ROSAENG-0000 | test: Cleanup VPC

Author: amandahla

examples/rosa-hcp-private-shared-vpc/main.tf

@@ -106,8 +106,9 @@ module "vpc" {
     aws = aws.network-owner
   }
 
-  name_prefix              = local.shared_resources_name_prefix
-  availability_zones_count = 1
+  name_prefix                       = local.shared_resources_name_prefix
+  availability_zones_count          = 1
+  cleanup_rosa_vpce_security_groups = true
 }
 
 ############################

examples/rosa-hcp-private-with-additional-control-plane-security-groups/main.tf

@@ -91,8 +91,9 @@ resource "random_password" "password" {
 module "vpc" {
   source = "../../modules/vpc"
 
-  name_prefix              = var.cluster_name
-  availability_zones_count = 1
+  name_prefix                       = var.cluster_name
+  availability_zones_count          = 1
+  cleanup_rosa_vpce_security_groups = true
 }
 
 ############################

examples/rosa-hcp-private/main.tf

@@ -46,8 +46,9 @@ resource "random_password" "password" {
 module "vpc" {
   source = "../../modules/vpc"
 
-  name_prefix              = var.cluster_name
-  availability_zones_count = 1
+  name_prefix                       = var.cluster_name
+  availability_zones_count          = 1
+  cleanup_rosa_vpce_security_groups = true
 }
 
 ############################

modules/vpc/README.md

@@ -22,13 +22,15 @@ module "vpc" {
 | ---- | ------- |
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.38.0 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.4 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9 |
 
 ## Providers
 
 | Name | Version |
 | ---- | ------- |
 | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.38.0 |
+| <a name="provider_null"></a> [null](#provider\_null) | >= 3.2.4 |
 | <a name="provider_time"></a> [time](#provider\_time) | >= 0.9 |
 
 ## Modules
@@ -54,6 +56,7 @@ No modules.
 | [aws_vpc.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc) | resource |
 | [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
 | [aws_vpc_endpoint_route_table_association.private_vpc_endpoint_route_table_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint_route_table_association) | resource |
+| [null_resource.vpc_destroy_cleanup](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [time_sleep.vpc_resources_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
 | [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
@@ -64,6 +67,7 @@ No modules.
 | ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | A list of availability zones names in the region. This value should not be updated, please create a new resource instead | `list(string)` | `null` | no |
 | <a name="input_availability_zones_count"></a> [availability\_zones\_count](#input\_availability\_zones\_count) | The count of availability zones to use within the specified AWS Region, where pairs of public and private subnets will be generated. Valid only when availability\_zones variable is not provided. This value should not be updated, please create a new resource instead | `number` | `null` | no |
+| <a name="input_cleanup_rosa_vpce_security_groups"></a> [cleanup\_rosa\_vpce\_security\_groups](#input\_cleanup\_rosa\_vpce\_security\_groups) | On destroy, remove orphaned ROSA HCP PrivateLink security groups (name suffix -vpce-private-router) left in this VPC after cluster deletion. Enable for private ROSA HCP clusters using this module; requires AWS CLI and EC2 permissions at destroy time. | `bool` | `false` | no |
 | <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | User-defined prefix for all generated AWS resources of this VPC. This value should not be updated, please create a new resource instead | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | AWS tags to be applied to generated AWS resources of this VPC. | `map(string)` | `null` | no |
 | <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | Cidr block of the desired VPC. This value should not be updated, please create a new resource instead | `string` | `"10.0.0.0/16"` | no |

modules/vpc/main.tf

@@ -204,9 +204,26 @@ resource "aws_route_table_association" "private_route_table_association" {
 
 # This resource is used in order to add dependencies on all resources 
 # Any resource uses this VPC ID, must wait to all resources creation completion
+# Optional destroy hook: after time_sleep.vpc_resources_wait completes its destroy wait,
+# remove orphaned ROSA HCP VPCE security groups that block VPC deletion (DependencyViolation).
+resource "null_resource" "vpc_destroy_cleanup" {
+  count = var.cleanup_rosa_vpce_security_groups ? 1 : 0
+
+  triggers = {
+    vpc_id = aws_vpc.vpc.id
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/../../scripts/vpc-destroy-cleanup.sh '${self.triggers.vpc_id}'"
+  }
+}
+
 resource "time_sleep" "vpc_resources_wait" {
+  depends_on = [null_resource.vpc_destroy_cleanup]
+
   create_duration  = "20s"
-  destroy_duration = "20s"
+  destroy_duration = "5m"
   triggers = {
     vpc_id                                           = aws_vpc.vpc.id
     cidr_block                                       = aws_vpc.vpc.cidr_block

modules/vpc/variables.tf

@@ -29,3 +29,9 @@ variable "tags" {
   default     = null
   description = "AWS tags to be applied to generated AWS resources of this VPC."
 }
+
+variable "cleanup_rosa_vpce_security_groups" {
+  type        = bool
+  default     = false
+  description = "On destroy, remove orphaned ROSA HCP PrivateLink security groups (name suffix -vpce-private-router) left in this VPC after cluster deletion. Enable for private ROSA HCP clusters using this module; requires AWS CLI and EC2 permissions at destroy time."
+}

modules/vpc/versions.tf

@@ -13,5 +13,9 @@ terraform {
       source  = "hashicorp/time"
       version = ">= 0.9"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = ">= 3.2.4"
+    }
   }
 }

scripts/vpc-destroy-cleanup.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copyright Red Hat
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+VPC_ID="${1:-}"
+
+if [[ -z "$VPC_ID" ]]; then
+  echo "usage: $0 <vpc-id>" >&2
+  exit 1
+fi
+
+while IFS=$'\t' read -r sg_id sg_name _sg_desc; do
+  [[ -z "$sg_id" || "$sg_id" == "None" ]] && continue
+
+  attached_enis="$(aws ec2 describe-network-interfaces \
+    --filters "Name=group-id,Values=${sg_id}" \
+    --query 'length(NetworkInterfaces)' \
+    --output text 2>/dev/null || echo 0)"
+
+  if [[ "$attached_enis" != "0" ]]; then
+    continue
+  fi
+
+  if [[ "$sg_name" == *"-vpce-private-router" ]]; then
+    aws ec2 delete-security-group --group-id "$sg_id" >/dev/null 2>&1 || true
+  fi
+done < <(aws ec2 describe-security-groups \
+  --filters "Name=vpc-id,Values=${VPC_ID}" \
+  --query 'SecurityGroups[?GroupName!=`default`].[GroupId,GroupName,Description]' \
+  --output text 2>/dev/null || true)
+
+remaining_count="$(aws ec2 describe-security-groups \
+  --filters "Name=vpc-id,Values=${VPC_ID}" \
+  --query 'length(SecurityGroups[?GroupName!=`default`])' \
+  --output text 2>/dev/null || echo 0)"
+
+if [[ "$remaining_count" != "0" ]]; then
+  echo "VPC ${VPC_ID} still has ${remaining_count} non-default security group(s) after cleanup." >&2
+  aws ec2 describe-security-groups \
+    --filters "Name=vpc-id,Values=${VPC_ID}" \
+    --query 'SecurityGroups[?GroupName!=`default`].[GroupId,GroupName,Description]' \
+    --output table >&2
+fi