Skip to content

Commit 99bff0d

Browse files
matttrachmatttrach
authored
fix: manage admin password better (#140)
Signed-off-by: matttrach <matt.trachier@suse.com>
1 parent 8af41ae commit 99bff0d

43 files changed

Lines changed: 1231 additions & 706 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cleanup.sh‎

Lines changed: 116 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -11,99 +11,131 @@ echo "Starting cleanup for Id: $cleanup_id"
1111
IDENTIFIER="$cleanup_id"
1212
AWS_REGION="${AWS_REGION:-us-west-2}"
1313

14-
echo "Clearing leftovers with Id $IDENTIFIER in $AWS_REGION..."
15-
14+
resources_to_clear="$(leftovers -d --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" | grep -v 'AccessDenied')"
15+
resources_ids="$(echo "$resources_to_clear" | awk -F"Id:" '{print $2}' | awk -F"," '{print $1}' | awk -F")" '{print $1}' | sort | uniq)"
1616
max_attempts=3
1717

18-
attempts=0
19-
resources_to_clear="$(leftovers -d --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" | grep -v 'AccessDenied')"
20-
while [ -n "$resources_to_clear" ] && [ $attempts -lt $max_attempts ]; do
21-
echo -e "found these resources to clear:\n $resources_to_clear\n"
22-
leftovers --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" --no-confirm | grep -v 'AccessDenied' || true
23-
sleep 10
24-
resources_to_clear="$(leftovers -d --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" | grep -v 'AccessDenied')"
25-
if [ -n "$resources_to_clear" ]; then
26-
echo "Some resources failed to clear, retrying in $((attempts * 10)) seconds..."
27-
fi
28-
sleep $((attempts * 10))
29-
attempts=$((attempts + 1))
18+
echo " resources found:"
19+
while IFS= read -r r; do
20+
echo " $r"
21+
done <<<"$resources_to_clear"
22+
23+
echo " resources ids:"
24+
for r in $resources_ids; do
25+
echo " $r"
3026
done
3127

32-
if [ $attempts -eq $max_attempts ]; then
33-
echo "Warning: Failed to clear all resources after $max_attempts attempts."
34-
fi
28+
if [ -z "$resources_ids" ]; then resources_ids=$IDENTIFIER; fi
3529

36-
# remove secrets
37-
attempts=0
38-
while [ $attempts -lt $max_attempts ]; do
39-
while read -r arn; do
40-
if [ -z "$arn" ]; then
41-
continue
42-
fi
43-
echo "removing secret $arn..."
44-
aws secretsmanager delete-secret --secret-id "$arn" --force-delete-without-recovery
45-
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "secretsmanager:secret" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN')"
46-
sleep $((attempts * 10))
47-
attempts=$((attempts + 1))
48-
done
30+
for id in $resources_ids; do
31+
IDENTIFIER=$id
32+
echo "Clearing leftovers with Id $IDENTIFIER in $AWS_REGION..."
33+
attempts=0
4934

50-
# remove s3 storage
51-
attempts=0
52-
while [ $attempts -lt $max_attempts ]; do
53-
while read -r id; do
54-
if [ -z "$id" ]; then
55-
continue
35+
resources_to_clear="$(leftovers -d --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" | grep -v 'AccessDenied' || true)"
36+
while [ -n "$resources_to_clear" ] && [ $attempts -lt $max_attempts ]; do
37+
echo -e "found these resources to clear:\n $resources_to_clear\n"
38+
leftovers --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" --no-confirm | grep -v 'AccessDenied' || true
39+
sleep 10
40+
resources_to_clear="$(leftovers -d --iaas=aws --aws-region="$AWS_REGION" --filter="Id:$IDENTIFIER" | grep -v 'AccessDenied' || true)"
41+
if [ -n "$resources_to_clear" ]; then
42+
echo "Some resources failed to clear, retrying in $((attempts * 10)) seconds..."
5643
fi
57-
echo "removing s3 bucket $id..."
58-
aws s3 rb "s3://$id" --force
59-
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "s3:bucket" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN' | awk -F'arn:aws:s3:::' '{print $2}')"
60-
sleep $((attempts * 10))
61-
attempts=$((attempts + 1))
62-
done
44+
sleep $((attempts * 10))
45+
attempts=$((attempts + 1))
46+
done
6347

64-
# remove key pairs
65-
attempts=0
66-
while [ $attempts -lt $max_attempts ]; do
67-
while read -r id; do
68-
if [ -z "$id" ]; then
69-
continue
70-
fi
71-
echo "removing ec2 key pair $id..."
72-
aws ec2 delete-key-pair --key-pair-id "$id"
73-
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "ec2:key-pair" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN' | awk -F'/' '{print $2}')"
74-
sleep $((attempts * 10))
75-
attempts=$((attempts + 1))
76-
done
48+
if [ $attempts -eq $max_attempts ]; then
49+
echo "Warning: Failed to clear all resources after $max_attempts attempts."
50+
fi
7751

78-
# remove server certificates
79-
# unfortunately get-resources doesn't support iam server certificates
80-
attempts=0
81-
while [ $attempts -lt $max_attempts ]; do
82-
while read -r name; do
83-
if [ -z "$name" ]; then
84-
continue
85-
fi
86-
if aws iam list-server-certificate-tags --server-certificate-name "$name" | jq -e --arg ID "$IDENTIFIER" '.Tags[] | select(.Key=="Id" and .Value==$ID)' > /dev/null; then
87-
echo "removing iam server certificate $name..."
88-
aws iam delete-server-certificate --server-certificate-name "$name"
89-
fi
90-
done <<<"$(aws iam list-server-certificates | jq -r '.ServerCertificateMetadataList[].ServerCertificateName')"
91-
sleep $((attempts * 10))
92-
attempts=$((attempts + 1))
93-
done
52+
# remove secrets
53+
echo "Clearing out secrets if they were missed..."
54+
attempts=0
55+
while [ $attempts -lt $max_attempts ]; do
56+
while read -r arn; do
57+
if [ -z "$arn" ]; then
58+
continue
59+
fi
60+
echo "removing secret $arn..."
61+
aws secretsmanager delete-secret --secret-id "$arn" --force-delete-without-recovery
62+
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "secretsmanager:secret" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN')"
63+
sleep $((attempts * 10))
64+
attempts=$((attempts + 1))
65+
done
9466

95-
# remove load balancer target groups
96-
attempts=0
97-
while [ $attempts -lt $max_attempts ]; do
98-
while read -r arn; do
99-
if [ -z "$arn" ]; then
100-
continue
101-
fi
102-
echo "removing load balancer target group $arn..."
103-
aws elbv2 delete-target-group --target-group-arn "$arn";
104-
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "elasticloadbalancing:targetgroup" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN')"
105-
sleep $((attempts * 10))
106-
attempts=$((attempts + 1))
67+
# remove s3 storage
68+
echo "Clearing out s3 buckets if they were missed..."
69+
attempts=0
70+
while [ $attempts -lt $max_attempts ]; do
71+
while read -r id; do
72+
if [ -z "$id" ]; then
73+
continue
74+
fi
75+
echo " removing s3 bucket $id..."
76+
echo " clearing out versions..."
77+
while read -r v; do
78+
if [ -z "$v" ]; then continue; fi;
79+
aws s3api delete-object --bucket "$id" --key "tfstate" --version-id="$v" > /dev/null 2>&1;
80+
done <<<"$(aws s3api list-object-versions --bucket "$id" | jq -r '.DeleteMarkers[]?.VersionId' || true)"
81+
while read -r v; do
82+
if [ -z "$v" ]; then continue; fi;
83+
aws s3api delete-object --bucket "$id" --key "tfstate" --version-id="$v" > /dev/null 2>&1;
84+
done <<<"$(aws s3api list-object-versions --bucket "$id" | jq -r '.Versions[]?.VersionId' || true)"
85+
echo " removing bucket..."
86+
aws s3 rb "s3://$id" --force
87+
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "s3:bucket" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN' | awk -F'arn:aws:s3:::' '{print $2}' || true)"
88+
sleep $((attempts * 10))
89+
attempts=$((attempts + 1))
90+
done
91+
92+
# remove key pairs
93+
echo "Clearing out key pairs if they were missed..."
94+
attempts=0
95+
while [ $attempts -lt $max_attempts ]; do
96+
while read -r id; do
97+
if [ -z "$id" ]; then
98+
continue
99+
fi
100+
echo " removing ec2 key pair $id..."
101+
aws ec2 delete-key-pair --key-pair-id "$id" || true
102+
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "ec2:key-pair" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN' | awk -F'/' '{print $2}')"
103+
sleep $((attempts * 10))
104+
attempts=$((attempts + 1))
105+
done
106+
107+
# remove server certificates
108+
# unfortunately get-resources doesn't support iam server certificates
109+
echo "Clearing out server certificates if they were missed..."
110+
attempts=0
111+
while [ $attempts -lt $max_attempts ]; do
112+
while read -r name; do
113+
if [ -z "$name" ]; then
114+
continue
115+
fi
116+
if aws iam list-server-certificate-tags --server-certificate-name "$name" | jq -e --arg ID "$IDENTIFIER" '.Tags[] | select(.Key=="Id" and (.Value | contains($ID)))' > /dev/null; then
117+
echo " removing iam server certificate $name..."
118+
aws iam delete-server-certificate --server-certificate-name "$name" || true
119+
fi
120+
done <<<"$(aws iam list-server-certificates | jq -r '.ServerCertificateMetadataList[].ServerCertificateName')"
121+
sleep $((attempts * 10))
122+
attempts=$((attempts + 1))
123+
done
124+
125+
# remove load balancer target groups
126+
echo "Clearing out load balancer target groups if they were missed..."
127+
attempts=0
128+
while [ $attempts -lt $max_attempts ]; do
129+
while read -r arn; do
130+
if [ -z "$arn" ]; then
131+
continue
132+
fi
133+
echo " removing load balancer target group $arn..."
134+
aws elbv2 delete-target-group --target-group-arn "$arn" || true;
135+
done <<<"$(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "elasticloadbalancing:targetgroup" --tag-filters "Key=Id,Values=$IDENTIFIER" | jq -r '.ResourceTagMappingList[]?.ResourceARN')"
136+
sleep $((attempts * 10))
137+
attempts=$((attempts + 1))
138+
done
107139
done
108140

109141
echo "Cleanup completed."
@@ -113,4 +145,4 @@ echo "Cleanup completed."
113145
# For example, if you hit a quota limit and notice there a bunch of leftover secrets or target groups, you can run these commands to clean up all resources with the same Id as the leftover resources.
114146
# for id in $(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "elasticloadbalancing:targetgroup" --tag-filters "Key=Owner,Values=terraform-ci@suse.com" | jq -r '.ResourceTagMappingList[]?.Tags[] | select(.Key=="Id") | .Value'); do ./cleanup.sh "$id"; done
115147
# for id in $(aws resourcegroupstaggingapi get-resources --no-cli-pager --resource-type-filters "secretsmanager:secret" --tag-filters "Key=Owner,Values=terraform-ci@suse.com" | jq -r '.ResourceTagMappingList[]?.Tags[] | select(.Key=="Id") | .Value'); do ./cleanup.sh "$id"; done
116-
# for id in $(for name in $(aws iam list-server-certificates | jq -r '.ServerCertificateMetadataList[].ServerCertificateName'); do echo "$(aws iam list-server-certificate-tags --server-certificate-name "$name" | jq -r '.Tags[] | select(.Key=="Id").Value')"; done); do echo "$id"; done
148+
# for id in $(for name in $(aws iam list-server-certificates | jq -r '.ServerCertificateMetadataList[].ServerCertificateName'); do echo "$(aws iam list-server-certificate-tags --server-certificate-name "$name" | jq -r '.Tags[] | select(.Key=="Id").Value')"; done); do ./cleanup.sh "$id"; done

0 commit comments

Comments
 (0)