fix(scripts/eks-lifecycle): sweep orphan ALB controller LB/SG before vpc destroy - #799
Merged
Merged
Conversation
…vpc destroy During a live eks-production teardown, the AWS Load Balancer Controller recreated a shared-IngressGroup ALB (+ its auto-created security groups) after Step 10.4's one-shot tag sweep already ran, racing the bulk `kubectl delete ingress --all`. The orphaned ALB then blocked IGW detach and subnet/VPC deletion with DependencyViolation once the cluster (and controller) was gone. Add a second, tag-based sweep right after the eks stack is destroyed — the last point where recreation is impossible and before alb/vpc destroy needs the dependency clear. Also fix a stale `karpenter` stack name left over from the eks-karpenter rename (#798) in the README's Module version requirements example. Signed-off-by: panicboat <panicboat@gmail.com>
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scripts/eks-lifecycleのギャップを修正kubectl delete ingress --allで1件ずつ削除する際、AWS Load Balancer Controller が Step 10.4 の一度きりの tag sweep 後に同名 ALB（+ 自動作成 security group）を再作成するレースがあり、eks/alb/vpcstack destroy 後にも orphan として残っていたterragrunt destroy(vpc stack) がDependencyViolationで fail する実害を確認30-destroy-stacks.shに、eksstack destroy 直後（controller が確実に消滅した安全なタイミング）にelbv2.k8s.aws/clusterタグで ALB/NLB + security group を再 sweep する処理を追加karpenterstack 名（PR chore(aws): remove unused _modules, rename karpenter to eks-karpenter #798 のeks-karpenterrename 後に取り残されていた）を修正Context
本日の live teardown で以下の順に手動対処した内容を、恒久対応としてスクリプトに反映:
terragrunt init -upgrade（8 stack、Module version drift）force-unlock再開k8s-application-92fded7941) + 2 security group の手動削除（本PRの対象）40-orphan-verify.shStep 40.3 が正しく検出、対応不要と判断）Test plan
shellcheck -x lib/30-destroy-stacks.shエラーなし