Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
Chapter 9. Uninstalling
You can uninstall OpenShift sandboxed containers and remove the Confidential Containers environment.
9.1. Uninstalling OpenShift sandboxed containers
You can uninstall OpenShift sandboxed containers by using the OpenShift Container Platform web console or the command line.
You uninstall OpenShift sandboxed containers by performing the following tasks:
- Delete the workload pods.
- 
						Delete the KataConfigcustom resource (CR).
- Uninstall the OpenShift sandboxed containers Operator.
- 
						Delete the KataConfigcustom resource definition (CRD).
					You must delete the workload pods before deleting the KataConfig CR. The pod names usually have the prefix podvm and custom tags, if provided. If you deployed OpenShift sandboxed containers or Confidential Containers on a cloud provider and any resources remain after following these procedures, you might receive an unexpected bill for those resources from your cloud provider. Once you complete uninstalling OpenShift sandboxed containers on a cloud provider, check the cloud provider console to ensure that the procedures deleted all of the resources.
				
9.1.1. Uninstalling OpenShift sandboxed containers by using the web console
You can uninstall OpenShift sandboxed containers by using the OpenShift Container Platform web console.
9.1.1.1. Deleting workload pods
You can delete the OpenShift sandboxed containers workload pods by using the OpenShift Container Platform web console.
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- You have a list of pods that use the OpenShift sandboxed containers runtime class.
Procedure
- 
								In the OpenShift Container Platform web console, navigate to Workloads Pods. 
- Enter the name of the pod that you want to delete in the Search by name field.
- Click the pod name to open it.
- 
								On the Details page, check that kataorkata-remoteis displayed for Runtime class.
- 
								Click the Options menu 
								 and select Delete Pod. and select Delete Pod.
- Click Delete.
Repeat this procedure for each pod.
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.1.1.2. Deleting the KataConfig custom resource
						You can delete the KataConfig custom resource (CR) by using the web console.
					
						Deleting the KataConfig CR removes and uninstalls the kata or kata-remote runtime and its related resources from your cluster.
					
							Deleting the KataConfig CR automatically reboots the worker nodes. The reboot can take from 10 to more than 60 minutes. Factors that impede reboot time are as follows:
						
- A larger OpenShift Container Platform deployment with a greater number of worker nodes.
- Activation of the BIOS and Diagnostics utility.
- Deployment on a hard drive rather than an SSD.
- Deployment on physical nodes such as bare metal, rather than on virtual nodes.
- A slow CPU and network.
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
Procedure
- 
								In the OpenShift Container Platform web console, navigate to Operators Installed Operators. 
- 
								Enter OpenShift sandboxed containers Operatorin the Search by name field.
- Click the Operator to open it and then click the KataConfig tab.
- 
								Click the Options menu 
								 and select Delete and select DeleteKataConfig.
- Click Delete in the confirmation window.
						Wait for the kata or kata-remote runtime and resources to uninstall and for the worker nodes to reboot before continuing to the next step.
					
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.1.1.3. Uninstalling the OpenShift sandboxed containers Operator
You can uninstall the OpenShift sandboxed containers Operator by using OpenShift Container Platform web console.
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KataConfigcustom resource.
Procedure
- 
								Navigate to Operators Installed Operators. 
- 
								Enter OpenShift sandboxed containers Operatorin the Search by name field.
- On the right side of the Operator Details page, select Uninstall Operator from the Actions list. - An Uninstall Operator? dialog box is displayed. 
- Click Uninstall to remove the Operator, Operator deployments, and pods.
- 
								Navigate to Administration Namespaces. 
- 
								Enter openshift-sandboxed-containers-operatorin the Search by name field.
- 
								Click the Options menu 
								 and select Delete Namespace. and select Delete Namespace.
- 
								In the confirmation dialog, enter openshift-sandboxed-containers-operatorand click Delete.
9.1.1.4. Deleting the KataConfig CRD
						You can delete the KataConfig custom resource definition (CRD) by using the OpenShift Container Platform web console.
					
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KataConfigcustom resource.
- You have uninstalled the OpenShift sandboxed containers Operator.
Procedure
- 
								In the web console, navigate to Administration CustomResourceDefinitions. 
- 
								Enter the KataConfigname in the Search by name field.
- Click the Options menu and select Delete CustomResourceDefinition.
- Click Delete in the confirmation window.
9.1.2. Uninstalling OpenShift sandboxed containers by using the CLI
You can uninstall OpenShift sandboxed containers by using the command-line interface (CLI).
9.1.2.1. Deleting workload pods
You can delete the OpenShift sandboxed containers workload pods by using the CLI.
Prerequisites
- 
								You have the JSON processor (jq) utility installed.
Procedure
- Search for the pods by running the following command: - oc get pods -A -o json | jq -r '.items[] | \ select(.spec.runtimeClassName == "<runtime>").metadata.name' - $ oc get pods -A -o json | jq -r '.items[] | \ select(.spec.runtimeClassName == "<runtime>").metadata.name'- 1 - Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - 1
- Replace<runtime>withkatafor bare metal deployments, or withkata-remotefor AWS, Azure, IBM Z®, and IBM® LinuxONE deployments.
 
- Delete each pod by running the following command: - oc delete pod <pod> - $ oc delete pod <pod>- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.1.2.2. Deleting the KataConfig custom resource
						You can delete the KataConfig custom resource (CR) by using the command line.
					
						Deleting the KataConfig CR removes the runtime and its related resources from your cluster.
					
							Deleting the KataConfig CR automatically reboots the worker nodes. The reboot can take from 10 to more than 60 minutes. Factors that impede reboot time are as follows:
						
- A larger OpenShift Container Platform deployment with a greater number of worker nodes.
- Activation of the BIOS and Diagnostics utility.
- Deployment on a hard drive rather than an SSD.
- Deployment on physical nodes such as bare metal, rather than on virtual nodes.
- A slow CPU and network.
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
Procedure
- Delete the - KataConfigCR by running the following command:- oc delete kataconfig example-kataconfig - $ oc delete kataconfig example-kataconfig- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - The OpenShift sandboxed containers Operator removes all resources that were initially created to enable the runtime on your cluster. Important- When you delete the - KataConfigCR, the CLI stops responding until all worker nodes reboot. You must wait for the deletion process to complete before performing the verification.
- Verify that the custom resource was deleted by running the following command: - oc get kataconfig example-kataconfig - $ oc get kataconfig example-kataconfig- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - Example output - No example-kataconfig instances exist - No example-kataconfig instances exist- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.1.2.3. Uninstalling the OpenShift sandboxed containers Operator
You can uninstall the OpenShift sandboxed containers Operator by using the command line.
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KataConfigcustom resource.
Procedure
- Delete the subscription by running the following command: - oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operator - $ oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operator- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
- Delete the namespace by running the following command: - oc delete namespace openshift-sandboxed-containers-operator - $ oc delete namespace openshift-sandboxed-containers-operator- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
9.1.2.4. Deleting the KataConfig CRD
						You can delete the KataConfig custom resource definition (CRD) by using the command line.
					
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KataConfigcustom resource.
- You have uninstalled the OpenShift sandboxed containers Operator.
Procedure
- Delete the - KataConfigCRD by running the following command:- oc delete crd kataconfigs.kataconfiguration.openshift.io - $ oc delete crd kataconfigs.kataconfiguration.openshift.io- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
- Verify that the CRD was deleted by running the following command: - oc get crd kataconfigs.kataconfiguration.openshift.io - $ oc get crd kataconfigs.kataconfiguration.openshift.io- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - Example output - Unknown CRD kataconfigs.kataconfiguration.openshift.io - Unknown CRD kataconfigs.kataconfiguration.openshift.io- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
9.2. Removing the Confidential Containers environment
You can remove the Confidential Containers environment by using the OpenShift Container Platform web console or the command line.
You remove the Confidential Containers environment by performing the following tasks:
- 
						Delete the KbsConfigcustom resource.
- Uninstall the Confidential compute attestation Operator.
- 
						Delete the KbsConfigcustom resource definition.
9.2.1. Removing the Confidential Containers environment by using the web console
You can remove the Confidential Containers environment by using the OpenShift Container Platform web console.
9.2.1.1. Deleting the KbsConfig custom resource
						You can delete the KbsConfig custom resource (CR) by using the web console.
					
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- You have uninstalled OpenShift sandboxed containers.
Procedure
- 
								In the OpenShift Container Platform web console, navigate to Operators Installed Operators. 
- 
								Enter Confidential compute attestationin the Search by name field.
- Click the Operator to open it and then click the KbsConfig tab.
- 
								Click the Options menu 
								 and select Delete and select DeleteKbsConfig.
- Click Delete in the confirmation window.
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.2.1.2. Uninstalling the Confidential compute attestation Operator
You can uninstall the Confidential compute attestation Operator by using OpenShift Container Platform web console.
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KbsConfigcustom resource.
Procedure
- 
								Navigate to Operators Installed Operators. 
- 
								Enter Confidential compute attestationin the Search by name field.
- On the right side of the Operator Details page, select Uninstall Operator from the Actions list. - An Uninstall Operator? dialog box is displayed. 
- Click Uninstall to remove the Operator, Operator deployments, and pods.
- 
								Navigate to Administration Namespaces. 
- 
								Enter trustee-operator-systemin the Search by name field.
- 
								Click the Options menu 
								 and select Delete Namespace. and select Delete Namespace.
- 
								In the confirmation dialog, enter trustee-operator-systemand click Delete.
9.2.1.3. Deleting the KbsConfig CRD
						You can delete the KbsConfig custom resource definition (CRD) by using the OpenShift Container Platform web console.
					
Prerequisites
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KbsConfigcustom resource.
- You have uninstalled the Confidential compute attestation Operator.
Procedure
- 
								In the web console, navigate to Administration CustomResourceDefinitions. 
- 
								Enter the KbsConfigname in the Search by name field.
- Click the Options menu and select Delete CustomResourceDefinition.
- Click Delete in the confirmation window.
9.2.2. Removing the Confidential Containers environment by using the CLI
You can remove the Confidential Containers environment by using the command-line interface (CLI).
9.2.2.1. Deleting the KbsConfig custom resource
						You can delete the KbsConfig custom resource (CR) by using the command line.
					
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- You have uninstalled OpenShift sandboxed containers.
Procedure
- Delete the - KbsConfigCR by running the following command:- oc delete kbsconfig kbsconfig - $ oc delete kbsconfig kbsconfig- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
- Verify that the custom resource was deleted by running the following command: - oc get kbsconfig kbsconfig - $ oc get kbsconfig kbsconfig- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - Example output - No kbsconfig instances exist - No kbsconfig instances exist- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
9.2.2.2. Uninstalling the Confidential compute attestation Operator
You can uninstall the Confidential compute attestation Operator by using the command line.
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted the KbsConfigcustom resource.
Procedure
- Delete the subscription by running the following command: - oc delete subscription trustee-operator -n trustee-operator-system - $ oc delete subscription trustee-operator -n trustee-operator-system- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
- Delete the namespace by running the following command: - oc delete namespace trustee-operator-system - $ oc delete namespace trustee-operator-system- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
9.2.2.3. Deleting the KbsConfig CRD
						You can delete the KbsConfig custom resource definition (CRD) by using the command line.
					
Prerequisites
- 
								You have installed the OpenShift CLI (oc).
- 
								You have access to the cluster as a user with the cluster-adminrole.
- 
								You have deleted all pods that use kataorkata-remoteas theruntimeClass.
- 
								You have deleted the KbsConfigcustom resource.
- You have uninstalled the Confidential compute attestation Operator.
Procedure
- Delete the - KbsConfigCRD by running the following command:- oc delete crd kbsconfigs.confidentialcontainers.org - $ oc delete crd kbsconfigs.confidentialcontainers.org- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow 
- Verify that the CRD was deleted by running the following command: - oc get crd kbsconfigs.confidentialcontainers.org - $ oc get crd kbsconfigs.confidentialcontainers.org- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow - Example output - Unknown CRD kbsconfigs.confidentialcontainers.org - Unknown CRD kbsconfigs.confidentialcontainers.org- Copy to Clipboard Copied! - Toggle word wrap Toggle overflow