allow uninstalling AWS objects created by prerequisite playbook

add deprovisioners/uninstallers for objects created via playbooks/aws/openshift-cluster/prerequisites.yml

specifically: security groups, vpcs, and any ssh keys

introduce openshift_aws_enable_uninstall_shared_objects to protect AWS objects that would be shared in the case of multiple clusters co-existing in one AWS account. right now it protects the ssh keys, but it can/should be used to protect against deleting the shared IAM instance profile as well. default this variable to False to be on the safe side when uninstalling/deprovisioning.

add some documentation on using deprovisioning playbooks

4 files changed, 63 insertions, 0 deletions

diff --git a/roles/openshift_aws/defaults/main.yml b/roles/openshift_aws/defaults/main.yml
index efd2468b2..a729e8dbd 100644
--- a/roles/openshift_aws/defaults/main.yml
+++ b/roles/openshift_aws/defaults/main.yml
@@ -301,3 +301,7 @@ openshift_aws_node_user_data: ''
 openshift_aws_node_config_namespace: openshift-node
 
 openshift_aws_masters_groups: masters,etcd,nodes
+
+# By default, don't delete things like the shared IAM instance
+# profile and uploaded ssh keys
+openshift_aws_enable_uninstall_shared_objects: False
diff --git a/roles/openshift_aws/tasks/uninstall_security_group.yml b/roles/openshift_aws/tasks/uninstall_security_group.yml
new file mode 100644
index 000000000..55d40e8ec
--- /dev/null
+++ b/roles/openshift_aws/tasks/uninstall_security_group.yml
@@ -0,0 +1,14 @@
+---
+- name: delete the node group sgs
+  oo_ec2_group:
+    state: absent
+    name: "{{ item.value.name}}"
+    region: "{{ openshift_aws_region }}"
+  with_dict: "{{ openshift_aws_node_security_groups }}"
+
+- name: delete the k8s sgs for the node group
+  oo_ec2_group:
+    state: absent
+    name: "{{ item.value.name }}_k8s"
+    region: "{{ openshift_aws_region }}"
+  with_dict: "{{ openshift_aws_node_security_groups }}"
diff --git a/roles/openshift_aws/tasks/uninstall_ssh_keys.yml b/roles/openshift_aws/tasks/uninstall_ssh_keys.yml
new file mode 100644
index 000000000..27e42da53
--- /dev/null
+++ b/roles/openshift_aws/tasks/uninstall_ssh_keys.yml
@@ -0,0 +1,9 @@
+---
+- name: Remove the public keys for the user(s)
+  ec2_key:
+    state: absent
+    name: "{{ item.key_name }}"
+    region: "{{ openshift_aws_region }}"
+  with_items: "{{ openshift_aws_users }}"
+  no_log: True
+  when: openshift_aws_enable_uninstall_shared_objects | bool
diff --git a/roles/openshift_aws/tasks/uninstall_vpc.yml b/roles/openshift_aws/tasks/uninstall_vpc.yml
new file mode 100644
index 000000000..ecf39f694
--- /dev/null
+++ b/roles/openshift_aws/tasks/uninstall_vpc.yml
@@ -0,0 +1,36 @@
+---
+- name: Fetch the VPC for the vpc.id
+  ec2_vpc_net_facts:
+    region: "{{ openshift_aws_region }}"
+    filters:
+      "tag:Name": "{{ openshift_aws_clusterid }}"
+  register: vpcout
+- debug:
+    var: vpcout
+    verbosity: 1
+
+- when: vpcout.vpcs | length > 0
+  block:
+  - name: delete the vpc igw
+    ec2_vpc_igw:
+      state: absent
+      region: "{{ openshift_aws_region }}"
+      vpc_id: "{{ vpcout.vpcs[0].id }}"
+    register: igw
+
+  - name: delete the vpc subnets
+    ec2_vpc_subnet:
+      state: absent
+      region: "{{ openshift_aws_region }}"
+      vpc_id: "{{ vpcout.vpcs[0].id }}"
+      cidr: "{{ item.cidr }}"
+      az: "{{ item.az }}"
+    with_items: "{{ openshift_aws_vpc.subnets[openshift_aws_region] }}"
+
+  - name: Delete AWS VPC
+    ec2_vpc_net:
+      state: absent
+      region: "{{ openshift_aws_region }}"
+      name: "{{ openshift_aws_clusterid }}"
+      cidr_block: "{{ openshift_aws_vpc.cidr }}"
+    register: vpc