This is unreleased documentation for Network Enforcer 0.4-dev.

Kubewarden Network Enforcer Uninstall

The commands below assume the Quick Start defaults: Helm release network-enforcer in namespace network-enforcer. Substitute the names from helm list -A if you installed elsewhere.

Optional: set mode back to monitor

Do this while the controller is still running, before helm uninstall.

When you delete the CRDs later in this guide, Kubernetes removes the generated policies through garbage collection. Use this step only if you want to drop protect before that, without a wait.

On Calico and Cilium the reconciler deletes the NetworkPolicy. On Istio it keeps the AuthorizationPolicy and sets istio.io/dry-run=true:

kubectl get wnp -A --no-headers -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name |
while read -r ns name; do
  kubectl patch wnp "$name" -n "$ns" --type=json \
    -p='[{"op":"replace","path":"/spec/mode","value":"monitor"}]'
done

Uninstall the Helm chart

You can remove Network Enforcer by uninstalling the Helm chart:

helm uninstall network-enforcer --namespace network-enforcer

That removes the controller, the collector, the admission policies, and the RBAC objects. It does not remove the two CRDs. They carry the annotation helm.sh/resource-policy: keep, so that an uninstall does not delete every WorkloadNetworkPolicy and WorkloadNetworkPolicyProposal in the cluster by accident. The policies, the proposals, and the generated NetworkPolicy and AuthorizationPolicy objects all stay in place. In protect mode, the data plane keeps enforcing them.

helm uninstall does not delete the network-enforcer namespace, and it does not delete the CRDs. Follow the next section to remove the policies.

Delete the CRDs

Delete the CRDs to remove every policy and proposal. Kubernetes then deletes the generated NetworkPolicy and AuthorizationPolicy objects through their owner references.

Deleting a CRD deletes every custom resource of that type in the cluster, in every namespace. Only run this when you intend to remove Network Enforcer entirely.

 
kubectl delete crd workloadnetworkpolicies.networkenforcer.kubewarden.io
kubectl delete crd workloadnetworkpolicyproposals.networkenforcer.kubewarden.io

Delete the namespace

kubectl delete ns network-enforcer

Optional: cert-manager

If you installed cert-manager and cert-manager-csi-driver only for Network Enforcer, remove them too. Uninstall the CSI driver first:

helm uninstall cert-manager-csi-driver --namespace cert-manager
helm uninstall cert-manager --namespace cert-manager
kubectl delete ns cert-manager

Skip this section if other workloads in the cluster still need cert-manager.

Optional: provider-side cleanup

These settings belong to the data-plane provider, not to the Network Enforcer chart. Revert them only if you applied them for Network Enforcer and no longer need them. Do not uninstall Istio, Calico, or Cilium unless you also intend to remove that provider from the cluster.

Istio ambient labels

The Quick Start labels application namespaces so istio-cni redirects pod traffic to ztunnel. Remove the namespace from the ambient data plane:

kubectl label namespace default istio.io/dataplane-mode-

Pods already running in ambient mode keep that dataplane until they are recreated. The AMBIENT_ENABLE_DRY_RUN_AUTHORIZATION_POLICY, AUTHZ_POLICY_INFO_LOGGING, and logAsJson flags on istiod and ztunnel can stay; they do not enforce traffic once the generated AuthorizationPolicy objects are gone.

Cilium Hubble settings

The Quick Start enables Hubble and Hubble Relay with TLS (hubble.enabled=true, hubble.relay.enabled=true, hubble.relay.tls.server.enabled=true, hubble.relay.tls.server.mtls=true) and sets policyDenyResponse=icmp so denied egress returns an ICMP error. If you enabled those only for Network Enforcer, restore the values you want on the Cilium Helm release. Leave Hubble in place if you use it for anything else.

Calico Goldmane settings

The Quick Start installs the Tigera operator with goldmane.enabled=true. If you enabled Goldmane only for Network Enforcer, disable it on the Calico Helm release. Leave it enabled if other tools still scrape Goldmane. The goldmane-ca-bundle ConfigMap and the goldmane-key-pair Secret in calico-system are Calico objects, not Network Enforcer objects. The Network Enforcer chart only reads them. helm uninstall removes the Role and RoleBinding that granted that read access.

Verify nothing Network Enforcer owned remains

After the steps above, these commands should all be empty or report NotFound.

helm list -A | grep network-enforcer || true

kubectl get crd | grep networkenforcer.kubewarden.io || true

kubectl get validatingadmissionpolicy,validatingadmissionpolicybinding \
  -l app.kubernetes.io/name=network-enforcer

kubectl get clusterrole,clusterrolebinding \
  -l app.kubernetes.io/name=network-enforcer

# The chart creates a Role and RoleBinding in the provider namespace,
# kube-system for Cilium or calico-system for Calico.
kubectl get role,rolebinding -n kube-system -l app.kubernetes.io/name=network-enforcer
kubectl get role,rolebinding -n calico-system -l app.kubernetes.io/name=network-enforcer

kubectl get ns network-enforcer

kubectl get networkpolicy -A -o yaml | grep -E 'kind: WorkloadNetworkPolicy' || true
kubectl get authorizationpolicy -A -o yaml 2>/dev/null | grep -E 'kind: WorkloadNetworkPolicy' || true