cloudtaser-cli target uninstall

Removes CloudTaser components from the Kubernetes cluster.

Vault cleanup (enabled by default with --vault-cleanup): 0. Establish admin proxy relay to vault via port-forward 1. Delete vault roles (cloudtaser, cloudtaser-operator) 2. Delete vault policies (cloudtaser, cloudtaser-operator) 3. Delete per-cluster KV paths (port certs, beacon salt, config) 4. Delete port JWKS

K8s cleanup (always): 1. helm uninstall cloudtaser -n cloudtaser-system

With --uninstall-port: 2. Remove the cloudtaser-port release from --port-namespace, after core removal succeeds. Use only for a Port dedicated to this installation. The source, namespace and retained ephemeral-container admission guard are preserved.

With --clean (thorough K8s removal): 2. Delete only verified release-owned leftovers; retain customer namespaces and PVCs 3. Delete release-owned empty CloudTaser CRDs and remaining cluster RBAC Node files and public runtime objects are removed by the stored chart cleanup hooks.

Vault cleanup runs BEFORE helm uninstall because the admin proxy relay (needed to reach vault) is destroyed by helm uninstall.

Usage

cloudtaser-cli target uninstall [flags]

Examples

# Uninstall with vault cleanup
  cloudtaser-cli target uninstall --secretstore-address https://vault.example.com --secretstore-token-file /path/to/token

  # Uninstall without vault cleanup
  cloudtaser-cli target uninstall --vault-cleanup=false

  # Remove an installation created with target install --install-port
  cloudtaser-cli target uninstall --uninstall-port --port-namespace cloudtaser-vault --vault-cleanup=false

  # Full cleanup including vault and verified release-owned leftovers
  cloudtaser-cli target uninstall --clean --secretstore-address https://vault.example.com

Flags

Flag	Type	Default	Required	Description
--broker-allow-insecure	bool	false	no	allow plain HTTP to operator broker (development only)
--broker-auth-token	string	(empty)	no	broker auth token (auto-detected if omitted)
--broker-ca	string	(empty)	no	path to PEM CA bundle for operator broker TLS (default: auto-fetch)
--clean	bool	false	no	remove verified release-owned leftovers; retain customer namespaces and PVCs
--help, -h	bool	false	no	help for uninstall
--kubeconfig	string	(empty)	no	path to kubeconfig file
--operator-namespace	string	cloudtaser-system	no	namespace where CloudTaser operator is deployed
--port-namespace	string	cloudtaser-vault	no	namespace of the dedicated managed Port to remove with --uninstall-port
--release-name	string	cloudtaser	no	helm release name
--secretstore-address	string	(empty)	no	secret store address for cleanup (required when --secretstore-cleanup=true and operator v0.13.0+ detected; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-auth-path	string	kubernetes	no	secret store authentication mount path
--secretstore-cleanup	bool	true	no	remove CloudTaser-managed data from the secret store
--secretstore-namespace	string	(empty)	no	secret store enterprise namespace
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--uninstall-port	bool	false	no	also uninstall the dedicated managed Port release after core removal; never use for a shared Port

All commands