crossplane-contrib / provider-aws

Crossplane AWS Provider
Apache License 2.0
433 stars 368 forks source link

EKSCluster failed to create, and now cannot be deleted from Kubernetes #103

Closed negz closed 2 years ago

negz commented 5 years ago

Is this a bug report or feature request? Bug Report

Deviation from expected behavior: I attempted to create an EKS cluster using the below resource class and claim.

---
apiVersion: compute.crossplane.io/v1alpha1
kind: KubernetesCluster
metadata:
  name: kubernetes
  namespace: example
  labels:
    app: example
spec:
  classReference:
    name: kubernetes-eks-example
    namespace: crossplane-system
---
apiVersion: core.crossplane.io/v1alpha1
kind: ResourceClass
metadata:
  name: kubernetes-eks-example
  namespace: crossplane-system
  labels:
    app: example
parameters:
  region: us-west-2
  roleARN: REDACTED
  vpcId: REDACTED
  subnetIds: subnet-REDACTED
  securityGroupIds: REDACTED
  workerKeyName: REDACTED
  workerNodeInstanceType: m3.medium
provisioner: ekscluster.compute.aws.crossplane.io/v1alpha1
providerRef:
  name: aws-example
reclaimPolicy: Delete

This resulted in an error:

Status:                                                                                                                                                                 [147/1504]
  Conditions:                                                                                                                        
    Last Transition Time:  2019-03-26T23:17:11Z                     
    Message:               InvalidParameterException: Subnets specified must be in at least two different AZs
                           status code: 400, request id: 4814d859-501d-11e9-b671-2fdcdcd2cd1d
    Reason:                Failed to create new cluster
    Status:                True                          
    Type:                  Failed   

I attempted to delete the ekscluster in order to rectify my mistake, but encountered the following error:

$ kubectl -n gitlab delete kubernetescluster kubernetes-example
$ kubectl -n crossplane-system describe ekscluster kubernetes-eks-example
# ...
Status:
  Conditions:
    Last Transition Time:  2019-03-26T23:27:55Z
    Message:               Master Delete Error: AccessDeniedException: Unable to determine service/operation name to be authorized
                           status code: 403, request id: c8ca907b-501e-11e9-b126-bf9e02431975
    Reason:                Failed to delete cluster
    Status:                True
    Type:                  Failed

When I look in my AWS console I see no Kubernetes clusters to delete. I presume my provider credentials have the correct permissions given that my creation request failed for reasons other than authorization. My AWS provider is configured to use the access token of a user in the administrator AWS group, which has policy arn:aws:iam::aws:policy/AdministratorAccess.

Expected behavior: Deleting the ekscluster from Kubernetes results in it being deleted from AWS.

Environment:

$ kubectl -n crossplane-system describe deploy crossplane|grep Image
    Image:      crossplane/crossplane:v0.1.0-171.g3f13ae6

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.4", GitCommit:"c27b913fddd1a6c480c229191a087698aa92f0b1", GitTreeState:"clean", BuildDate:"2019-03-01T23:34:27Z", GoVersion:"go1.12", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.1", GitCommit:"eec55b9ba98609a46fee712359c7b5b365bdd920", GitTreeState:"clean", BuildDate:"2018-12-13T10:31:33Z", GoVersion:"go1.11.2", Compiler:"gc", Platform:"linux/amd64"}

$ ./cluster/local/minikube.sh ssh
# ...
$ cat /etc/os-release 
NAME=Buildroot
VERSION=2018.05
ID=buildroot
VERSION_ID=2018.05
PRETTY_NAME="Buildroot 2018.05"

$ uname -a
Linux minikube 4.15.0 crossplaneio/crossplane#1 SMP Fri Jan 18 22:39:33 UTC 2019 x86_64 GNU/Linux
negz commented 4 years ago

I thiiiiink this might be resolved by https://github.com/crossplaneio/crossplane-runtime/pull/70 once we port the EKS controllers to the generic managed reconciler.

haarchri commented 2 years ago

@negz think we can close this Issue ? Looks like outdated