diff options
author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2018-01-22 15:56:47 -0800 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-01-22 15:56:47 -0800 |
commit | 0acd0b6cceab794eeff005a3cde2fdc8221bbb0e (patch) | |
tree | 2d4544863b03854269ef1b343f91e0ef6460e3d1 /roles/openshift_aws | |
parent | b79b497a9a443140f23cd3b8ef5c19d1893bce95 (diff) | |
parent | a0015f7ead6a89dbb602bc245b51e82cfad66902 (diff) | |
download | openshift-0acd0b6cceab794eeff005a3cde2fdc8221bbb0e.tar.gz openshift-0acd0b6cceab794eeff005a3cde2fdc8221bbb0e.tar.bz2 openshift-0acd0b6cceab794eeff005a3cde2fdc8221bbb0e.tar.xz openshift-0acd0b6cceab794eeff005a3cde2fdc8221bbb0e.zip |
Merge pull request #6533 from joelddiaz/prereqs_uninstall
Automatic merge from submit-queue.
allow uninstalling AWS objects created by prerequisite playbook
add deprovisioners/uninstallers for objects created via playbooks/aws/openshift-cluster/prerequisites.yml
specifically: security groups, vpcs, and any ssh keys
introduce openshift_aws_enable_uninstall_shared_objects to protect AWS objects that would be shared in the case of multiple clusters co-existing in one AWS account. right now it protects the ssh keys, but it can/should be used to protect against deleting the shared IAM instance profile as well. default this variable to False to be on the safe side when uninstalling/deprovisioning.
Diffstat (limited to 'roles/openshift_aws')
-rw-r--r-- | roles/openshift_aws/defaults/main.yml | 4 | ||||
-rw-r--r-- | roles/openshift_aws/tasks/uninstall_security_group.yml | 14 | ||||
-rw-r--r-- | roles/openshift_aws/tasks/uninstall_ssh_keys.yml | 9 | ||||
-rw-r--r-- | roles/openshift_aws/tasks/uninstall_vpc.yml | 36 |
4 files changed, 63 insertions, 0 deletions
diff --git a/roles/openshift_aws/defaults/main.yml b/roles/openshift_aws/defaults/main.yml index efd2468b2..a729e8dbd 100644 --- a/roles/openshift_aws/defaults/main.yml +++ b/roles/openshift_aws/defaults/main.yml @@ -301,3 +301,7 @@ openshift_aws_node_user_data: '' openshift_aws_node_config_namespace: openshift-node openshift_aws_masters_groups: masters,etcd,nodes + +# By default, don't delete things like the shared IAM instance +# profile and uploaded ssh keys +openshift_aws_enable_uninstall_shared_objects: False diff --git a/roles/openshift_aws/tasks/uninstall_security_group.yml b/roles/openshift_aws/tasks/uninstall_security_group.yml new file mode 100644 index 000000000..55d40e8ec --- /dev/null +++ b/roles/openshift_aws/tasks/uninstall_security_group.yml @@ -0,0 +1,14 @@ +--- +- name: delete the node group sgs + oo_ec2_group: + state: absent + name: "{{ item.value.name}}" + region: "{{ openshift_aws_region }}" + with_dict: "{{ openshift_aws_node_security_groups }}" + +- name: delete the k8s sgs for the node group + oo_ec2_group: + state: absent + name: "{{ item.value.name }}_k8s" + region: "{{ openshift_aws_region }}" + with_dict: "{{ openshift_aws_node_security_groups }}" diff --git a/roles/openshift_aws/tasks/uninstall_ssh_keys.yml b/roles/openshift_aws/tasks/uninstall_ssh_keys.yml new file mode 100644 index 000000000..27e42da53 --- /dev/null +++ b/roles/openshift_aws/tasks/uninstall_ssh_keys.yml @@ -0,0 +1,9 @@ +--- +- name: Remove the public keys for the user(s) + ec2_key: + state: absent + name: "{{ item.key_name }}" + region: "{{ openshift_aws_region }}" + with_items: "{{ openshift_aws_users }}" + no_log: True + when: openshift_aws_enable_uninstall_shared_objects | bool diff --git a/roles/openshift_aws/tasks/uninstall_vpc.yml b/roles/openshift_aws/tasks/uninstall_vpc.yml new file mode 100644 index 000000000..ecf39f694 --- /dev/null +++ b/roles/openshift_aws/tasks/uninstall_vpc.yml @@ -0,0 +1,36 @@ +--- +- name: Fetch the VPC for the vpc.id + ec2_vpc_net_facts: + region: "{{ openshift_aws_region }}" + filters: + "tag:Name": "{{ openshift_aws_clusterid }}" + register: vpcout +- debug: + var: vpcout + verbosity: 1 + +- when: vpcout.vpcs | length > 0 + block: + - name: delete the vpc igw + ec2_vpc_igw: + state: absent + region: "{{ openshift_aws_region }}" + vpc_id: "{{ vpcout.vpcs[0].id }}" + register: igw + + - name: delete the vpc subnets + ec2_vpc_subnet: + state: absent + region: "{{ openshift_aws_region }}" + vpc_id: "{{ vpcout.vpcs[0].id }}" + cidr: "{{ item.cidr }}" + az: "{{ item.az }}" + with_items: "{{ openshift_aws_vpc.subnets[openshift_aws_region] }}" + + - name: Delete AWS VPC + ec2_vpc_net: + state: absent + region: "{{ openshift_aws_region }}" + name: "{{ openshift_aws_clusterid }}" + cidr_block: "{{ openshift_aws_vpc.cidr }}" + register: vpc |