Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Offboard ambient networking

Autopilot Standard

Follow these steps to safely disable and remove ambient networking from your cluster.

Remove all ambient policies impacting your services, ensuring no policy enforces strict mTLS:

kubectl delete gcpservertlspolicies -n ambient-test server
kubectl delete gcpclienttlspolicies -n ambient-test server-mtls
kubectl delete gcpauthzpolicy -n ambient-test --all

Remove the label from the relevant namespace to disable traffic interception:
```
kubectl label namespace ambient-test networking.gke.io/dataplane-mode-
```
Verify that the annotation ambient.networking.gke.io/redirection is removed from all Pods in the Namespace:
```
kubectl get pods -n ambient-test -o yaml | grep redirection
```
The output should be an empty response.
Optionally, if you enabled Layer 4 metrics generation, remove the metrics label from the namespace:
```
kubectl label namespace ambient-test networking.gke.io/ambient-network-metrics-
```
Disable ambient networking at the cluster level to remove ambient components:
```
gcloud beta container clusters update CLUSTER_NAME \
    --location=CLUSTER_LOCATION --no-enable-ambient-networking
```
Replace the following:
- CLUSTER_NAME: the name of the cluster.
- CLUSTER_LOCATION: the Compute Engine region or zone of the cluster.