search

Mirantis / hmc

Apache License 2.0
17 stars 16 forks source link

nginx-ingress beachhead service's ELB prevents VPC deletion with VPC DependencyViolation #262

Closed squizzi closed 2 months ago

squizzi commented 2 months ago

If installBeachHeadServices: true is used and nginx-ingress deploys an Amazon ELB, AWS will create a security group for this ELB, the issue is, the security group will not ever be reconciled on deletion of the Deployment and therefore VPCs will not properly get deleted from a Deployment, resulting in the following error from CAPA:

E0904 21:47:19.639776       1 controller.go:329] "Reconciler error" err=<
        error deleting network: failed to delete vpc "vpc-0903c498733816aab": DependencyViolation: The vpc 'vpc-0903c498733816aab' has dependencies and cannot be deleted.
                status code: 400, request id: 1e280582-e116-4008-8704-8e548d8a4330
 > controller="awscluster" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSCluster" AWSCluster="hmc-system/squizzi-aws-dev" namespace="hmc-system" name="squizzi-aws-dev" reconcileID="e24267dd-27ce-433a-8222-625f8d5caaf3"
I0904 21:47:19.640295       1 awscluster_controller.go:208] "Reconciling AWSCluster delete" controller="awscluster" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSCluster" AWSCluster="hmc-system/squizzi-aws-dev" namespace="hmc-system" name="squizzi-aws-dev" reconcileID="2a62831c-2548-466a-8ae0-5671a3ca73ce" cluster="hmc-system/squizzi-aws-dev"

Checking the AWS resources via the UI and there appears to be a single security group attached to the VPC affiliated with the nginx-ingress load balancer:

Security group for Kubernetes ELB aed328c6b0fbd432498ba59c673b35ab (nginx-ingress/nginx-ingress-controller)

If this security group is removed manually the VPC deletes with no issues.

Kshatrix commented 2 months ago

Let's track it as a more generic issue under #152