Uninstall Anthos Service Mesh

This page explains how to uninstall Anthos Service Mesh.

Uninstall Anthos Service Mesh

Use the following commands to uninstall all Anthos Service Mesh components. These commands also delete the istio-system namespace and all custom resource definitions (CRDs), including any CRDs that you applied.

  1. To prevent interruption of application traffic:

    • Downgrade any STRICT mTLS policies to PERMISSIVE.
    • Remove any AuthorizationPolicy that may block traffic.
  2. Disable Automatic Managed Anthos Service Mesh through the Fleet API, if it is enabled.

  3. Disable sidecar auto-injection on your namespace(s), if it is enabled. Run the following command to display namespace labels:

     kubectl get namespace YOUR_NAMESPACE --show-labels
    

    The output is similar to the following:

     NAME   STATUS   AGE     LABELS
     demo   Active   4d17h   istio.io/rev=asm-181-5

    If you see istio.io/rev= in the output under the LABELS column, remove it:

     kubectl label namespace YOUR_NAMESPACE istio.io/rev-
    

    If you see istio-injection in the output under the LABELS column, remove it:

     kubectl label namespace YOUR_NAMESPACE istio-injection-
    

    If you don't see either the istio.io/rev or istio-injection labels, then auto-injection wasn't enabled on the namespace.

  4. Restart your workloads that have sidecars injected to remove the proxies.

  5. If you're using managed Anthos Service Mesh, remove any controlplanerevision resources in the cluster:

    kubectl delete controlplanerevision RELEASE_CHANNEL -n istio-system
    

    Where RELEASE_CHANNEL is the release channel you provisioned, such as asm-managed, asm-managed-rapid, or asm-managed-stable.

  6. Delete webhooks from your cluster, if they exist.

    In-cluster Anthos Service Mesh

    Delete the validatingwebhooksconfiguration and mutatingwebhookconfiguration.

    kubectl delete validatingwebhookconfiguration,mutatingwebhookconfiguration -l operator.istio.io/component=Pilot
    

    Managed Anthos Service Mesh

    A. Delete the validatingwebhooksconfiguration.

    kubectl delete validatingwebhookconfiguration istiod-istio-system-mcp
    

    B. Delete the mutatingwebhookconfiguration.

    kubectl delete mutatingwebhookconfiguration RELEASE_CHANNEL
    
  7. Once all workloads come up and no proxies are observed, then you can safely delete the in-cluster control plane to stop billing. If you deployed a managed control plane, then it is automatically deleted with the previous step.

    To remove the in-cluster control plane, run the command below:

    istioctl x uninstall --purge
    

    If there are no other control planes, you can delete the istio-system namespace to get rid of all Anthos Service Mesh resources. Otherwise, delete the services corresponding to the Anthos Service Mesh revisions. This avoids deleting shared resources, such as CRDs.

  8. Delete the istio-system and asm-system namespaces:

     kubectl delete namespace istio-system asm-system --ignore-not-found=true
    
  9. Check if the deletions were successful:

     kubectl get ns
    

    The output should indicate a Terminating state and return as shown, otherwise you might have to manually delete any remaining resources in the namespaces and try again.

     NAME                 STATUS       AGE
     istio-system         Terminating  71m
     asm-system           Terminating  71m
    
  10. If you're using managed Anthos Service Mesh, delete the mdp-controller deployment:

     kubectl delete deployment mdp-controller -n kube-system
    
  11. Delete the istio-cni-node daemonset:

     kubectl delete daemonset istio-cni-node -n kube-system
    
  12. Follow the steps to unregister each cluster from your fleet. This step is required even if you deleted the cluster, since deleted clusters may still be registered to your fleet.
{"cc_re__cc_re__cc_by_4_0": ["ta-position=\"footer\"\n  class=\"nocontent\"\n  \n  \n  \n    project-icon=\"https://www.gstatic.com/devrel-devsite/prod/ved7a80da7b7ebda036cad4a1e1d58c3f8a455fd3236cff9178ee907e8348f62c/cloud/images/favicons/onecloud/super_cloud.png\"\n  \n  \n  feedback-type=\"thumb-rating\">\n\n  <button>\n  \n    \n    Send feedback\n  \n  </button>\n</devsite-feedback>\n       \n    \n    \n  \n\n  \n  \n</article>\n\n\n<devsite-content-footer class=\"nocontent\">\n  <p>Except as otherwise noted, the content of this page is licensed under the <a href=\"https://creativecommons.org/licenses/by/4.0/\">Creative Commons Attribution 4.0 License</a>, and code samples are licensed under the <a href=\"https://www.apache.org/licenses/LICENSE-2.0\">Apache 2.0 License</a>. For details, see the <a href=\"https://developers.google.com/site-policies\">Google Developers Site Policies</a>. Java is a registered trademark of Oracle and/or its affiliates.</p>\n  <p>Last updated 2023-12-04 UTC.</p>\n</devsite-content-footer>\n\n\n<devsite-notification\n>\n</devsite-notification>\n\n\n  \n<div class=\"devsite-content-data\">\n  "]}