---
title: Uninstalling the Zero Trust Workload Identity Manager
---

# Uninstalling the Zero Trust Workload Identity Manager {#zero-trust-manager-uninstall_{context}}

To remove the Zero Trust Workload Identity Manager from OpenShift Container Platform, uninstall the Operator and delete its related resources. This process removes the component from your cluster.

## Uninstalling the Zero Trust Workload Identity Manager {#zero-trust-manager-uninstall-console_zero-trust-manager-uninstall}

To remove the Zero Trust Workload Identity Manager from your cluster, uninstall the Operator using the web console. This helps you clean up resources and delete the service from your environment.

**Prerequisites**

- You have access to the cluster with `cluster-admin` privileges.
- You have access to the OpenShift Container Platform web console.
- The Zero Trust Workload Identity Manager is installed.

**Procedure**

1. Log in to the OpenShift Container Platform web console.
2. Uninstall the Zero Trust Workload Identity Manager.

   1. Go to **Ecosystem** → **Installed Operators**.
   2. Click the **Options** menu next to the **Zero Trust Workload Identity Manager** entry, and then click **Uninstall Operator**.
   3. In the confirmation dialog, click **Uninstall**.

**Verification**

- Verify that the Zero Trust Workload Identity Manager Operator is uninstalled.

  ```terminal
  $ oc get csv -n openshift-zero-trust-workload-identity
  ```

  ```terminal {title="Example output"}
  No resources found in openshift-zero-trust-workload-identity namespace.
  ```

## Uninstalling Zero Trust Workload Identity Manager resources by using the CLI {#zero-trust-manager-uninstall-resources_zero-trust-manager-uninstall}

Remove Zero Trust Workload Identity Manager resources from your cluster using the CLI. This deletes the remaining operands and definitions to help ensure a clean environment after you uninstall the product.

**Prerequisites**

- You have access to the cluster with `cluster-admin` privileges.

**Procedure**

1. Uninstall the operands by running each of the following commands:

   1. Delete the `SpireOIDCDiscoveryProvider` cluster by running the following command:

      ```terminal
      $ oc delete SpireOIDCDiscoveryProvider cluster
      ```
   2. Delete the `SpiffeCSIDriver` cluster by running the following command:

      ```terminal
      $ oc delete SpiffeCSIDriver cluster -l
      ```
   3. Delete the `SpireAgent` cluster by running the following command:

      ```terminal
      $ oc delete SpireAgent cluster
      ```
   4. Delete the `SpireServer` cluster by running the following command:

      ```terminal
      $ oc delete SpireServer cluster
      ```
   5. Delete the `ZeroTrustWorkloadIdentityManager` cluster by running the following command:

      ```terminal
      $ oc delete ZeroTrustWorkloadIdentityManager cluster
      ```
   6. Delete the persistent volume claim (PVC) by running the following command:

      ```terminal
      $ oc delete pvc -l=app.kubernetes.io/name=spire-server
      ```
   7. Delete the service by running the following command:

      ```terminal
      $ oc delete service -l=app.kubernetes.io/name=zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager
      ```
   8. Delete the namespace by running the following command:

      ```terminal
      $ oc delete ns zero-trust-workload-identity-manager
      ```
   9. Delete the cluster role by running the following command:

      ```terminal
      $ oc delete clusterrole -l=app.kubernetes.io/name=zero-trust-workload-identity-manager
      ```
   10. Delete the admission webhook configuration by running the following command:

       ```terminal
       $ oc delete validatingwebhookconfigurations -l=app.kubernetes.io/name=zero-trust-workload-identity-manager
       ```
2. Delete the custom resource definitions (CRDs) by running each of the following commands:

   1. Delete the SPIRE Server CRD by running the following command:

      ```terminal
      $ oc delete crd spireservers.operator.openshift.io
      ```
   2. Delete the SPIRE Agent CRD by running the following command:

      ```terminal
      $ oc delete crd spireagents.operator.openshift.io
      ```
   3. Delete the SPIFFEE CSI Drivers CRD by running the following command:

      ```terminal
      $ oc delete crd spiffecsidrivers.operator.openshift.io
      ```
   4. Delete the SPIRE OIDC Discovery Provider CRD by running the following command:

      ```terminal
      $ oc delete crd spireoidcdiscoveryproviders.operator.openshift.io
      ```
   5. Delete the SPIRE and SPIFFE cluster federated trust domains CRD by running the following command:

      ```terminal
      $ oc delete crd clusterfederatedtrustdomains.spire.spiffe.io
      ```
   6. Delete the cluster SPIFFE IDs CRD by running the following command:

      ```terminal
      $ oc delete crd clusterspiffeids.spire.spiffe.io
      ```
   7. Delete the SPIRE and SPIFFE cluster static entries CRD by running the following command:

      ```terminal
      $ oc delete crd clusterstaticentries.spire.spiffe.io
      ```
   8. Delete the Zero Trust Workload Identity Manager CRD by running the following command:

      ```terminal
      $ oc delete crd zerotrustworkloadidentitymanagers.operator.openshift.io
      ```

**Verification**

To verify that the resources have been deleted, replace each `oc delete` command with `oc get`, and then run the command. If no resources are returned, the deletion was successful.