Helm TSB Uninstallation

To uninstall TSB, installed using helm, you can use helm uninstall to uninstall a release. Uninstallation must be done in the following order:

1. Control Plane.
2. Management Plane.

TSB prevents the deletion of critical resources, which must be disabled to allow uninstallation. Disable it by annotating the operator deployments, then restarting them.

kubectl annotate -n istio-system deployment tsb-operator-control-plane --overwrite tsb.tetrate.io/deletion-protection=disabled
kubectl annotate -n tsb deployment tsb-operator-management-plane --overwrite tsb.tetrate.io/deletion-protection=disabled

kubectl rollout restart -n istio-system deployment tsb-operator-control-plane
kubectl rollout restart -n tsb deployment tsb-operator-management-plane

Deletion protection can also be disabled by setting this value in each operator's helm values file, then running a helm upgrade.

operator:
  deletionProtection: disabled

hook-init-finalizer Job must be able to schedule

helm uninstall runs a pre-delete hook Job named hook-init-finalizer. If this Job's pod cannot be scheduled or admitted, the uninstall hangs. This happens when the operator runs on tainted or dedicated node pools, or when the namespace enforces a ResourceQuota / LimitRange that requires resource requests on every pod. The hook Job's pod spec is fixed at install time, so configure it before uninstalling, via helm upgrade if needed:

operator:
  hookInitFinalizer:
    tolerations:      # match operator.deployment.tolerations
      - key: dedicated
        operator: Equal
        value: tsb
        effect: NoSchedule
    nodeSelector:
      dedicated: tsb
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        cpu: 100m
        memory: 128Mi

See the control plane and management plane Helm value references for all operator.hookInitFinalizer fields.

Control Plane Uninstallation

helm uninstall cp tetrate-tsb-helm/controlplane --namespace istio-system

Once Helm has removed all the resources associated with the last release of the control plane chart, you will need to manually remove some resources created during the uninstallation process that are untracked by Helm.

kubectl delete serviceaccount tsb-helm-delete-hook --ignore-not-found
kubectl delete clusterrole tsb-helm-delete-hook --ignore-not-found
kubectl delete clusterrolebinding tsb-helm-delete-hook --ignore-not-found
kubectl delete apiservices.apiregistration.k8s.io v1beta1.external.metrics.k8s.io
kubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io xcp-edge-istio-system
kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io xcp-edge-istio-system

Management Plane Uninstallation

info

Skip this step if you are using the Tetrate-hosted Management Plane

helm uninstall mp tetrate-tsb-helm/managementplane --namespace tsb

Once Helm has removed all the resources associated with the last release of the management plane chart, you will need to manually remove some resources created during the uninstallation process that are untracked by Helm.

kubectl delete serviceaccount tsb-helm-delete-hook --ignore-not-found
kubectl delete clusterrole tsb-helm-delete-hook --ignore-not-found
kubectl delete clusterrolebinding tsb-helm-delete-hook --ignore-not-found
kubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io xcp-central-tsb
kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io xcp-central-tsb