If you no longer need your Gloo Mesh environment, you can deregister workload clusters and uninstall the Gloo Mesh management plane from your management cluster. You can also optionally uninstall Istio and the Bookinfo sample app.

Before you begin

Save the names and contexts of the clusters you want to uninstall Gloo Mesh Enterprise from.

  export MGMT_CLUSTER=<management-cluster>
export REMOTE_CLUSTER1=<remote-cluster1>
export REMOTE_CLUSTER2=<remote-cluster2>
  
  export MGMT_CONTEXT=<management-cluster-context>
export REMOTE_CONTEXT1=<remote-cluster1-context>
export REMOTE_CONTEXT2=<remote-cluster2-context>
  

Uninstall Istio

Uninstall Istio from each workload cluster. Note that if you used the Istio lifecycle manager, you must complete this section to uninstall Istio before you uninstall any Gloo Mesh management or agent components.

  1. Uninstall the Istio control plane and gateway proxies. These steps differ depending on how you installed them.

  2. OpenShift installations: Revoke the extra permissions and resources required for OpenShift to run Istio.

    1. Revoke the Istio namespace ID permissions for the Istio service accounts.
        oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT1
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways --context $REMOTE_CONTEXT1
      # Update revision as needed
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gm-iop-1-20 --context $REMOTE_CONTEXT1
        
        oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT2
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways --context $REMOTE_CONTEXT2
      # Update revision as needed
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gm-iop-1-20 --context $REMOTE_CONTEXT2
        
    2. Revoke the Istio namespace ID permissions for sample app project service accounts.
        oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo
      oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin
      oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:helloworld
      oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh
        
        oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:helloworld
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh
        
    3. Delete the NetworkAttachmentDefinition resources and the Istio namespace ID permissions for your workload projects.
        oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
        
        oc --context $REMOTE_CONTEXT1 delete network-attachment-definition istio-cni -n <workload_projects>
      oc --context $REMOTE_CONTEXT2 delete network-attachment-definition istio-cni -n <workload_projects>
        
  3. Repeat these steps for each cluster that was registered with Gloo Mesh and that ran an Istio service mesh.

Deregister workload clusters

Uninstall the Gloo Mesh data plane components from the workload clusters.

  1. Uninstall the Gloo agent that runs on each workload cluster.

  2. Uninstall the Gloo CRDs Helm releases in each workload cluster.

      helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT1
    helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT2
      
  3. Delete the gloo-mesh namespaces from each workload cluster.

      kubectl --context $REMOTE_CONTEXT1 delete namespace gloo-mesh
    kubectl --context $REMOTE_CONTEXT2 delete namespace gloo-mesh
      
  4. Repeat these steps for any other cluster that is registered with Gloo Mesh. For example, if you ran the management plane in a cluster that was also registered, repeat these steps for the MGMT_CLUSTER and specify the MGMT_CONTEXT. If you registered multiple workload clusters, repeat these steps for each workload cluster.

Uninstall the management plane

Uninstall the Gloo Mesh management plane components from the management cluster.

  1. Uninstall the Gloo Mesh management plane components.

  2. Uninstall the Gloo Mesh CRDs Helm release from the management cluster.

      helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $MGMT_CONTEXT
      
  3. Delete the gloo-mesh namespace, and if applicable, the gloo-mesh-config namespace.

      kubectl --context $MGMT_CONTEXT delete namespace gloo-mesh
    kubectl --context $MGMT_CONTEXT delete namespace gloo-mesh-config
      

Optional: Uninstall sample apps

If you installed the Bookinfo and httpbin sample apps, run the following commands to uninstall their resources.

  1. Export the Istio version that your cluster runs as an environment variable, such as 1.20.8-patch1 in the following example.

      export ISTIO_VERSION=1.20.8-patch1
      
  2. Remove the Bookinfo application components and service accounts.

  3. Delete the bookinfo namespace.

      kubectl delete ns bookinfo --context $REMOTE_CONTEXT1
    kubectl delete ns bookinfo --context $REMOTE_CONTEXT2
      
  4. Remove the httpbin application components.

      kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT1
    kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT2
      
  5. Delete the httpbin namespace.

      kubectl delete ns httpbin --context $REMOTE_CONTEXT1
    kubectl delete ns httpbin --context $REMOTE_CONTEXT2
      
  6. Remove the helloworld application components.

      kubectl -n helloworld delete -l 'service=helloworld' -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/helloworld.yaml --context $REMOTE_CONTEXT1
    kubectl -n helloworld delete -l 'app=helloworld,version in (v1, v2)' -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/helloworld.yaml --context $REMOTE_CONTEXT1
    kubectl -n helloworld delete -l 'service=helloworld' -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/helloworld.yaml --context $REMOTE_CONTEXT2
    kubectl -n helloworld delete -l 'app=helloworld,version in (v3, v4)' -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/helloworld.yaml --context $REMOTE_CONTEXT2
      
  7. Delete the helloworld namespace.

      kubectl delete ns helloworld --context $REMOTE_CONTEXT1
    kubectl delete ns helloworld --context $REMOTE_CONTEXT2