Security Group for CCE is not deleted along with CCE cluster

[bkondek]

Hello,

during many tests, my resources weren't properly removed via the "terraform destroy" command. I create CCE (Kubernetes cluster) with all underlying required resources, e.g. VPC and subnets. Many times VPC couldn't be removed because of a security group "-cce-node-" existence. This group is created during Kubernetes cluster provisioning ("The security group is created by CCE cluster") and should be removed along with this cluster. Cluster removal is marked as done and other resources are deleted except this security group and VPC which is blocked by this group existence.

Terraform Version

1.5.2

Affected Resource(s)

• security group xxx-cce-node-xxx

Terraform Configuration Files

resource "flexibleengine_vpc_subnet_v1" "default" {
  name          = "${var.name}-default"
  cidr          = var.networking.default_subnet.cidr
  gateway_ip    = var.networking.default_subnet.gateway
  vpc_id        = flexibleengine_vpc_v1.vpc.id
  primary_dns   = "100.125.0.41"
  secondary_dns = "100.125.12.161"
}

resource "flexibleengine_vpc_subnet_v1" "master" {
  name          = "${var.name}-master"
  cidr          = var.kubernetes.subnet.cidr
  gateway_ip    = var.kubernetes.subnet.gateway
  vpc_id        = flexibleengine_vpc_v1.vpc.id
  primary_dns   = "100.125.0.41"
  secondary_dns = "100.125.12.161"
}

resource "flexibleengine_vpc_eip" "kubernetes_api" {
  publicip {
    type = "5_bgp"
  }
  bandwidth {
    name       = "${var.name}-kubernetes-api"
    size       = 100
    share_type = "PER"
  }
}

resource "flexibleengine_cce_cluster_v3" "cluster" {
  name                   = var.name
  cluster_type           = "VirtualMachine"
  authentication_mode    = "rbac"
  description            = "${var.name} - k8s cluster"
  flavor_id              = var.kubernetes.flavor
  cluster_version        = var.kubernetes.version
  vpc_id                 = flexibleengine_vpc_v1.vpc.id
  subnet_id              = flexibleengine_vpc_subnet_v1.master.id
  container_network_type = "overlay_l2"
  container_network_cidr = var.kubernetes.container_network_cidr
  service_network_cidr   = var.kubernetes.service_network_cidr
  eip                    = flexibleengine_vpc_eip.kubernetes_api.publicip[0].ip_address

  dynamic "masters" {
    for_each = var.kubernetes.zones
    content {
      availability_zone = masters.value
    }
  }
}

Panic Output

flexibleengine_cce_cluster_v3.cluster: Still destroying... [id=63da9d7a-eb78-11ee-9517-0255ac100038, 2m20s elapsed] flexibleengine_cce_cluster_v3.cluster: Destruction complete after 2m22s error deleting VPC 36017c68-c1e5-4f53-8c08-bb975b0682d5: timeout while waiting for state to become 'DELETED' (last state: 'ACTIVE', timeout: 3m0s

Expected Behavior

During CCE cluster removal, TF provider should verify if automatically created Security Group for CCE is also deleted before confirmation that cluster is deleted.

Actual Behavior

Mentioned security group in majority of tests remains and VPC can't be deleted.

Steps to Reproduce

1. terraform apply
2. terraform destroy