Removing

Preparation

Before removing Stronghold, do the following:

1. Make sure Stronghold is no longer in use: applications, CI/CD, and other systems have moved to another secrets store or no longer need access.

2. Take a final storage snapshot and keep it together with the unseal or recovery keys for the period defined by your data retention policy (see Creating a snapshot):

   d8 stronghold operator raft snapshot save final.snap

3. Revoke dynamic secret leases so that Stronghold removes the credentials it issued in external systems (databases, LDAP, Kubernetes). List secrets engines:

   d8 stronghold secrets list

   For each engine that issues dynamic secrets, revoke leases by prefix:

   d8 stronghold lease revoke -prefix database/

   Check that no leases remain:

   d8 stronghold list sys/leases/lookup/database/creds/

   Disabling a secrets engine with d8 stronghold secrets disable <PATH> also revokes all its leases.

4. If Stronghold was used as a PKI certificate authority, issue CA certificates in another system in advance and replace trusted CAs on clients. After Stronghold is removed, CRLs and OCSP responses stop being updated.

5. Preserve audit logs according to your retention policy if they are stored on Stronghold nodes.

Stopping and removing

Perform on each cluster node:

1. Stop and disable the service:

   systemctl stop stronghold
   systemctl disable stronghold

2. Delete the systemd unit and reload the systemd configuration:

   rm /etc/systemd/system/stronghold.service
   systemctl daemon-reload

3. Delete data, configuration, certificates, and the binary. The default paths match Installation; if the configuration uses other directories (the path parameter of the storage block, log_file, audit files), delete them too:

   rm -rf /opt/stronghold

   For media that stored Raft data, follow your organization’s secure data destruction procedure.

4. Delete the system user:

   userdel stronghold

5. Remove firewall rules for ports 8200 and 8201, DNS records, and load balancer settings created for Stronghold.

After removal

After Stronghold is removed, do the following:

• Destroy the unseal or recovery key shares and root tokens if the final snapshot does not need to be kept; otherwise, store them together with the snapshot.
• If auto unseal was used, delete the Stronghold keys in the HSM or KMS only after the snapshot retention period expires: without them, the snapshot cannot be unsealed.
• Revoke the credentials Stronghold used to connect to external systems (for example, secrets engine accounts in databases).