Uninstall

Single cluster link

Uninstall Gloo Mesh Gateway from a single-cluster setup.

Gateway proxies link

Uninstall the Istio control plane and gateway proxies. Note: For demo installations, skip to the next section.

1. Find the name of your Istio Helm chart release in the istio-ingress namespace, such as istio-ingressgateway-main.

     helm ls -n istio-ingress
     

2. Delete the Helm release for the ingress gateway.

     helm uninstall istio-ingressgateway-main -n istio-ingress
     

3. Find the name of your Istio Helm chart release in the istio-system namespace, such as istiod-main.

     helm ls -n istio-system
     

4. Delete the Helm release for the istiod control plane.

     helm uninstall istiod-main -n istio-system
     

5. Delete the Istio CRDs.

     helm uninstall istio-base -n istio-system
     

6. Delete the Istio namespaces.

     kubectl delete ns istio-system
   kubectl delete ns istio-ingress
   kubectl delete ns istio-config
     

OpenShift installations: Revoke the extra permissions and resources required for OpenShift to run Istio.

1. Revoke the Istio namespace ID permissions for the Istio service accounts.

     oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh
   oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system
   oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-ingress
     

2. Revoke the Istio namespace ID permissions for sample app project service accounts.

     oc adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo
   oc adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin
     

3. Delete the NetworkAttachmentDefinition resources and the Istio namespace ID permissions for your workload projects.

     oc adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
     

     oc delete network-attachment-definition istio-cni -n <workload_projects>
     

Gloo Mesh Gateway link

1. Uninstall Gloo Mesh Gateway.

     meshctl uninstall --purge
     

   Note: If you see a warning such as release gloo-platform does not exist, nothing to uninstall, use the Helm tab instead.

   1. Uninstall the main Gloo Mesh Gateway release.

        meshctl uninstall
        

   2. Uninstall the Gloo CRDs Helm release.

        helm uninstall gloo-platform-crds -n gloo-mesh
        

   Note: If you see a warning such as release gloo-platform does not exist, nothing to uninstall, use the Helm tab instead.

   3. Delete the KubernetesCluster resource from the cluster.

        kubectl delete kubernetescluster $CLUSTER_NAME -n gloo-mesh
        

   4. Uninstall the main Gloo Mesh Gateway release. Note that your Helm release might have a different name.

        helm uninstall gloo-platform -n gloo-mesh
        

   5. If you maintained a separate gloo-agent-addons Helm release, uninstall the release. Note that your add-ons might be installed in a different namespace, such as gloo-mesh-addons.

        helm uninstall gloo-agent-addons -n gloo-mesh
        

   6. Uninstall the Gloo CRDs Helm release.

        helm uninstall gloo-platform-crds -n gloo-mesh
        

2. Delete the gloo-mesh namespace.

     kubectl delete namespace gloo-mesh
     

Optional: Sample apps link

If you installed the Bookinfo and httpbin sample apps, run the following commands to uninstall their resources.

1. Export the Istio version that your cluster runs as an environment variable, such as 1.25.2 in the following example.

     export ISTIO_VERSION=1.25.2
     

2. Remove the Bookinfo application components and service accounts.

     kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)'
   kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account'
     

3. Delete the bookinfo namespace.

     kubectl delete ns bookinfo
     

4. Remove the httpbin application components.

     kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml
     

5. Delete the httpbin namespace.

     kubectl delete ns httpbin
     

Multicluster link

Uninstall Gloo Mesh Gateway from a multicluster setup.

Gateway proxies link

1. Save the names and contexts of the clusters you want to uninstall Gloo Mesh Gateway from.

     export MGMT_CLUSTER=<management-cluster>
   export REMOTE_CLUSTER1=<remote-cluster1>
   export REMOTE_CLUSTER2=<remote-cluster2>
     

     export MGMT_CONTEXT=<management-cluster-context>
   export REMOTE_CONTEXT1=<remote-cluster1-context>
   export REMOTE_CONTEXT2=<remote-cluster2-context>
     

2. Uninstall the Istio control plane and gateway proxies.

   1. Find the name of your Istio Helm chart releases in the istio-ingress or istio-eastwest namespaces, such as istio-ingressgateway-main and istio-eastwestgateway-main.

        helm ls -n istio-ingress
      helm ls -n istio-eastwest
        

   2. Delete the Helm release for the ingress and east-west gateways.

        helm uninstall istio-ingressgateway-main -n istio-ingress
      helm uninstall istio-eastwestgateway-main -n istio-eastwest
        

   3. Find the name of your Istio Helm chart release in the istio-system namespace, such as istiod-main.

        helm ls -n istio-system
        

   4. Delete the Helm release for the istiod control plane.

        helm uninstall istiod-main -n istio-system
        

   5. Delete the Istio CRDs.

        helm uninstall istio-base -n istio-system
        

   6. Delete the Istio namespaces.

        kubectl delete ns istio-system --context $REMOTE_CONTEXT1
      kubectl delete ns istio-ingress --context  $REMOTE_CONTEXT1
      kubectl delete ns istio-config --context $REMOTE_CONTEXT1
      kubectl delete ns istio-eastwest --context  $REMOTE_CONTEXT1
        

        kubectl delete ns istio-system --context $REMOTE_CONTEXT2
      kubectl delete ns istio-ingress --context $REMOTE_CONTEXT2
      kubectl delete ns istio-config --context $REMOTE_CONTEXT2
      kubectl delete ns istio-eastwest --context  $REMOTE_CONTEXT2
        

3. OpenShift installations: Revoke the extra permissions and resources required for OpenShift to run Istio.

   1. Revoke the Istio namespace ID permissions for the Istio service accounts.

        oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh --context $REMOTE_CONTEXT1
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT1
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-ingress --context $REMOTE_CONTEXT1
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-eastwest --context $REMOTE_CONTEXT1
        

        oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh --context $REMOTE_CONTEXT2
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:istio-system --context $REMOTE_CONTEXT2
      oc adm policy remove-scc-from-group anyuid system:serviceaccounts:gloo-mesh-gateways --context $REMOTE_CONTEXT2
        

   2. Revoke the Istio namespace ID permissions for sample app project service accounts.

        oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo
      oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin
        

        oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:bookinfo
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:httpbin
        

   3. Delete the NetworkAttachmentDefinition resources and the Istio namespace ID permissions for your workload projects.

        oc --context $REMOTE_CONTEXT1 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
      oc --context $REMOTE_CONTEXT2 adm policy remove-scc-from-group anyuid system:serviceaccounts:<workload_projects>
        

        oc --context $REMOTE_CONTEXT1 delete network-attachment-definition istio-cni -n <workload_projects>
      oc --context $REMOTE_CONTEXT2 delete network-attachment-definition istio-cni -n <workload_projects>
        

Workload clusters link

Uninstall the Gloo data plane components from the workload clusters.

1. Uninstall the Gloo agent that runs on each workload cluster.

   1. Deregister cluster1.

        meshctl cluster deregister \
        --kubecontext $MGMT_CONTEXT \
        --remote-context $REMOTE_CONTEXT1 \
        $REMOTE_CLUSTER1
        

   2. Deregister cluster2.

        meshctl cluster deregister \
        --kubecontext $MGMT_CONTEXT \
        --remote-context $REMOTE_CONTEXT2 \
        $REMOTE_CLUSTER2
        

   3. If you maintained a separate gloo-agent-addons Helm release, uninstall the release. Note that your add-ons might be installed in a different namespace, such as gloo-mesh-addons.

        helm uninstall gloo-agent-addons -n gloo-mesh --kube-context $REMOTE_CONTEXT1
      helm uninstall gloo-agent-addons -n gloo-mesh --kube-context $REMOTE_CONTEXT2
        

   4. Uninstall the agent Helm releases. Note that your Helm release might have a different name.

        helm uninstall gloo-platform -n gloo-mesh --kube-context $REMOTE_CONTEXT1
      helm uninstall gloo-platform -n gloo-mesh --kube-context $REMOTE_CONTEXT2
        

   5. Delete the corresponding KubernetesCluster resources from the management cluster.

        kubectl delete kubernetescluster $REMOTE_CLUSTER1 $REMOTE_CLUSTER2 -n gloo-mesh --context $MGMT_CONTEXT
        

   6. Delete the relay secrets from each workload cluster, as you cannot reuse the same secret if you decide to re-register the agent later.

        kubectl delete secret -n gloo-mesh relay-client-tls-secret --context $REMOTE_CONTEXT1
      kubectl delete secret -n gloo-mesh relay-identity-token-secret --context $REMOTE_CONTEXT1
      kubectl delete secret -n gloo-mesh relay-root-tls-secret --context $REMOTE_CONTEXT1
        

        kubectl delete secret -n gloo-mesh relay-client-tls-secret --context $REMOTE_CONTEXT2
      kubectl delete secret -n gloo-mesh relay-identity-token-secret --context $REMOTE_CONTEXT2
      kubectl delete secret -n gloo-mesh relay-root-tls-secret --context $REMOTE_CONTEXT2
        

2. Uninstall the Gloo CRDs Helm releases in each workload cluster.

     helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT1
   helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $REMOTE_CONTEXT2
     

3. Delete the gloo-mesh namespace from each workload cluster.

     kubectl --context $REMOTE_CONTEXT1 delete namespace gloo-mesh
   kubectl --context $REMOTE_CONTEXT2 delete namespace gloo-mesh
     

4. Repeat these steps for any other cluster that is registered with Gloo Mesh. For example, if you ran the management plane in a cluster that was also registered, repeat these steps for the MGMT_CLUSTER and specify the MGMT_CONTEXT. If you registered multiple workload clusters, repeat these steps for each workload cluster.

Management cluster link

Uninstall the Gloo management plane components from the management cluster.

1. Uninstall the Gloo management plane components.

     meshctl uninstall --purge --kubecontext $MGMT_CONTEXT
     

   Note: If you see a warning such as release gloo-platform does not exist, nothing to uninstall, use the Helm tab instead.

     meshctl uninstall --kubecontext $MGMT_CONTEXT
     

   Note: If you see a warning such as release gloo-platform does not exist, nothing to uninstall, use the Helm tab instead.

   Note that your Helm release might have a different name.

     helm uninstall gloo-platform -n gloo-mesh --kube-context $MGMT_CONTEXT
     

2. Uninstall the Gloo CRDs Helm release from the management cluster.

     helm uninstall gloo-platform-crds -n gloo-mesh --kube-context $MGMT_CONTEXT
     

3. Delete the gloo-mesh namespace, and if applicable, the gloo-mesh-config namespace.

     kubectl --context $MGMT_CONTEXT delete namespace gloo-mesh
   kubectl --context $MGMT_CONTEXT delete namespace gloo-mesh-config
     

Optional: Sample apps link

If you installed the Bookinfo and httpbin sample apps, run the following commands to uninstall their resources.

1. Export the Istio version that your cluster runs as an environment variable, such as 1.25.2 in the following example.

     export ISTIO_VERSION=1.25.2
     

2. Remove the Bookinfo application components and service accounts.

     kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)' --context $REMOTE_CONTEXT1
   kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'app,version notin (v3)' --context $REMOTE_CONTEXT2
   kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account' --context $REMOTE_CONTEXT1
   kubectl -n bookinfo delete -f https://raw.githubusercontent.com/istio/istio/$ISTIO_VERSION/samples/bookinfo/platform/kube/bookinfo.yaml -l 'account' --context $REMOTE_CONTEXT2
     

3. Delete the bookinfo namespace.

     kubectl delete ns bookinfo --context $REMOTE_CONTEXT1
   kubectl delete ns bookinfo --context $REMOTE_CONTEXT2
     

4. Remove the httpbin application components.

     kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT1
   kubectl -n httpbin delete -f https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/policy-demo/httpbin.yaml --context $REMOTE_CONTEXT2
     

5. Delete the httpbin namespace.

     kubectl delete ns httpbin --context $REMOTE_CONTEXT1
   kubectl delete ns httpbin --context $REMOTE_CONTEXT2