Strata Copilot
    Next-Gen Trust Security
    : Deleting VSatellites
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Overview: Venafi VSatellites
    6. Managing your VSatellites
    7. Deleting VSatellites

    Next-Gen Trust Security

    Deleting VSatellites

    Table of Contents

    Deleting VSatellites

    When you need to retire an existing VSatellite, you can delete it from the VSatellites page.
    To delete a VSatellite, you must delete it within Next-Gen Trust Security and then remove the binaries from the file system where it is installed.
    Warning: Deleting the very last VSatellite permanently deletes all associated services and the VSatellite data encryption key (DEK), which contains all related keys and credentials. Learn more
    Important: A backup DEK is not sufficient for recovery if the last VSatellite is deleted. Recovery requires that at least one VSatellite entry remains in your Next-Gen Trust Security account.
    Important: Deleting VSatellites that have existing services running on them can cause service outages. Before deleting a VSatellite, reassign any associated services to a different VSatellite.
    If you no longer need the services, you can delete the VSatellite without reassigning them.

    Reassign existing services to a different VSatellite

    1. Sign in to Next-Gen Trust Security.
    2. Click System Settings > Services.
    3. In the left pane, click the service you want to reassign.
    4. Click the Administration tab.
    5. In the VSatellite section, click the field and select a different VSatellite.
    6. Click Save.
    Repeat these steps for every service running on the VSatellite you want to delete.

    Delete a VSatellite from Next-Gen Trust Security

    1. Click System Settings > Services.
    2. Select the VSatellite you want to delete and click Delete.
    3. When prompted, click Delete to confirm.
    4. Log in to Next-Gen Trust Security.
    5. Click Settings > VSatellites.
    6. Select the VSatellite you want to delete and click Delete.
    7. When prompted, select I understand the risks of deleting the VSatellite, then click Delete VSatellite to confirm.

    Remove VSatellite binaries

    After deleting a VSatellite in Next-Gen Trust Security, remove the VSatellite binaries from the server where it was installed.
    Run the following command from a terminal:
    sudo ./vsatctl uninstall
    Why are root privileges required?The vsatctl uninstall command deletes k3s from /usr/local/bin, which is owned by the root user.
    If you installed VSatellite on RHEL, Oracle, or Rocky Linux, the vsatctl uninstall command removes the k3s-selinux RPM package, which requires root privileges.
    If you are already logged in as the root user, you can omit the sudo command.
    Tip: See what else you can do using vsatctl.

    © 2026 Palo Alto Networks, Inc. All rights reserved.