Chapter 5. Uninstall

Procedure

1. Delete the TrusteeConfig custom resource by running the following command:

   $ oc delete trusteeconfig <name> -n trustee-operator-system

   where <name> is the name of your TrusteeConfig resource.

2. Verify that all generated resources are removed by running the following command:

   $ oc get configmaps,secrets,kbsconfig -n trustee-operator-system

Procedure

1. Delete the subscription by running the following command:

   $ oc delete subscription trustee-operator

2. Delete the namespace by running the following command:

   $ oc delete namespace trustee-operator-system

Procedure

1. Check the pod events for error messages:

   $ oc describe pod <pod_name>

2. Review the pod logs:

   $ oc logs <pod_name>

3. Examine the output for attestation-related errors, such as:

   • NVIDIA Remote Attestation Service (NRAS) connection failures
   • Policy evaluation errors
   • GPU device allocation issues

Procedure

1. Test network connectivity to NVIDIA Remote Attestation Service from the Red Hat build of Trustee cluster:

   $ oc exec -n trustee-operator-system deployment/trustee-deployment -- curl -I https://nras.attestation.nvidia.com

   The command should return HTTP headers indicating successful connectivity.

2. Verify that network policies allow outbound HTTPS connections to NVIDIA cloud services.
3. If the connection fails, review your cluster’s egress firewall rules and ensure that traffic to nras.attestation.nvidia.com is permitted.

Procedure

1. Review the attestation policy OPA rules to ensure they are correctly configured for NVIDIA GPU attestation.
2. Verify that the NRAS claim names in your policy match the expected values from the attestation response.

3. Check Red Hat build of Trustee logs for policy evaluation details:

   $ oc logs -n trustee-operator-system deployment/trustee-deployment | grep -i "policy"

4. Review the log output for specific policy evaluation errors or mismatched claim values.

Procedure

1. Verify that the NVIDIA GPU Operator is installed on your cluster:

   $ oc get pods -n nvidia-gpu-operator

2. Check the worker node for GPU visibility:

   $ oc debug node/<worker_node_name> -- chroot /host nvidia-smi

   The command should list available GPU devices.

3. Verify that GPU passthrough is configured correctly on the worker node.
4. Ensure that the pod requesting the GPU has the correct resource limits specified in its configuration.