Uninstalling Istio on GKE

Beta

This product is covered by the Pre-GA Offerings Terms of the Google Cloud Platform Terms of Service. Pre-GA products may have limited support, and changes to pre-GA products may not be compatible with other pre-GA versions. For more information, see the launch stage descriptions.

This guide shows you how to uninstall the Istio on GKE add-on from a cluster.

Removing Istio from a cluster

The simplest way to remove the Istio on GKE add-on is to delete the cluster. However, if the cluster has an existing application that must be preserved, disabling Istio requires the following steps:

1. Ensure your default mTLS mode is set to Permissive mTLS.
2. Shift traffic away from the Istio ingress gateway.
3. Turn off sidecar auto-injection, if enabled.

   kubectl label namespace your-namespace istio-injection=disabled
   

4. Restart application pods (for example using rolling restart) to remove the Envoy sidecars.
5. Remove the Istio control plane with gcloud:

   gcloud beta container clusters update my-cluster --project=$PROJECT_ID \
     --update-addons=Istio=DISABLED
   

6. Some versions of the Istio on GKE add-on deliberately leave behind some Istio resources to support non-disruptive migration workflows. To completely remove all Istio resources:
   1. Wait a few minutes for the Istio operator to delete any resources it installed.
   2. Delete the istio-system namespace if it exists:

      kubectl delete ns istio-system

   3. Delete the Istio CustomResourceDefinitions:

      kubectl delete crd $(kc get crd | grep istio.io | cut -d " " -f 1)