Uninstall istio (all components) completely from kubernetes cluster

Question

I installed istio using these commands:

VERSION = 1.0.5
GCP = gcloud
K8S = kubectl

@$(K8S) apply -f istio-$(VERSION)/install/kubernetes/helm/istio/templates/crds.yaml
@$(K8S) apply -f istio-$(VERSION)/install/kubernetes/istio-demo-auth.yaml
@$(K8S) get pods -n istio-system
@$(K8S) label namespace default istio-injection=enabled
@$(K8S) get svc istio-ingressgateway -n istio-system

Now, how do I completely uninstall it including all containers/ingress/egress etc (everthing installed by istio-demo-auth.yaml?

Thanks.

score 31 · Answer 1 · answered Mar 16 '21 at 19:24

31

If you used istioctl, it's pretty easy:

istioctl x uninstall --purge

Of course, it would be easier if that command were listed in istioctl --help...

Reference: https://istio.io/latest/docs/setup/install/istioctl/#uninstall-istio

answered Mar 16 '21 at 19:24

Tin Can

2,540
2
29
39

Muhammad Soliman · Answer 2 · 2020-05-06T17:31:55.383

Based on their documentation here, you can generate all specs as yml file then pipe it to simple kubectl's delete operation

istioctl manifest generate <your original installation options> | kubectl delete -f -

here's an example:

istioctl manifest generate --set profile=default | kubectl delete -f -

A drawback of this approach though is to remember all options you have used when you installed istio which might be quite hard to remember especially if you enabled specific components.

If you have installed istio using helm's chart, you can uninstall it easily

First, list all installed charts:

helm list -n istio-system
NAME    NAMESPACE   REVISION    UPDATED                                 STATUS   
istiod  istio-system    1       2020-03-07 15:01:56.141094 -0500 EST    deployed

and then delete/uninstall the chart using the following syntax:

helm delete -n istio-system --purge istio-system
helm delete -n istio-system --purge istio-init
...

Check their website for more information on how to do this.

If you already installed istio using istioctl or helm in its own separate namespace, you can easily delete completely that namespace which will in turn delete all resources created inside it.

kubectl delete namespace istio-system

score 10 · Answer 3 · answered Jan 18 '19 at 21:39

10

Just run kubectl delete for the files you applied.

kubectl delete -f istio-$(VERSION)/install/kubernetes/istio-demo-auth.yaml

You can find this in docs as well.

answered Jan 18 '19 at 21:39

f.loris

911
1
13
25

Istio CRDs are installed through a Job+ConfigMap so this will not remove them. – CashIsClay Aug 21 '20 at 14:19

score 7 · Answer 4 · answered Apr 18 '19 at 09:45

If you have installed it as described, then you will need to delete it in the same way.

kubectl delete -f istio-$(VERSION)/install/kubernetes/helm/istio/templates/crds.yaml
kubectl delete -f istio-$(VERSION)/install/kubernetes/istio-demo-auth.yaml

Then you would manually delete the folder, and istioctl, if you moved to anywhere.

IMPORTANT: Deleting a namespace is super comfortable to clean up, but you can't do it for all scenarios. In this situation, if you delete the namespace only, you are leaving all the permissions and credentials intact. Now, say you want to update Istio, and Istio team has made some security changes in their RBAC rules, but has not changed the name of the object. You would deploy the new yaml file, and it will throw an error saying the object (for example clusterrolebinding) already exists. If you don't pay attention to what that error was, you can end up with the worse type of errors (when there are no error, but something goes wrong).

score 6 · Answer 5 · answered Apr 17 '19 at 16:00

Cleaning up Istio is a bit tricky, because of all the things it adds: CustomResourceDefinitions, ConfigMaps, MutatingWebhookConfigurations, etc. Just deleting the istio-system namespace is not sufficient. The safest bet is to use the uninstall instructions from istio.io for the method you used to install.

Kubectl: https://istio.io/docs/setup/kubernetes/install/kubernetes/#uninstall

Helm: https://istio.io/docs/setup/kubernetes/install/helm/#uninstall

When performing these steps, use the version of Istio you are attempting to remove. So if you are trying to remove Istio 1.0.2, grab that release from istio.io.

hmharsh3 · Answer 6 · 2020-12-24T09:03:48.173

After normal istio uninstall (depending on the way istio was installed by helm or istioctl) following steps can be performed

Check if anything still exists in the istio-system namespace, if exists then delete manually, also remove the istio-system namespace
Check if there is a sidecar associated with any pod (sometimes sidecars not get cleaned up in case of failed uninstallation)

kubectl get pods -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.namespace}{"\t"}{..image}{"\n\n"}{end}' -A | grep 'istio/proxyv' | grep -v istio-system

Get the CRD that is still in use and remove associated resources

kubectl get crds | grep 'istio.io' | cut -f1-1 -d "." |     xargs -n1 -I{} bash -c "  echo {} && kubectl get --all-namespaces  {} -o wide  && echo -e '---'"

Delete all the CRD

kubectl get crds | grep 'istio.io' |   xargs -n1 -I{} sh -c "kubectl delete crd {}"

Edit the labels back (optional)

kubectl label default <namespace name> istio-injection=disabled

score 1 · Answer 7 · answered Jan 08 '20 at 13:59

Don't forget to disable the injection:

kubectl delete -f istio-$(VERSION)/install/kubernetes/helm/istio/templates/crds.yaml
kubectl delete -f istio-$(VERSION)/install/kubernetes/istio-demo-auth.yaml
kubectl label default your-namespace istio-injection=disabled

Montaro · Answer 8 · 2020-05-10T02:38:10.197

1

Using the profile you used in installation, demo for example, run the following command istioctl manifest generate --set profile=demo | kubectl delete -f -

edited May 10 '20 at 02:38

answered May 10 '20 at 00:33

Montaro

9,240
6
29
30

score 0 · Answer 9 · answered Jan 18 '19 at 21:48

0

Just delete the ns

k delete ns istio-system

answered Jan 18 '19 at 21:48

7

Common mistake. By deleting the namespace, you just delete the control plane, not the credentials/permissions. – suren Apr 18 '19 at 09:37
2

This won't delete the CRDs as well – Joao Cunha Jul 19 '19 at 11:00
2

This will leave MutatingWebhooks and other potentially problematic configuration. – Isaiah Snell-Feikema Aug 05 '19 at 18:05

score 0 · Answer 10 · answered Nov 08 '20 at 20:48

0

Deleting CRDs without needing to find the helm charts:

kubectl delete crd -l chart=istio

answered Nov 08 '20 at 20:48

Gerry

10,584
4
41
49

score -1 · Answer 11 · answered Dec 01 '19 at 20:35

Hi if you installated via helm-template you can use these commands :

For CRD's:

$ helm template ${ISTIO_BASE_DIR}/install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl delete -f -

$ kubectl delete crd $(kubectl get crd |grep istio)

For Deployment/NS..etc other resources:

$     helm template install/kubernetes/helm/istio --name istio --namespace istio-system\
    --values install/kubernetes/helm/istio/values-istio-demo.yaml \
    --set global.controlPlaneSecurityEnabled=true \
    --set global.mtls.enabled=true | kubectl delete -f -

Uninstall istio (all components) completely from kubernetes cluster

11 Answers11

Linked