Uninstalling QRadar EDR by using the Red Hat OpenShift Console

Edit online

You can uninstall an instance of IBM® Security QRadar® EDR by using the Red Hat® OpenShift® Console.

About this task

Uninstalling QRadar EDR deletes all data that is associated with QRadar EDR. Complete a backup procedure before uninstallation. For more information, see Backup and restore.

Procedure

  1. Log in to the Red Hat OpenShift Console for your cluster.
  2. Go to Operators > Installed Operators and ensure that the Project is set to the namespace where QRadar EDR is installed.
  3. Click the IBM Security QRadar EDR operator.
  4. Go to the QRadar EDR tab and find the reaqta instance.
  5. Click the action menu next to reaqta and select Delete IBMSecurityReaQta.
    The QRadar EDR objects that depend on reaqta are removed. This process takes approximately 8 - 10 minutes.

What to do next

Uninstalling QRadar EDR by using the Red Hat OpenShift Console doesn't uninstall foundational services. If you need to uninstall foundational services, see Uninstalling foundational services.

Uninstalling foundational services

Edit online

About this task

If you don't have any other instances of QRadar EDR in your cluster, uninstall foundational services.

Procedure

  1. Log in to the Red Hat OpenShift Console for your cluster.
  2. Uninstall the IBM Cloud Pak®foundational services operator.
    1. Go to Operators > Installed Operators and ensure that the Project is set to the ibm-common-services namespace.
    2. Click the action menu next to IBM Cloud Pak foundational services and click Uninstall Operator.
  3. Delete the operator APIs from the ibm-common-services namespace.
    1. Go to Operators > Installed Operators and click Operand Deployment Lifecycle Manager.
    2. On the OperandRequest tab, delete each instance. Wait until all instances are deleted before you continue to the next step.
    3. On the OperandConfig tab, delete each instance. Wait until all instances are deleted before you continue to the next step.
    4. On the OperandRegistry tab, delete each instance. Wait until all instances are deleted before you continue to the next step.
    5. Go to Operators > Installed Operators and click IBM NamespaceScope Operator.
    6. On the Namespace Scope tab, delete each instance. Wait until all instances are deleted before you continue to the next step.
    7. Go to Operators > Installed Operators > IBM Licensing > IBM License Service Reporter.
    8. Optional: If you have deployed the IBM License Service Reporter, delete each IBM License Service Reporter instance.
    9. Go to Operators > Installed Operators > IBM Licensing > IBM License Service.
    10. Delete each IBM License Service instance.
  4. Uninstall the IBM NamespaceScope Operator.
    1. Go to Operators > Installed Operators.
    2. Click the action menu () next to NamespaceScope Operator and click Uninstall Operator.
  5. Uninstall the IBM Licensing Operator.
    1. Go to Operators > Installed Operators.
    2. Click the action menu () next to Licensing operator and click Uninstall Operator.
  6. Uninstall the Operand Deployment Lifecycle Manager operator.
    1. Go to Operators > Installed Operators and ensure that the Project is set to the openshift-operators namespace.
    2. Click the action menu next to Operand Deployment Lifecycle Manager and click Uninstall Operator.

Uninstalling the operators and catalog sources

Edit online

Procedure

  1. Log in to the Red Hat OpenShift Console for your cluster.
  2. From the menu, click Operators > Installed Operators.
  3. For Project, select All Project options.
  4. Uninstall each operator by clicking he action menu () for each operator and clicking Uninstall Operator.
  5. Delete the CatalogSource for the operators.
    Tip: Do not delete the CatalogSource if you are using other operators from the same catalog source.
    1. Click Administration > Cluster Settings.
    2. Go to the Global Configuration tab and then click OperatorHub.
    3. On the Sources tab, delete the catalog sources for ibm-operator-catalog.
  6. Delete the targeted namespace.
    1. Go to Home > Project.
    2. Search for the <qradar_edr_namespace>.
    3. Click the action menu () next to the project name and click Delete Project.
    Important: If the project remains in a Terminating state, see A namespace is stuck in the Terminating state for troubleshooting information.