Openshift installer is not correctly tracking terraform resources #1000
Comments
|
In addition to the tracking mentioned above, attempting to then re-do the install errors as follows: |
Some discussion of improving this experience in #746.
Disscussion of this in #522.
This we can probably fix. I'll see about working something up. |
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [2]. Unfortunately, instance profiles at not tag-able [3]. [1]: openshift#1000 [2]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [3]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [2]. Unfortunately, instance profiles are not tag-able [3]. [1]: openshift#1000 [2]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [3]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles (new in 2018-11-16 [2]) is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [3]. Unfortunately, instance profiles are not tag-able [4]. [1]: openshift#1000 [2]: https://aws.amazon.com/blogs/security/add-tags-to-manage-your-aws-iam-users-and-roles/ [3]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [4]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles (new in 2018-11-16 [2]) is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [3]. Unfortunately, instance profiles are not tag-able [4]. [1]: openshift#1000 [2]: https://aws.amazon.com/blogs/security/add-tags-to-manage-your-aws-iam-users-and-roles/ [3]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [4]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles (new in 2018-11-16 [2]) is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [3]. Unfortunately, instance profiles are not tag-able [4]. [1]: openshift#1000 [2]: https://aws.amazon.com/blogs/security/add-tags-to-manage-your-aws-iam-users-and-roles/ [3]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [4]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
As reported by Brian Harrington, we're currently deleting these roles based on cluster name, when we'd ideally be deleting them based on the more-specific cluster ID [1]. Tagging the roles (new in 2018-11-16 [2]) is a step in that direction, although as of this commit we still delete roles by name. In coming work, I'll pivot to deleting these based on their tags. The tag property is documented in [3]. Unfortunately, instance profiles are not tag-able [4]. [1]: openshift#1000 [2]: https://aws.amazon.com/blogs/security/add-tags-to-manage-your-aws-iam-users-and-roles/ [3]: https://www.terraform.io/docs/providers/aws/r/iam_role.html#tags [4]: https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
|
With #1039, role matching is now by tag (taking advantage of the tags from #1036), instead of by name. That helps with this, but we still effectively delete roles by cluster name, because our /close |
|
@wking: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Version
Platform (aws|libvirt|openstack):
AWS
What happened?
Background information
After performing an install which failed and rebooting, i lost the cluster assets (they were stored in /tmp while working through troubleshooting with @abhinavdahiya). As such, I had to manually reap all resources related to the cluster. In the process of performing this manual cleanup, I missed the following three resources:
Installation failure
As the roles already existed in IAM when attempting to perform an installation it failed with the following error:
Noting the following message:
I then used the
destroy clustermechanism of the installer as follows:As noted on lines 7, 17, & 18 the installer deleted those roles despite the fact that it failed due to their existence.
What you expected to happen?
I would expect that the installer would only delete "resources that successfully completed", as per it's error message. As it was not able to successfully create those resources it should not have removed them when the cleanup was performed.
How to reproduce it (as minimally and precisely as possible)?
Create conflicting roles, perform an install, destroy the cluster
The text was updated successfully, but these errors were encountered: