Uninstall in-cluster Cloud Service Mesh

This page explains how to uninstall in-cluster Cloud Service Mesh if you are using the Istio APIs. If you are using Compute Engine APIs, no steps are necessary. See the Cloud Service Mesh overview to understand the differences.

Following these instructions to uninstall in-cluster Cloud Service Mesh removes all configurations.

If you are uninstalling managed Cloud Service Mesh, follow the managed uninstallation guide instead.

If you are migrating from in-cluster to managed, follow the Migration guide instead.

Uninstall Cloud Service Mesh

Use the following commands to uninstall all Cloud Service Mesh components.

1. To prevent interrupting application traffic:

   • Downgrade any STRICT mTLS policies to PERMISSIVE.
   • Remove any AuthorizationPolicy that may block traffic.

2. Disable sidecar auto-injection on your namespace(s), if it is enabled. Run the following command to display namespace labels:

   kubectlgetnamespaceYOUR_NAMESPACE--show-labels
   

   The output is similar to the following:

   NAMESTATUSAGELABELS
   demoActive4d17histio.io/rev=asm-181-5

   If you see istio.io/rev= in the output under the LABELS column, remove it:

   kubectllabelnamespaceYOUR_NAMESPACEistio.io/rev-
   

   If you see istio-injection in the output under the LABELS column, remove it:

   kubectllabelnamespaceYOUR_NAMESPACEistio-injection-
   

   If you don't see either the istio.io/rev or istio-injection labels, then auto-injection wasn't enabled on the namespace.

3. Restart your workloads that have sidecars injected to remove the proxies.

4. Delete the validatingwebhooksconfiguration and mutatingwebhookconfiguration from your cluster, if they exist:

   kubectldeletevalidatingwebhookconfiguration,mutatingwebhookconfiguration-loperator.istio.io/component=Pilot,istio.io/owned-by!=mesh.googleapis.com
   

5. Once all workloads come up and no proxies are observed, then you can safely delete the in-cluster control plane to stop billing.

   To remove the in-cluster control plane, run the following command:

   istioctluninstall--purge
   

   If there are no other control planes, you can delete the istio-system namespace to get rid of all Cloud Service Mesh resources. Otherwise, delete the services corresponding to the Cloud Service Mesh revisions. This avoids deleting shared resources, such as CRDs.

6. Optionally, Remove Istio CRs, Isto CRDs, istio-(revision) configmap, asm-options configmap, istio-system and asm-system namespaces to remove service mesh from the cluster or use them in another Istio API compatible service mesh.

   1. Remove Istio CRs:

      kubectldeletegateways,virtualservices,destinationrules,serviceentries,envoyfilters,sidecars,peerauthentications,requestauthentications,authorizationpolicies,telemetries,wasmplugins,proxyconfigs--all--all-namespaces
      

   2. Remove Istio CRDs:

      kubectlgetcrds-oname|grep--color=never'istio.io'|xargskubectldelete
      

   3. Remove istio-(revision) configmap. You can skip this step if you delete the istio-system namespace.

      kubectldeleteconfigmapistio-RELEASE_CHANNEL-nistio-system
      

      Replace RELEASE_CHANNEL with your release channel

   4. Remove istio-system namespace:

      kubectldeletenamespaceistio-system--ignore-not-found=true
      

   5. Remove asm-system namespace:

      kubectldeletenamespaceasm-system--ignore-not-found=true
      

      1. Check if the deletions were successful:

         kubectlgetns
         ```
         Theoutputshouldindicatea`Terminating`stateandreturnasshown,
         otherwiseyoumighthavetomanuallydeleteanyremainingresourcesin
         thenamespacesandtryagain.
         ```sh
         NAMESTATUSAGE
         istio-systemTerminating71m
         asm-systemTerminating71m
         ```
         

7. If you will delete your clusters, or have already deleted them, ensure that each cluster is unregistered from your fleet.

8. If you plan to stop using Cloud Service Mesh at the fleet level, disable the service mesh feature for your fleet host project.

   gcloudcontainerhubmeshdisable--projectFLEET_PROJECT_ID
   

   Where FLEET_PROJECT_ID is the ID of your Fleet Host project.

Once you've completed these steps, all Cloud Service Mesh components, including proxies, in-cluster certificate authorities, and RBAC roles and bindings, are systematically removed from the cluster. During the installation process, a Google-owned service account is granted the necessary permissions to establish the service mesh resources within the cluster. These uninstall instructions don't revoke these permissions, allowing for a seamless re-activation of Cloud Service Mesh in the future.