Delete storage objects

This page shows you how to delete objects from Google Distributed Cloud (GDC) air-gapped storage buckets.

Before you begin

A project namespace manages bucket resources in the management API server. You must have a project to work with buckets and objects.

Required IAM roles

Contact your IAM Project Admin to request the following roles in your project namespace:

• Project Bucket Admin (project-bucket-admin): create, update, and delete storage buckets.
• Project Bucket Object Viewer (project-bucket-object-viewer): view and check details of storage buckets and objects.

For more information, see Grant bucket access.

Prepare your environment

To run commands against the management API server or the global API server, do the following:

1. Sign in and generate the kubeconfig file for the zonal management API server if you don't have one.
2. For dual-zone buckets, do the following:
   • Verify with your Infrastructure Operator (IO) that the BucketLocationConfig custom resource has been created for your paired zones.
   • Generate the kubeconfig file for the global API server.

Delete objects in buckets

Console

1. In the navigation menu, click Object Storage.
2. Click the name of the bucket containing the objects.
3. Wait to be redirected to the Bucket details page with objects listed in a table.
4. Navigate to the object's detail page and click Permanently delete. Alternatively, in the bucket object list view, select the checkbox next to the object and then click Permanently delete.
5. Wait a few minutes and refresh the page to check that the object is deleted.

Note that all objects in dual-zone buckets are versioned, so deleting an object won't remove that object from storage. Instead, the object will be marked for deletion and will no longer be visible in LIST calls. The object can still be retrieved by specifying its version ID. An object is permanently deleted only if you specify the versionID when performing the deletion.

gdcloud

Delete a file from a bucket:

gdcloud storage rm s3://FULLY_QUALIFIED_BUCKET_NAME/OBJECT

Crypto shred objects in buckets with encryption v2

Warning: Deleting an AEADKey leads to irreversible data loss. Objects encrypted with the deleted key cannot be recovered.

1. Retrieve all AEADKeys that belong to a bucket:

   kubectl get aeadkeys -n PROJECT_NAMESPACE -l  cmek.security.gdc.goog/resource-name=FULLY_QUALIFIED_BUCKET_NAME
   

2. Follow Delete a key to delete the intended AEADKey to crypto shred objects.

Crypto shred dual-zone buckets

Warning: Deleting an MZAEADKey leads to irreversible data loss. Objects encrypted with the deleted key cannot be recovered.

1. Retrieve all MZAEADKeys that belong to a bucket:

kubectl --kubeconfig GLOBAL_API_SERVER_KUBECONFIG \
  get mzaeadkey -n PROJECT_NAMESPACE -l cmek.security.gdc.goog/resource-name=FULLY_QUALIFIED_BUCKET_NAME

1. For each MZAEADKey, use the following command to delete the key and its zonal AEADKey replicas:

kubectl --kubeconfig GLOBAL_API_SERVER_KUBECONFIG \
  delete mzaeadkey KEY_NAME --namespace=PROJECT_NAMESPACE