Why Does a Service Mesh Remain in the Unready State for a Long Time After I Uninstall It?

Symptom

On the ASM console, after I uninstall a service mesh, it remains in the unready state for a long time.

Fault Diagnosis

1. Log in to the CCE console. Click the cluster name to go to the cluster console. In the navigation pane, choose App Templates.
2. Click Releases and select the target cluster from the drop-down list. Check the releases and the latest events about uninstallation failure.

   The Status of istio-master is Uninstallation Failed, and the following message is displayed.

   deletion failed with 1 error(s): clusterroles:rbac.authorization.k8s.io "istio-cleanup-secrets-istio-system" already exists

Analysis

Abnormal operations cause the Helm chart of Istio stuck during uninstallation. Residual resources lead to an uninstallation failure.

Solution

1. Connect to the CCE cluster using kubectl.
2. Run the following commands to clear Istio resources:

   kubectl delete ServiceAccount -n istio-system `kubectl get ServiceAccount -n istio-system | grep istio | awk '{print $1}'`
   kubectl delete ClusterRole -n istio-system `kubectl get ClusterRole -n istio-system | grep istio | awk '{print $1}'`
   kubectl delete ClusterRoleBinding -n istio-system `kubectl get ClusterRoleBinding -n istio-system | grep istio | awk '{print $1}'`
   kubectl delete job -n istio-system `kubectl get job -n istio-system | grep istio | awk '{print $1}'`
   kubectl delete crd -n istio-system `kubectl get crd -n istio-system | grep istio | awk '{print $1}'`
   kubectl delete mutatingwebhookconfigurations -n istio-system `kubectl get mutatingwebhookconfigurations -n istio-system | grep istio | awk '{print $1}'`

3. Log in to the ASM console and uninstall the service mesh again.