Uninstall c8s

Stop encrypted-volume consumers

Scale workloads using c8s encrypted volumes to zero and wait for their pods to terminate while volumed is still running. This lets it close their dm-crypt/dm-verity mappings.

When the release has volumed enabled, uninstall checks for nonterminal pods with c8s volume requests and refuses to continue while any remain. --force bypasses that check, but a live consumer can keep mappings and backing disks open, and the pre-delete cleanup hook can fail. It does not force a busy mapping closed.

Select the release and deletion scope

Use the namespace and release name supplied at installation. Their defaults are c8s-system and c8s:

c8s uninstall --namespace c8s-system --release c8s

The command reads the release's values before removing it, runs Helm uninstall, then sweeps host artifacts. --wait=true and --host-sweep=true are the defaults. The sweep runs a temporary privileged DaemonSet across Linux nodes, including tainted nodes, and removes that DaemonSet after a successful rollout.

Helm's default deletion wait has a five-minute timeout. The sweep separately waits up to five minutes for the release's legacy mesh pods to disappear, even with --wait=false, then allows another five minutes for its DaemonSet rollout. A Helm failure stops the command before the sweep. A sweep failure stops it before either optional deletion below.

Add destructive options only for resources you intend to delete:

• --delete-crds deletes the confidentialworkloads.confidential.ai CRD and every ConfidentialWorkload object in the cluster.
• --delete-namespace deletes the release namespace and everything remaining in it, including separately created image-pull Secrets.

Both options default to false. Without them, the CRD, its objects, and the namespace remain. Deleting these API objects is destructive; uninstall provides no recovery operation.

Check cleanup results

Check the CLI exit status and reported errors. Successful rollout can still leave busy volume devices or mesh state whose cleanup produced only warnings. Those warnings are in sweep pod logs: the CLI does not print them, and it deletes the DaemonSet and its pods after successful rollout. After those pods are deleted, this procedure cannot retrieve their warnings. Use the prearranged node inventory and inspection for operational device accounting. The following table describes the cleanup scope, not a guarantee of complete removal:

On baked c8s nodes, the sweep skips the entire NRI phase and preserves the managed containerd templates. Removing managed containerd registration can restart the runtime. The sweep's device checks do not detect a process holding only a raw device open; stop such consumers before uninstalling.

The sweep replays the script pinned by the installed release when available, otherwise it uses the CLI’s embedded script. Older releases may lack volume-device cleanup; the CLI warns when it detects such a script. After stopping all consumers, have an authorized node administrator run c8s volume detach <NAME> as root on each node where that volume was attached. This requires node-local access and the c8s binary on that node; Kubernetes credentials alone do not provide it. Replace <NAME> with the attached volume's name.

If the sweep DaemonSet fails to complete its rollout after being applied, it remains for inspection. Earlier errors can occur before it exists. For the default release and namespace, list sweep pods with their nodes and read each affected pod's init-container logs:

kubectl -n c8s-system get pods \
  -l app.kubernetes.io/instance=c8s,app.kubernetes.io/component=host-sweep -o wide
kubectl -n c8s-system logs "<SWEEP_POD>" -c sweep

Replace <SWEEP_POD> with a pod name from the listing; repeat for other affected nodes. These are operational diagnostics, not attested evidence of host cleanup.

After inspecting the retained DaemonSet and resolving the failure, remove it. If Helm already removed the release, retry with --host-sweep-only:

kubectl -n c8s-system delete ds c8s-host-sweep
c8s uninstall --namespace c8s-system --release c8s --host-sweep-only

Append any --delete-crds or --delete-namespace options you still intend to execute to the retry command; options from the failed invocation are not retained. The retry uses chart defaults once release values are gone, as described below. If Helm failed and the release still exists, resolve that error and rerun the original uninstall command instead.

Resource deletion and device detachment do not establish erasure of keys, plaintext, or copies held by an adversarial host.