Chapter 6. Uninstalling Red Hat Advanced Cluster Security for Kubernetes
Chapter 6. Uninstalling Red Hat Advanced Cluster Security for Kubernetes When you install Red Hat Advanced Cluster Security for Kubernetes, it creates: A namespace called rhacs-operator where the Operator is installed, if you chose the Operator method of installation A namespace called stackrox , or another namespace where you created the Central and SecuredCluster custom resources PodSecurityPolicy and Kubernetes role-based access control (RBAC) objects for all components Additional labels on namespaces, for use in generated network policies An application custom resource definition (CRD), if it does not exist Uninstalling Red Hat Advanced Cluster Security for Kubernetes involves deleting all of these items. 6.1. Deleting namespace You can delete the namespace that Red Hat Advanced Cluster Security for Kubernetes creates by using the OpenShift Container Platform or Kubernetes command-line interface. Procedure Delete the stackrox namespace: On OpenShift Container Platform: USD oc delete namespace stackrox On Kubernetes: USD kubectl delete namespace stackrox Note If you installed RHACS in a different namespace, use the name of that namespace in the delete command. 6.2. Deleting global resources You can delete the global resources that Red Hat Advanced Cluster Security for Kubernetes (RHACS) creates by using the OpenShift Container Platform or Kubernetes command-line interface (CLI). Procedure To delete the global resources by using the OpenShift Container Platform CLI, perform the following steps: Retrieve all the StackRox-related cluster roles, cluster role bindings, roles, role bindings, and PSPs, and then delete them by running the following command: USD oc get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs oc delete --wait Note You might receive the error: the server doesn't have a resource type "psp" error message in RHACS 4.4 and later versions because the pod security policies (PSPs) are deprecated. The PSPs were removed from Kubernetes in version 1.25, except for clusters with older Kubernetes versions. Delete the custom security context constraints (SCCs) labeled with app.kubernetes.io/name=stackrox by running the following command: USD oc delete scc -l "app.kubernetes.io/name=stackrox" Note You might receive the No resources found error message in RHACS 4.4 and later versions because the custom SCCs with this label are no longer used in these versions. Delete the ValidatingWebhookConfiguration object named stackrox by running the following command: USD oc delete ValidatingWebhookConfiguration stackrox To delete the global resources by using the Kubernetes CLI, perform the following steps: Retrieve all the StackRox-related cluster roles, cluster role bindings, roles, role bindings, and PSPs, and then delete them by running the following command: USD kubectl get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs kubectl delete --wait Note You might receive the error: the server doesn't have a resource type "psp" error message in RHACS 4.4 and later versions because the pod security policies (PSPs) are deprecated. The PSPs were removed from Kubernetes in version 1.25, except for clusters with older Kubernetes versions. Delete the ValidatingWebhookConfiguration object named stackrox by running the following command: USD kubectl delete ValidatingWebhookConfiguration stackrox 6.3. Deleting labels and annotations You can delete the labels and annotations that Red Hat Advanced Cluster Security for Kubernetes creates, by using the OpenShift Container Platform or Kubernetes command-line interface. Procedure Delete labels and annotations: On OpenShift Container Platform: USD for namespace in USD(oc get ns | tail -n +2 | awk '{print USD1}'); do oc label namespace USDnamespace namespace.metadata.stackrox.io/id-; oc label namespace USDnamespace namespace.metadata.stackrox.io/name-; oc annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done On Kubernetes: USD for namespace in USD(kubectl get ns | tail -n +2 | awk '{print USD1}'); do kubectl label namespace USDnamespace namespace.metadata.stackrox.io/id-; kubectl label namespace USDnamespace namespace.metadata.stackrox.io/name-; kubectl annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done
oc delete namespace stackrox kubectl delete namespace stackrox oc get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs oc delete --wait oc delete scc -l "app.kubernetes.io/name=stackrox" oc delete ValidatingWebhookConfiguration stackrox kubectl get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs kubectl delete --wait kubectl delete ValidatingWebhookConfiguration stackrox for namespace in USD(oc get ns | tail -n +2 | awk '{print USD1}'); do oc label namespace USDnamespace namespace.metadata.stackrox.io/id-; oc label namespace USDnamespace namespace.metadata.stackrox.io/name-; oc annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done for namespace in USD(kubectl get ns | tail -n +2 | awk '{print USD1}'); do kubectl label namespace USDnamespace namespace.metadata.stackrox.io/id-; kubectl label namespace USDnamespace namespace.metadata.stackrox.io/name-; kubectl annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done