Este contenido no está disponible en el idioma seleccionado.
Chapter 10. Uninstalling
You can uninstall OpenShift sandboxed containers and remove the Confidential Containers environment.
10.1. Uninstalling OpenShift sandboxed containers Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall OpenShift sandboxed containers by using the OpenShift Container Platform web console or the command line.
You uninstall OpenShift sandboxed containers by performing the following tasks:
- Delete the workload pods.
-
Delete the
KataConfigcustom resource (CR). - Uninstall the OpenShift sandboxed containers Operator.
-
Delete the
KataConfigcustom resource definition (CRD).
You must delete the workload pods before deleting the KataConfig CR. The pod names usually have the prefix podvm and custom tags, if provided. If you deployed OpenShift sandboxed containers or Confidential Containers on a cloud provider and any resources remain after following these procedures, you might receive an unexpected bill for those resources from your cloud provider. Once you complete uninstalling OpenShift sandboxed containers on a cloud provider, check the cloud provider console to ensure that the procedures deleted all of the resources.
10.1.1. Uninstalling OpenShift sandboxed containers by using the web console Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall OpenShift sandboxed containers by using the OpenShift Container Platform web console.
10.1.1.1. Deleting workload pods Copiar enlaceEnlace copiado en el portapapeles!
You can delete the OpenShift sandboxed containers workload pods by using the OpenShift Container Platform web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. - You have a list of pods that use the OpenShift sandboxed containers runtime class.
Procedure
-
In the OpenShift Container Platform web console, navigate to Workloads
Pods. - Enter the name of the pod that you want to delete in the Search by name field.
- Click the pod name to open it.
-
On the Details page, check that
kataorkata-remoteis displayed for Runtime class. -
Click the Options menu
and select Delete Pod.
- Click Delete.
Repeat this procedure for each pod.
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.1.1.2. Deleting the KataConfig custom resource Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KataConfig custom resource (CR) by using the web console.
Deleting the KataConfig CR removes and uninstalls the kata or kata-remote runtime and its related resources from your cluster.
Deleting the KataConfig CR automatically reboots the worker nodes. The reboot can take from 10 to more than 60 minutes. Factors that impede reboot time are as follows:
- A larger OpenShift Container Platform deployment with a greater number of worker nodes.
- Activation of the BIOS and Diagnostics utility.
- Deployment on a hard drive rather than an SSD.
- Deployment on physical nodes such as bare metal, rather than on virtual nodes.
- A slow CPU and network.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass.
Procedure
-
In the OpenShift Container Platform web console, navigate to Operators
Installed Operators. -
Enter
OpenShift sandboxed containers Operatorin the Search by name field. - Click the Operator to open it and then click the KataConfig tab.
-
Click the Options menu
and select Delete KataConfig. - Click Delete in the confirmation window.
Wait for the kata or kata-remote runtime and resources to uninstall and for the worker nodes to reboot before continuing to the next step.
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.1.1.3. Uninstalling the OpenShift sandboxed containers Operator Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall the OpenShift sandboxed containers Operator by using OpenShift Container Platform web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KataConfigcustom resource.
Procedure
-
Navigate to Operators
Installed Operators. -
Enter
OpenShift sandboxed containers Operatorin the Search by name field. On the right side of the Operator Details page, select Uninstall Operator from the Actions list.
An Uninstall Operator? dialog box is displayed.
- Click Uninstall to remove the Operator, Operator deployments, and pods.
-
Navigate to Administration
Namespaces. -
Enter
openshift-sandboxed-containers-operatorin the Search by name field. -
Click the Options menu
and select Delete Namespace.
-
In the confirmation dialog, enter
openshift-sandboxed-containers-operatorand click Delete.
10.1.1.4. Deleting the KataConfig CRD Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KataConfig custom resource definition (CRD) by using the OpenShift Container Platform web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KataConfigcustom resource. - You have uninstalled the OpenShift sandboxed containers Operator.
Procedure
-
In the web console, navigate to Administration
CustomResourceDefinitions. -
Enter the
KataConfigname in the Search by name field. - Click the Options menu and select Delete CustomResourceDefinition.
- Click Delete in the confirmation window.
10.1.2. Uninstalling OpenShift sandboxed containers by using the CLI Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall OpenShift sandboxed containers by using the command-line interface (CLI).
10.1.2.1. Deleting workload pods Copiar enlaceEnlace copiado en el portapapeles!
You can delete the OpenShift sandboxed containers workload pods by using the CLI.
Prerequisites
-
You have the JSON processor (
jq) utility installed.
Procedure
Search for the pods by running the following command:
oc get pods -A -o json | jq -r '.items[] | \ select(.spec.runtimeClassName == "<runtime>").metadata.name'
$ oc get pods -A -o json | jq -r '.items[] | \ select(.spec.runtimeClassName == "<runtime>").metadata.name'1 Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Replace
<runtime>withkatafor bare metal deployments, or withkata-remotefor AWS, Azure, IBM Z®, and IBM® LinuxONE deployments.
Delete each pod by running the following command:
oc delete pod <pod>
$ oc delete pod <pod>Copy to Clipboard Copied! Toggle word wrap Toggle overflow
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.1.2.2. Deleting the KataConfig custom resource Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KataConfig custom resource (CR) by using the command line.
Deleting the KataConfig CR removes the runtime and its related resources from your cluster.
Deleting the KataConfig CR automatically reboots the worker nodes. The reboot can take from 10 to more than 60 minutes. Factors that impede reboot time are as follows:
- A larger OpenShift Container Platform deployment with a greater number of worker nodes.
- Activation of the BIOS and Diagnostics utility.
- Deployment on a hard drive rather than an SSD.
- Deployment on physical nodes such as bare metal, rather than on virtual nodes.
- A slow CPU and network.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass.
Procedure
Delete the
KataConfigCR by running the following command:oc delete kataconfig example-kataconfig
$ oc delete kataconfig example-kataconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow The OpenShift sandboxed containers Operator removes all resources that were initially created to enable the runtime on your cluster.
ImportantWhen you delete the
KataConfigCR, the CLI stops responding until all worker nodes reboot. You must wait for the deletion process to complete before performing the verification.Verify that the custom resource was deleted by running the following command:
oc get kataconfig example-kataconfig
$ oc get kataconfig example-kataconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
No example-kataconfig instances exist
No example-kataconfig instances existCopy to Clipboard Copied! Toggle word wrap Toggle overflow
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.1.2.3. Uninstalling the OpenShift sandboxed containers Operator Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall the OpenShift sandboxed containers Operator by using the command line.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KataConfigcustom resource.
Procedure
Delete the subscription by running the following command:
oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operator
$ oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operatorCopy to Clipboard Copied! Toggle word wrap Toggle overflow Delete the namespace by running the following command:
oc delete namespace openshift-sandboxed-containers-operator
$ oc delete namespace openshift-sandboxed-containers-operatorCopy to Clipboard Copied! Toggle word wrap Toggle overflow
10.1.2.4. Deleting the KataConfig CRD Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KataConfig custom resource definition (CRD) by using the command line.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KataConfigcustom resource. - You have uninstalled the OpenShift sandboxed containers Operator.
Procedure
Delete the
KataConfigCRD by running the following command:oc delete crd kataconfigs.kataconfiguration.openshift.io
$ oc delete crd kataconfigs.kataconfiguration.openshift.ioCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that the CRD was deleted by running the following command:
oc get crd kataconfigs.kataconfiguration.openshift.io
$ oc get crd kataconfigs.kataconfiguration.openshift.ioCopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Unknown CRD kataconfigs.kataconfiguration.openshift.io
Unknown CRD kataconfigs.kataconfiguration.openshift.ioCopy to Clipboard Copied! Toggle word wrap Toggle overflow
10.2. Removing the Confidential Containers environment Copiar enlaceEnlace copiado en el portapapeles!
You can remove the Confidential Containers environment by using the OpenShift Container Platform web console or the command line.
You remove the Confidential Containers environment by performing the following tasks:
-
Delete the
KbsConfigcustom resource. - Uninstall the Confidential compute attestation Operator.
-
Delete the
KbsConfigcustom resource definition.
10.2.1. Removing the Confidential Containers environment by using the web console Copiar enlaceEnlace copiado en el portapapeles!
You can remove the Confidential Containers environment by using the OpenShift Container Platform web console.
10.2.1.1. Deleting the KbsConfig custom resource Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KbsConfig custom resource (CR) by using the web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. - You have uninstalled OpenShift sandboxed containers.
Procedure
-
In the OpenShift Container Platform web console, navigate to Operators
Installed Operators. -
Enter
Confidential compute attestationin the Search by name field. - Click the Operator to open it and then click the KbsConfig tab.
-
Click the Options menu
and select Delete KbsConfig. - Click Delete in the confirmation window.
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.2.1.2. Uninstalling the Confidential compute attestation Operator Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall the Confidential compute attestation Operator by using OpenShift Container Platform web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KbsConfigcustom resource.
Procedure
-
Navigate to Operators
Installed Operators. -
Enter
Confidential compute attestationin the Search by name field. On the right side of the Operator Details page, select Uninstall Operator from the Actions list.
An Uninstall Operator? dialog box is displayed.
- Click Uninstall to remove the Operator, Operator deployments, and pods.
-
Navigate to Administration
Namespaces. -
Enter
trustee-operator-systemin the Search by name field. -
Click the Options menu
and select Delete Namespace.
-
In the confirmation dialog, enter
trustee-operator-systemand click Delete.
10.2.1.3. Deleting the KbsConfig CRD Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KbsConfig custom resource definition (CRD) by using the OpenShift Container Platform web console.
Prerequisites
-
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KbsConfigcustom resource. - You have uninstalled the Confidential compute attestation Operator.
Procedure
-
In the web console, navigate to Administration
CustomResourceDefinitions. -
Enter the
KbsConfigname in the Search by name field. - Click the Options menu and select Delete CustomResourceDefinition.
- Click Delete in the confirmation window.
10.2.2. Removing the Confidential Containers environment by using the CLI Copiar enlaceEnlace copiado en el portapapeles!
You can remove the Confidential Containers environment by using the command-line interface (CLI).
10.2.2.1. Deleting the KbsConfig custom resource Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KbsConfig custom resource (CR) by using the command line.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. - You have uninstalled OpenShift sandboxed containers.
Procedure
Delete the
KbsConfigCR by running the following command:oc delete kbsconfig kbsconfig
$ oc delete kbsconfig kbsconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that the custom resource was deleted by running the following command:
oc get kbsconfig kbsconfig
$ oc get kbsconfig kbsconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
No kbsconfig instances exist
No kbsconfig instances existCopy to Clipboard Copied! Toggle word wrap Toggle overflow
When uninstalling OpenShift sandboxed containers deployed using a cloud provider, you must delete all of the pods. Any remaining pod resources might result in an unexpected bill from your cloud provider.
10.2.2.2. Uninstalling the Confidential compute attestation Operator Copiar enlaceEnlace copiado en el portapapeles!
You can uninstall the Confidential compute attestation Operator by using the command line.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted the
KbsConfigcustom resource.
Procedure
Delete the subscription by running the following command:
oc delete subscription trustee-operator -n trustee-operator-system
$ oc delete subscription trustee-operator -n trustee-operator-systemCopy to Clipboard Copied! Toggle word wrap Toggle overflow Delete the namespace by running the following command:
oc delete namespace trustee-operator-system
$ oc delete namespace trustee-operator-systemCopy to Clipboard Copied! Toggle word wrap Toggle overflow
10.2.2.3. Deleting the KbsConfig CRD Copiar enlaceEnlace copiado en el portapapeles!
You can delete the KbsConfig custom resource definition (CRD) by using the command line.
Prerequisites
-
You have installed the OpenShift CLI (
oc). -
You have access to the cluster as a user with the
cluster-adminrole. -
You have deleted all pods that use
kataorkata-remoteas theruntimeClass. -
You have deleted the
KbsConfigcustom resource. - You have uninstalled the Confidential compute attestation Operator.
Procedure
Delete the
KbsConfigCRD by running the following command:oc delete crd kbsconfigs.confidentialcontainers.org
$ oc delete crd kbsconfigs.confidentialcontainers.orgCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that the CRD was deleted by running the following command:
oc get crd kbsconfigs.confidentialcontainers.org
$ oc get crd kbsconfigs.confidentialcontainers.orgCopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Unknown CRD kbsconfigs.confidentialcontainers.org
Unknown CRD kbsconfigs.confidentialcontainers.orgCopy to Clipboard Copied! Toggle word wrap Toggle overflow