Uninstalling QRadar Suite Software in an air-gapped environment

You can uninstall an instance of IBM Security QRadar® Suite Software by using the CLI, or uninstall all instances in a cluster.

Before you begin

Note:

Complete a backup before uninstallation.

Uninstalling QRadar Suite Software deletes all data that is associated with QRadar Suite Software. For more information about completing a backup, see Backup and restore.

The Red Hat OpenShift CLI client helps you develop, build, deploy, and run your applications on any Red Hat OpenShift or Kubernetes cluster. It also includes the administrative commands for managing a cluster under the adm subcommand.
1. Download Red Hat OpenShift CLI 4.10 or later from https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/stable-4.10/. The file to download is called openshift-client-<platform>-<version>.tar.gz.
2. Extract the binary file that you downloaded by typing the following command, where <oc_cli_archive_file> is the name of the archive file that you downloaded.
```
tar -xf <oc_cli_archive_file>
```
3. Modify the permissions of the binary file by typing the following command, where <oc_cli_binary> is the name of the Red Hat OpenShift binary that you extracted from the archive.
```
chmod 755 <oc_cli_binary>
```
4. Move the binary file to the /usr/local/bin directory by typing the following command.
```
mv <oc_cli_binary> /usr/local/bin/oc
```
  Tip: If this command returns a No such file or directory or Not a directory error message, create the /usr/local/bin directory by typing the following command.
```
sudo mkdir /usr/local/bin
```
5. Ensure that the Red Hat OpenShift CLI client is working by typing the following command.
```
oc version
```
  Tip: MacOS users might see a message that this tool cannot be opened because it is from an unidentified developer. Close this message and go to System Preferences > Security & Privacy. On the General tab, click Open Anyway or Allow Anyway. Repeat the oc version command.

1. Download the latest version of the plug-in.
  - To download the latest release version from the public GitHub repo on MacOS, type the following command.
```
curl -L https://github.com/IBM/ibm-pak-plugin/releases/latest/download/oc-ibm_pak-darwin-amd64.tar.gz -o oc-ibm_pak-plugin.tar.gz
```
  - To download the latest release version from the public GitHub repo on Linux®, type the following command.
```
curl -L https://github.com/IBM/ibm-pak-plugin/releases/latest/download/oc-ibm_pak-linux-amd64.tar.gz -o oc-ibm_pak-plugin.tar.gz
```
2. Extract the plug-in from the archive file by typing the following command.
```
tar -xvf oc-ibm_pak-plugin.tar.gz
```
3. Move the extracted plug-in to your /usr/local/bin directory by typing the following command.
```
mv oc-ibm_pak-*-amd64 /usr/local/bin/oc-ibm_pak
```
4. Verify that the plug-in is installed successfully by typing the following command.
```
oc ibm-pak --version
```

1. If you need to download the CASE files to a new mirroring device, follow the instructions in the Setting environment variables and downloading CASE files section of Installing QRadar Suite Software in an air-gapped environment by using a bastion host or Installing QRadar Suite Software in an air-gapped environment by using a portable device.
2. After you complete those steps, disconnect your mirroring device from the internet and connect it to your air-gapped environment.

Procedure

Log in to your Red Hat OpenShift Container Platform cluster as a cluster administrator by typing one of the following commands, where <openshift_url> is the URL for your Red Hat OpenShift Container Platform environment.
- Using a username and password.
```
oc login <openshift_url> -u <cluster_admin_user> -p <cluster_admin_password>
```
- Using a token.
```
oc login --token=<token> --server=<openshift_url>
```
Set the $CP4S_NAMESPACE environment variable by typing the following command, where <cp4s_namespace> is the namespace where you are installing QRadar Suite Software.
```
export CP4S_NAMESPACE=<cp4s_namespace>
```
Set the following environment variables with the installer image name and the image inventory by typing the following command.
```
export CASE_NAME=ibm-cp-security && export CASE_VERSION=1.0.42
```

Uninstall QRadar Suite Software by typing the following command.

oc ibm-pak launch -t 1 $CASE_NAME --version $CASE_VERSION --inventory ibmSecurityOperatorSetup --namespace $CP4S_NAMESPACE --action uninstall

If you do not have any other instances of QRadar Suite Software on your cluster, delete the catalog sources and image content source policies from the openshift-marketplace namespace, and the CRDs from the cluster, by typing the following command.
```
oc ibm-pak launch -t 1 $CASE_NAME --version $CASE_VERSION --inventory ibmSecurityOperatorSetup --namespace $CP4S_NAMESPACE --action uninstall --args "--deleteCrd --airgap"
```

If you do not have any other IBM Cloud® Paks on your cluster, you can uninstall IBM Cloud foundational services by typing the following command, where <foundational_services_namespace> is the namespace where foundational services is installed..

oc ibm-pak launch -t 1 $CASE_NAME --version $CASE_VERSION --inventory ibmSecurityOperatorSetup --namespace <foundational_services_namespace> --action uninstall-foundationalservices --args "--inputDir ~/.ibm-pak/data/cases/$CASE_NAME/$CASE_VERSION"