Kaspersky Next XDR Expert

Uninstalling Kaspersky Next XDR Expert

KDT allows you to uninstall all Kaspersky Next XDR Expert components installed in the Kubernetes cluster, the cluster itself, the KUMA services installed outside the cluster, and other artifacts created during the deployment or operation of the solution.

To uninstall the Kaspersky Next XDR Expert components and related data:

1. On the administrator host, run the following command:

   ./kdt remove --all

   This command removes the following objects and artifacts:

   • All Kaspersky Next XDR Expert components installed in the Kubernetes cluster and the cluster itself.

   • The Kaspersky Next XDR Expert user account that was created by KDT during the deployment.

   • The database located on a separate server or inside the cluster, DBMS schemes, and DBMS accounts created by KDT during the deployment.

   • The KUMA services installed outside the cluster on the hosts that were specified in the inventory file.

   • The contents of the following directories on target hosts:
     • /var/spool/ksc/logs
     • /var/spool/ksc/backup
     • /var/spool/ksc/
     • /var/lib/k0s
     • /run/k0s
     • /etc/k0s/
     • /etc/containerd/
     • /var/lib/containerd/
     • /run/containerd/

   • Logs obtained during the installation and operation of the Kaspersky Next XDR Expert components.

   • Data related to the Kaspersky Next XDR Expert components on the administrator host.

   If the administrator host does not have network access to a target host, uninstalling the components is interrupted. You can restore network access and restart the uninstallation of Kaspersky Next XDR Expert. Alternatively, you can uninstall the Kaspersky Next XDR Expert components from the target hosts manually.

   If you use multiple Kubernetes clusters managing by contexts, this command removes only the current Kubernetes context, the corresponding cluster, and the Kaspersky Next XDR Expert components installed in the cluster. Other contexts and their clusters with Kaspersky Next XDR Expert instances are not removed.

2. Close the ports used by Kaspersky Next XDR Expert that were opened during the deployment, if needed. These ports are not closed automatically.

3. Remove the operating system packages that were automatically installed during the deployment, if needed. These packages are not removed automatically.

4. Remove KDT and the contents of the /home/<user>/kdt and /home/<user>/.kdt directories.

The Kaspersky Next XDR Expert components, database, and related data are removed, and the ports used by Kaspersky Next XDR Expert are closed.

Kaspersky applications installed on the managed devices are not removed by using the ./kdt remove command. For information on how to remove Kaspersky applications, refer to their documentation.

After uninstalling Kaspersky Next XDR Expert, target hosts are not restarted automatically. You can restart these hosts manually if necessary.