Delete storage buckets

This page guides you through how to delete storage buckets within Google Distributed Cloud (GDC) air-gapped environments. It covers prerequisites and methods for deleting buckets through the GDC console and command line interface (CLI). Learn how to delete buckets with retention policies by crypto shredding—a process where you delete the encryption key associated with the storage bucket. This information lets you securely and permanently manage the lifecycle of your object storage, providing data hygiene and compliance

This page is for audiences such as IT admins within the infrastructure operator group or developers within the application operator group who are responsible for managing object storage resources in GDC air-gapped environments. For more information, see Audiences for GDC air-gapped documentation.

Before you begin

A project namespace manages bucket resources in the management API server. You must have a project to work with buckets and objects.

Required IAM roles

Contact your IAM Project Admin to request the following roles in your project namespace:

• Project Bucket Admin (project-bucket-admin): create, update, and delete storage buckets.
• Project Bucket Object Viewer (project-bucket-object-viewer): view and check details of storage buckets and objects.

For more information, see Grant bucket access.

Prepare your environment

To run commands against the management API server or the global API server, do the following:

1. Sign in and generate the kubeconfig file for the zonal management API server if you don't have one.
2. For dual-zone buckets, do the following:
   • Verify with your Infrastructure Operator (IO) that the BucketLocationConfig custom resource has been created for your paired zones.
   • Generate the kubeconfig file for the global API server.

Delete storage buckets

Warning: Buckets with an active retention policy are blocked from deletion until the lock date expires. If you need to destroy the data before that date, you must crypto-shred the bucket.

Console

1. In the navigation menu, click Object Storage.
2. Click delete Delete at the end of the row of the bucket to be deleted.
3. Wait a few minutes and refresh the page to check that the bucket is deleted.

CLI

You can delete storage buckets by using the CLI. Buckets must be empty before you can delete them.

1. Use the GET or DESCRIBE command from the View bucket configuration section to get the fully qualified bucket name.

2. If the bucket is not empty, delete files within the bucket:

   gdcloud storage rm --recursive --all-versions s3://FULLY_QUALIFIED_BUCKET_NAME/**
   

3. Delete the empty bucket:

   Note: Make sure the bucket is empty before using the following kubectl command to trigger the bucket deletion.

   kubectl delete buckets/FULLY_QUALIFIED_BUCKET_NAME --namespace PROJECT_NAMESPACE
   

Crypto shred bucket

To crypto-shred a bucket is to permanently destroy access to its data by deleting the encryption keys, rendering the stored data unreadable. In comparison to deleting individual buckets when cleaning up storage, which can take minutes to days for very large buckets, crypto-shredding provides instant and irreversible data destruction at scale.

Note: Only v1 encryption bucket can be crypto shred, for v2 encryption bucket, use Crypto shred objects in buckets with encryption v2

Warning: This step is not recoverable and you will lose all data encrypted in the bucket.

Crypto shred buckets

Retrieve information about the AEADKey based on Verify bucket resource creation and follow Delete a key to delete the AEADKey, then the entire bucket would be crypto shredded.

After crypto shredding the bucket, proceed to verify.

Verify crypto shred success

You can run the following command to verify the bucket has been successfully crypto shredded. The BucketReady should be False and Reason to be BucketCryptoShredded.

kubectl get buckets FULLY_QUALIFIED_BUCKET_NAME -n PROJECT_NAMESPACE