xcsh — Remove

Remove steps

Detach dependent consumers before removing your exclusively owned certificate through xcsh. Confirm the exact resource and namespace, check xcsh delete --help for the current resource deletion interface, and verify named API absence. Retain private manifests for recovery. Never remove Terraform-owned or retained demonstration resources.

For infrastructure retirement, follow Terraform Remove in its independently owned state. Removing a certificate manifest does not tear down its consumers.

Review and remove the owned certificate

After detaching references, preview the exact certificate name in your authenticated xcsh context. Inspect the saved report before deleting that same name.

umask 077
xcsh delete certificates "$XCSH_CERT_NAME" -n "$XCSH_NAMESPACE" --dry-run client -o json \
  > "$XCSH_WORKDIR/certificate-remove-preview.json"
xcsh delete certificates "$XCSH_CERT_NAME" -n "$XCSH_NAMESPACE" -o json \
  > "$XCSH_WORKDIR/certificate-remove.json"

Verify named absence

Use the same tenant and namespace as the authenticated context. Require an authenticated API response showing that the named certificate is absent; authorization failures and transport errors remain failures.

status=$(curl --silent --show-error --header "Authorization: APIToken $XCSH_API_TOKEN" \
  "$XCSH_API_URL/api/config/namespaces/$XCSH_NAMESPACE/certificates/$XCSH_CERT_NAME" \
  --output "$XCSH_WORKDIR/certificate-remove-readback.json" --write-out '%{http_code}')
test "$status" = 404

Expect exit 0 from the absence assertion. Preserve the private reports and manifests for recovery; retire unused session credentials when all checks finish.