Chapter 6. Uninstalling Red Hat Advanced Cluster Security for Kubernetes

Procedure

• Delete the stackrox namespace:

  • On OpenShift Container Platform:

    $ oc delete namespace stackrox

    Copy to Clipboard Toggle word wrap

  • On Kubernetes:

    $ kubectl delete namespace stackrox

    Copy to Clipboard Toggle word wrap

Procedure

• To delete the global resources by using the OpenShift Container Platform CLI, perform the following steps:

  1. Retrieve all the StackRox-related cluster roles, cluster role bindings, roles, role bindings, and PSPs, and then delete them by running the following command:

     $ oc get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs oc delete --wait

     Copy to Clipboard Toggle word wrap
     Note

     You might receive the error: the server doesn’t have a resource type "psp" error message in RHACS 4.4 and later versions because the pod security policies (PSPs) are deprecated. The PSPs were removed from Kubernetes in version 1.25, except for clusters with older Kubernetes versions.

  2. Delete the custom security context constraints (SCCs) labeled with app.kubernetes.io/name=stackrox by running the following command:

     $ oc delete scc -l "app.kubernetes.io/name=stackrox"

     Copy to Clipboard Toggle word wrap
     Note

     You might receive the No resources found error message in RHACS 4.4 and later versions because the custom SCCs with this label are no longer used in these versions.

  3. Delete the ValidatingWebhookConfiguration object named stackrox by running the following command:

     $ oc delete ValidatingWebhookConfiguration stackrox

     Copy to Clipboard Toggle word wrap

• To delete the global resources by using the Kubernetes CLI, perform the following steps:

  1. Retrieve all the StackRox-related cluster roles, cluster role bindings, roles, role bindings, and PSPs, and then delete them by running the following command:

     $ kubectl get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs kubectl delete --wait

     Copy to Clipboard Toggle word wrap
     Note

     You might receive the error: the server doesn’t have a resource type "psp" error message in RHACS 4.4 and later versions because the pod security policies (PSPs) are deprecated. The PSPs were removed from Kubernetes in version 1.25, except for clusters with older Kubernetes versions.

  2. Delete the ValidatingWebhookConfiguration object named stackrox by running the following command:

     $ kubectl delete ValidatingWebhookConfiguration stackrox

     Copy to Clipboard Toggle word wrap

Procedure

• Delete labels and annotations:

  • On OpenShift Container Platform:

    $ for namespace in $(oc get ns | tail -n +2 | awk '{print $1}'); do     oc label namespace $namespace namespace.metadata.stackrox.io/id-;     oc label namespace $namespace namespace.metadata.stackrox.io/name-;     oc annotate namespace $namespace modified-by.stackrox.io/namespace-label-patcher-;   done

    Copy to Clipboard Toggle word wrap

  • On Kubernetes:

    $ for namespace in $(kubectl get ns | tail -n +2 | awk '{print $1}'); do     kubectl label namespace $namespace namespace.metadata.stackrox.io/id-;     kubectl label namespace $namespace namespace.metadata.stackrox.io/name-;     kubectl annotate namespace $namespace modified-by.stackrox.io/namespace-label-patcher-;   done

    Copy to Clipboard Toggle word wrap