Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup-security-group misses elb security groups #158

Open
1 task done
dpedu opened this issue Apr 27, 2022 · 0 comments
Open
1 task done

cleanup-security-group misses elb security groups #158

dpedu opened this issue Apr 27, 2022 · 0 comments
Labels
bug Something isn't working

Comments

@dpedu
Copy link

dpedu commented Apr 27, 2022

Describe the bug
I ran this tool and it deleted the cluster's security group but not groups created for load balancers.

To Reproduce

  • Create an eks service with load balancer
  • Delete the service (LB automatically removed, leaves orphan security groups in certain situations)
  • Call kubergrunt.
resource "aws_eks_cluster" "eks" {
   ...
  provisioner "local-exec" {
    when    = destroy
    command = "kubergrunt eks cleanup-security-group --eks-cluster-arn ${self.arn} --security-group-id ${self.vpc_config.0.cluster_security_group_id} --vpc-id ${self.vpc_config.0.vpc_id}"
  }
}

Expected behavior
Kubergrunt deletes the orphaned load balancer security groups.

Nice to have

  • Terminal output
module.eks_common.aws_eks_cluster.eks (local-exec): Executing: ["/bin/sh" "-c" "kubergrunt eks cleanup-security-group --eks-cluster-arn arn:aws:eks:us-east-1:xxxx:cluster/dpedu5-eks --security-group-id sg-0a10673de28a8a38f --vpc-id vpc-07c666f30e4bebbef"]
module.eks_common.aws_eks_cluster.eks (local-exec): [] time="2022-04-27T12:30:25-07:00" level=info msg="Successfully authenticated with AWS" name=kubergrunt
module.eks_common.aws_eks_cluster.eks (local-exec): [] time="2022-04-27T12:30:26-07:00" level=info msg="Deleting security group sg-0a10673de28a8a38f" name=kubergrunt
module.eks_common.aws_eks_cluster.eks (local-exec): [] time="2022-04-27T12:30:26-07:00" level=info msg="Security group sg-0a10673de28a8a38f already deleted." name=kubergrunt

Additional context
The orphaned security groups have a tag like: kubernetes.io/cluster/<clustername>=owned. See kubernetes/kubernetes#109698 for the conditions under which these orphaned groups are created and not deleted.

@dpedu dpedu added the bug Something isn't working label Apr 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant