Cleaning everything up
Follow these steps in order. The trust domain cannot be deleted while clusters or node-groups are still registered to it. Pick the tab that matches how you added your cluster.
- Kubernetes
- Linux
1. Remove the demo workload
helm -n spiffe-demo uninstall spiffe-demo
kubectl delete namespace spiffe-demo
2. Deregister the cluster
Disable the cluster first, then delete it:
defakto cluster disable "cluster-1" --trust-domain "example.com"
defakto cluster delete "cluster-1" --trust-domain "example.com"
On success, each command confirms the operation:
Cluster disabled.
Cluster deleted.
3. Remove the Defakto components from your cluster
If your cluster is disposable
Simply delete the kind cluster:
kind delete cluster --name "cluster-1"
If you want to keep the cluster
kubectl delete namespace spirl-system
kubectl delete mutatingwebhookconfiguration spirl-controller-webhook
4. Delete the trust domain
defakto trust-domain delete "example.com"
On success:
Trust domain ‘example.com’ deleted successfully.
Deleted trust domains cannot be recovered. All SPIFFE IDs issued under the domain are permanently invalidated.
5. Log out
defakto logout
1. Remove the verification tool
If you downloaded spirldbg to verify SVID issuance, remove it from the VM:
rm ./spirldbg
2. Deregister the node-group
First, find the config ID for your node-group:
defakto node-group config list my-linux-cluster --trust-domain example.com
Replace <your-config-id> below with the ID returned by the command above, then disable that config and delete the node-group:
defakto node-group config disable my-linux-cluster --config-id <your-config-id>
defakto node-group delete my-linux-cluster --trust-domain example.com
3. Remove the agent from the VM
Stop and disable the service, then remove the package:
sudo systemctl stop spirl-agent.service
sudo systemctl disable spirl-agent.service
# Debian
sudo dpkg -r spirl-agent
# RPM
sudo yum remove spirl-agent
/etc/spirl contains the node-group's private key (*.key.pem). Deleted keys cannot be recovered. Only remove this directory once the node-group has been deregistered in the previous step:
sudo rm -rf /etc/spirl
4. Delete the trust domain
defakto trust-domain delete "example.com"
On success:
Trust domain ‘example.com’ deleted successfully.
Deleted trust domains cannot be recovered. All SPIFFE IDs issued under the domain are permanently invalidated.
5. Log out
defakto logout