Skip to content

Commit b86cfe8

Browse files
michaelryanpetermichaelryanpeter
authored
Merge pull request #74557 from jneczypor/OSDOCS-10187
OSDOCS-10187: Add how to delete a ROSA HCP cluster
2 parents 2a8e270 + 0f76ac8 commit b86cfe8

6 files changed

+319
-16
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@ Topics:
229229
File: rosa-hcp-aws-private-creating-cluster
230230
- Name: Using the Node Tuning Operator on ROSA with HCP
231231
File: rosa-tuning-config
232+
- Name: Deleting a ROSA with HCP cluster
233+
File: rosa-hcp-deleting-cluster
232234
---
233235
Name: Install ROSA Classic clusters
234236
Dir: rosa_install_access_delete_clusters

‎modules/rosa-deleting-account-wide-iam-roles-and-policies.adoc

Lines changed: 67 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
// Module included in the following assemblies:
22
//
33
// * rosa_install_access_delete_clusters/rosa-sts-deleting-cluster.adoc
4+
// *rosa_hcp/rosa-hcp-deleting-cluster.adoc
5+
6+
ifeval::["{context}" == "rosa-hcp-deleting-cluster"]
7+
:hcp:
8+
endif::[]
49

510
ifeval::["{context}" == "rosa-sts-deleting-cluster"]
611
:sts:
@@ -10,16 +15,37 @@ endif::[]
1015
[id="rosa-deleting-account-wide-iam-roles-and-policies_{context}"]
1116
= Deleting the account-wide IAM roles and policies
1217

13-
This section provides steps to delete the account-wide IAM roles and policies that you created for ROSA with STS deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the {product-title} (ROSA) with AWS Security Token Services (STS) clusters that depend on them.
18+
This section provides steps to delete the account-wide IAM roles and policies that you created for
19+
ifdef::sts[]
20+
ROSA with STS
21+
endif::sts[]
22+
ifdef::hcp[]
23+
{hcp-title}
24+
endif::hcp[]
25+
deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the
26+
ifdef::sts[]
27+
{product-title} (ROSA) with AWS Security Token Services (STS)
28+
endif::sts[]
29+
ifdef::hcp[]
30+
{hcp-title}
31+
endif::hcp[]
32+
clusters that depend on them.
1433

1534
[IMPORTANT]
1635
====
17-
The account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the roles if they are not required by other clusters.
36+
The account-wide IAM roles and policies might be used by other
37+
ifdef::sts[]
38+
ROSA clusters
39+
endif::sts[]
40+
ifdef::hcp[]
41+
{product-title}
42+
endif::hcp[]
43+
in the same AWS account. Only remove the roles if they are not required by other clusters.
1844
====
1945

2046
.Prerequisites
2147

22-
* You have installed a ROSA cluster.
48+
* You have account-wide IAM roles that you want to delete.
2349
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
2450
2551
.Procedure
@@ -33,6 +59,7 @@ $ rosa list account-roles
3359
----
3460
+
3561
.Example output
62+
ifdef::sts[]
3663
[source,terminal]
3764
----
3865
I: Fetching account roles
@@ -42,6 +69,17 @@ ManagedOpenShift-Installer-Role Installer arn:aws:iam::<aws_account_id>
4269
ManagedOpenShift-Support-Role Support arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Support-Role 4.10
4370
ManagedOpenShift-Worker-Role Worker arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role 4.10
4471
----
72+
endif::sts[]
73+
ifdef::hcp[]
74+
[source,terminal]
75+
----
76+
I: Fetching account roles
77+
ROLE NAME ROLE TYPE ROLE ARN OPENSHIFT VERSION AWS Managed
78+
ManagedOpenShift-HCP-ROSA-Installer-Role Installer arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Installer-Role 4.15 Yes
79+
ManagedOpenShift-HCP-ROSA-Support-Role Support arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Support-Role 4.15 Yes
80+
ManagedOpenShift-HCP-ROSA-Worker-Role Worker arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Worker-Role 4.15 Yes
81+
----
82+
endif::hcp[]
4583
.. Delete the account-wide roles:
4684
+
4785
[source,terminal]
@@ -52,9 +90,25 @@ $ rosa delete account-roles --prefix <prefix> --mode auto <1>
5290
+
5391
[IMPORTANT]
5492
====
55-
The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. You must only remove the roles if they are not required by other clusters.
93+
The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
5694
====
57-
95+
+
96+
ifdef::hcp[]
97+
.Example output
98+
[source,terminal]
99+
----
100+
W: There are no classic account roles to be deleted
101+
I: Deleting hosted CP account roles
102+
? Delete the account role 'delete-rosa-HCP-ROSA-Installer-Role'? Yes
103+
I: Deleting account role 'delete-rosa-HCP-ROSA-Installer-Role'
104+
? Delete the account role 'delete-rosa-HCP-ROSA-Support-Role'? Yes
105+
I: Deleting account role 'delete-rosa-HCP-ROSA-Support-Role'
106+
? Delete the account role 'delete-rosa-HCP-ROSA-Worker-Role'? Yes
107+
I: Deleting account role 'delete-rosa-HCP-ROSA-Worker-Role'
108+
I: Successfully deleted the hosted CP account roles
109+
----
110+
endif::hcp[]
111+
+
58112
. Delete the account-wide in-line and Operator policies:
59113
.. Under the *Policies* page in the link:https://console.aws.amazon.com/iamv2/home#/policies[AWS IAM Console], filter the list of policies by the prefix that you specified when you created the account-wide roles and policies.
60114
+
@@ -67,5 +121,12 @@ If you did not specify a custom prefix when you created the account-wide roles,
67121
+
68122
[IMPORTANT]
69123
====
70-
The account-wide in-line and Operator IAM policies might be used by other ROSA clusters in the same AWS account. You must only remove the roles if they are not required by other clusters.
124+
The account-wide in-line and Operator IAM policies might be used by other
125+
ifdef::sts[]
126+
ROSA clusters
127+
endif::sts[]
128+
ifdef::hcp[]
129+
{hcp-title}
130+
endif::hcp[]
131+
in the same AWS account. Only remove the roles if they are not required by other clusters.
71132
====

‎modules/rosa-deleting-sts-iam-resources-account-wide.adoc

Lines changed: 45 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,58 @@
11
// Module included in the following assemblies:
22
//
33
// * rosa_install_access_delete_clusters/rosa-sts-deleting-cluster.adoc
4+
// *rosa_hcp/rosa-hcp-deleting-cluster.adoc
5+
6+
ifeval::["{context}" == "rosa-hcp-deleting-cluster"]
7+
:hcp:
8+
endif::[]
49

510
:_mod-docs-content-type: PROCEDURE
611
[id="rosa-deleting-sts-resources-account-wide_{context}"]
712
= Deleting the account-wide IAM resources
813

9-
After you have deleted all {product-title} (ROSA) with AWS Security Token Services (STS) clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.
14+
After you have deleted all
15+
ifndef::hcp[]
16+
{product-title} (ROSA) with AWS Security Token Services (STS)
17+
endif::hcp[]
18+
ifdef::hcp[]
19+
{hcp-title-first}
20+
endif::hcp[]
21+
clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.
1022

11-
If you no longer need to install a ROSA with STS cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.
23+
If you no longer need to install a
24+
ifndef::hcp[]
25+
ROSA with STS
26+
endif::hcp[]
27+
ifdef::hcp[]
28+
{hcp-title}
29+
endif::hcp[]
30+
cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.
1231

1332
[IMPORTANT]
1433
====
15-
The account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
34+
The account-wide IAM roles and policies might be used by other
35+
ifndef::hcp[]
36+
ROSA
37+
endif::hcp[]
38+
ifdef::hcp[]
39+
{hcp-title}
40+
endif::hcp[]
41+
clusters in the same AWS account. Only remove the resources if they are not required by other clusters.
1642
17-
The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other ROSA clusters in the same AWS account by using {cluster-manager}. You must only remove the roles if you no longer need to install ROSA clusters in your account by using {cluster-manager}. See the "Additional resources" section for information on repairing your cluster if these roles are removed prior to deletion.
18-
====
43+
The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other
44+
ifndef::hcp[]
45+
ROSA
46+
endif::hcp[]
47+
ifdef::hcp[]
48+
{product-title}
49+
endif::hcp[]
50+
clusters in the same AWS account by using {cluster-manager}. Only remove the roles if you no longer need to install
51+
ifndef::hcp[]
52+
ROSA
53+
endif::hcp[]
54+
ifdef::hcp[]
55+
{product-title}
56+
endif::hcp[]
57+
clusters in your account by using {cluster-manager}. For more information about repairing your cluster if these roles are removed before deletion, see "Repairing a cluster that cannot be deleted" in _Troubleshooting cluster deployments_.
58+
====

‎modules/rosa-hcp-deleting-cluster.adoc

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-deleting-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="rosa-hcp-deleting-cluster_{context}"]
7+
= Deleting a {hcp-title} cluster and the cluster-specific IAM resources
8+
9+
You can delete a {hcp-title} cluster by using the ROSA command line interface (CLI) (`rosa`) or {cluster-manager-first}.
10+
11+
After deleting the cluster, you can clean up the cluster-specific Identity and Access Management (IAM) resources in your AWS account by using the ROSA CLI. The cluster-specific resources include the Operator roles and the OpenID Connect (OIDC) provider.
12+
13+
[NOTE]
14+
====
15+
The cluster deletion must complete before you remove the IAM resources, because the resources are used in the cluster deletion and clean up processes.
16+
====
17+
18+
If add-ons are installed, the cluster deletion takes longer because add-ons are uninstalled before the cluster is deleted. The amount of time depends on the number and size of the add-ons.
19+
20+
.Prerequisites
21+
22+
* You have installed a {hcp-title} cluster.
23+
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
24+
25+
.Procedure
26+
27+
. Get the cluster ID, the Amazon Resource Names (ARNs) for the cluster-specific Operator roles, and the endpoint URL for the OIDC provider by running the following command:
28+
+
29+
[source,terminal]
30+
----
31+
$ rosa describe cluster --cluster=<cluster_name>
32+
----
33+
+
34+
.Example output
35+
[source,terminal]
36+
----
37+
Name: test_cluster
38+
Domain Prefix: test_cluster
39+
Display Name: test_cluster
40+
ID: <cluster_id> <1>
41+
External ID: <external_id>
42+
Control Plane: ROSA Service Hosted
43+
OpenShift Version: 4.15.0
44+
Channel Group: stable
45+
DNS: test_cluster.l3cn.p3.openshiftapps.com
46+
AWS Account: <AWS_id>
47+
AWS Billing Account: <AWS_id>
48+
API URL: https://api.test_cluster.l3cn.p3.openshiftapps.com:443
49+
Console URL:
50+
Region: us-east-1
51+
Availability:
52+
- Control Plane: MultiAZ
53+
- Data Plane: SingleAZ
54+
55+
Nodes:
56+
- Compute (desired): 2
57+
- Compute (current): 0
58+
Network:
59+
- Type: OVNKubernetes
60+
- Service CIDR: 172.30.0.0/16
61+
- Machine CIDR: 10.0.0.0/16
62+
- Pod CIDR: 10.128.0.0/14
63+
- Host Prefix: /23
64+
- Subnets: <subnet_ids>
65+
EC2 Metadata Http Tokens: optional
66+
Role (STS) ARN: arn:aws:iam::<AWS_id>:role/test_cluster-HCP-ROSA-Installer-Role
67+
Support Role ARN: arn:aws:iam::<AWS_id>:role/test_cluster-HCP-ROSA-Support-Role
68+
Instance IAM Roles:
69+
- Worker: arn:aws:iam::<AWS_id>:role/test_cluster-HCP-ROSA-Worker-Role
70+
Operator IAM Roles: <2>
71+
- arn:aws:iam::<AWS_id>:role/test_cluster-openshift-cloud-network-config-controller-cloud-crede
72+
- arn:aws:iam::<AWS_id>:role/test_cluster-openshift-image-registry-installer-cloud-credentials
73+
- arn:aws:iam::<AWS_id>:role/test_cluster-openshift-ingress-operator-cloud-credentials
74+
- arn:aws:iam::<AWS_id>:role/test_cluster-kube-system-kube-controller-manager
75+
- arn:aws:iam::<AWS_id>:role/test_cluster-kube-system-capa-controller-manager
76+
- arn:aws:iam::<AWS_id>:role/test_cluster-kube-system-control-plane-operator
77+
- arn:aws:iam::<AWS_id>:role/hcpcluster-kube-system-kms-provider
78+
- arn:aws:iam::<AWS_id>:role/test_cluster-openshift-cluster-csi-drivers-ebs-cloud-credentials
79+
Managed Policies: Yes
80+
State: ready
81+
Private: No
82+
Created: Apr 16 2024 20:32:06 UTC
83+
User Workload Monitoring: Enabled
84+
Details Page: https://console.redhat.com/openshift/details/s/<cluster_id>
85+
OIDC Endpoint URL: https://oidc.op1.openshiftapps.com/<cluster_id> (Managed) <3>
86+
Audit Log Forwarding: Disabled
87+
External Authentication: Disabled
88+
----
89+
<1> Lists the cluster ID.
90+
<2> Specifies the ARNs for the cluster-specific Operator roles. For example, in the sample output the ARN for the role required by the Machine Config Operator is `arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-machine-api-aws-cloud-credentials`.
91+
<3> Displays the endpoint URL for the cluster-specific OIDC provider.
92+
+
93+
[IMPORTANT]
94+
====
95+
After the cluster is deleted, you need the cluster ID to delete the cluster-specific STS resources using the ROSA CLI.
96+
====
97+
98+
. Delete the cluster by using either the {cluster-manager} or the ROSA CLI (`rosa`):
99+
** To delete the cluster by using the {cluster-manager}:
100+
.. Navigate to the {cluster-manager-url}.
101+
.. Click the Options menu {kebab} next to your cluster and select *Delete cluster*.
102+
.. Type the name of your cluster into the prompt and click *Delete*.
103+
** To delete the cluster using the ROSA CLI:
104+
.. Run the following command, replacing `<cluster_name>` with the name or ID of your cluster:
105+
+
106+
[source,terminal]
107+
----
108+
$ rosa delete cluster --cluster=<cluster_name> --watch
109+
----
110+
+
111+
[IMPORTANT]
112+
====
113+
You must wait for cluster deletion to complete before you remove the Operator roles and the OIDC provider.
114+
====
115+
116+
. Delete the cluster-specific Operator IAM roles by running the following command:
117+
+
118+
[source,terminal]
119+
----
120+
$ rosa delete operator-roles --prefix <operator_role_prefix>
121+
----
122+
123+
. Delete the OIDC provider by running the following command:
124+
+
125+
[source,terminal]
126+
----
127+
$ rosa delete oidc-provider --oidc-config-id <oidc_config_id>
128+
----
129+
130+
//If reusing, porting, or separating this content, make sure to grab the "Troubleshooting" section from the assembly. It could not be included in the module because of xrefs.

0 commit comments

Comments
 (0)