway CRDs Helm release from the management cluster.
helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $MGMT_CONTEXT
-
Delete the
gloo-mesh
namespace.kubectl --context $MGMT_CONTEXT delete namespace gloo-mesh
-
Optional: If you installed the Bookinfo and httpbin sample apps, run the following commands to uninstall their resources.
-
Export the Istio version that your cluster runs as an environment variable, such as 1.19.3 in the following example.
export ISTIO_VERSION=1.19.3
-
Remove the Bookinfo application components and service accounts.
kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)' --context $REMOTE_CONTEXT1 kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)' --context $REMOTE_CONTEXT2 kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account' --context $REMOTE_CONTEXT1 kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account' --context $REMOTE_CONTEXT2
-
Delete the
bookinfo
namespace.kubectl delete ns bookinfo --context $REMOTE_CONTEXT1 kubectl delete ns bookinfo --context $REMOTE_CONTEXT2
-
Remove the httpbin application components.
kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT1 kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT2
-
Delete the
httpbin
namespace.kubectl delete ns httpbin --context $REMOTE_CONTEXT1 kubectl delete ns httpbin --context $REMOTE_CONTEXT2
-