如有必要，您可以通过运行脚本来移除 NCP 创建的所有 NSX-T 对象。
安装文件中包含以下清理脚本：
- nsx_policy_cleanup.py - 如果 NSX-T 资源是在策略模式下创建的，请使用此脚本。
- nsx_cleanup.py - 如果 NSX-T 资源是在管理器模式下创建的，请使用此脚本。
注意：在 vSphere with Tanzu 环境中，可以在 vCenter Server Appliance 上的目录 /usr/lib/vmware-wcp 中找到清理脚本。
在运行脚本之前，请执行以下任务：
- 停止 NCP。
- 移除您创建的与 NCP 创建的对象关联的所有资源。如果不删除这些对象，脚本将失败。例如，如果 NCP 创建了一个分段，并且您创建了与该分段关联的分布式防火墙 (Distributed Firewall, DFW) 规则和组，则必须删除该 DFW 规则和组，或者移除它们之间的关联。或者，如果已将虚拟机连接到该分段，则必须删除这些虚拟机，或者将它们与该分段断开连接。
策略模式
Usage: nsx_policy_cleanup.py [options]
Options:
-h, --help show this help message and exit
--mgr-ip=MGR_IP NSX Manager IP address
-u USERNAME, --username=USERNAME
NSX Manager username, ignored if nsx-cert is set
-p PASSWORD, --password=PASSWORD
NSX Manager password, ignored if nsx-cert is set
-n NSX_CERT, --nsx-cert=NSX_CERT
NSX certificate path
-k KEY, --key=KEY NSX client private key path
--vc-endpoint=VC_ENDPOINT
IpAddress or Hostname of VC, ignored if environment
variable VC_ENDPOINT is set
--vc-username=VC_USERNAME
Username for the VC ServiceAccount, ignored if
environment variable VC_USERNAME is set
--vc-password=VC_PASSWORD
Password for the VC ServiceAccount, ignored if
environment variable VC_PASSWORD is set
--vc-https-port=VC_HTTPS_PORT
HTTPS port of VC, ignored if environment variable
VC_HTTPS_PORT is set. If not present, 443 default
value will be used
--vc-sso-domain=VC_SSO_DOMAIN
SSO Domain of VC, ignored if environment variable
VC_SSO_DOMAIN is set. If not present, local default
value will be used
--vc-ca-cert=VC_CA_CERT
Specify a CA bundle to verify the VC server
certificate. It will be ignored if environment
VC_CA_CERT is set
--vc-insecure Not verify VC server certificate
-c CLUSTER, --cluster=CLUSTER
Cluster to be removed
-r, --remove CAVEAT: Removes NSX resources. If not set will do dry-
run.
--top-tier-router-id=TOP_TIER_ROUTER_ID
Specify the top tier router id. Must be specified if
top tier router does not have the cluster tag
--all-res Also clean up HA switching profile, ipblock, external
ippool. These resources could be created by TAS NSX-T
Tile
--no-warning Disable urllib's insecure request warning
--status Check the deletion status, the exit code can be
success(0), in progress(EXIT_CODE_IN_PROGRESS or
failure(other non-zerovalues)
--thumbprint=THUMBPRINT
Specify one or a list of thumbprint strings to use in
verifying the NSX Manager server certificate
例如：
python nsx_policy_cleanup.py --mgr-ip={nsx_mngr_ip} -u admin -p {password} -c {k8s_cluster_name} --no-warning -r
在某些情况下，必须指定 top-tier-router-id 参数。
管理器模式
Usage: nsx_cleanup.py [options]
Options:
-h, --help show this help message and exit
--mgr-ip=MGR_IP NSX Manager IP address
-u USERNAME, --username=USERNAME
NSX Manager username, ignored if nsx-cert is set
-p PASSWORD, --password=PASSWORD
NSX Manager password, ignored if nsx-cert is set
-n NSX_CERT, --nsx-cert=NSX_CERT
NSX certificate path
-k KEY, --key=KEY NSX client private key path
-c CLUSTER, --cluster=CLUSTER
Cluster to be removed
-r, --remove CAVEAT: Removes NSX resources. If not set will do dry-
run.
--top-tier-router-uuid=TOP_TIER_ROUTER_UUID
Specify the top tier router uuid. Must be specified if
top tier router does not have the cluster tag or for a
single-tier1 topology
--all-res Also clean up HA switching profile, ipblock, external
ippool. These resources could be created by TAS NSX-T
Tile
--no-warning Disable urllib's insecure request warning
例如：
python nsx_cleanup.py --mgr-ip={nsx_mngr_ip} -u admin -p {password} -c {k8s_cluster_name} --top-tier-router-uuid={top_tier_router_uuid} --no-warning -r
