Bug 1967531

Summary:	the ccoctl tool should extend MaxItems when listRoles, the default value 100 is a little small
Product:	OpenShift Container Platform	Reporter:	wang lin <lwan>
Component:	Cloud Credential Operator	Assignee:	Akhil Rane <arane>
Status:	CLOSED ERRATA	QA Contact:	wang lin <lwan>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	4.8	CC:	arane, lwan
Target Milestone:	---
Target Release:	4.8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: aws-sdk list roles is paginated to return only 100 items as default Consequence: if account contained more than 100 roles, some of the roles were skipped from deletion Fix: list roles paginated results are evaluated until all the roles are deleted Result: All the roles are deleted as expected	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-27 23:11:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description wang lin 2021-06-03 10:20:20 UTC

Description of problem:
When using the command `./ccoctl aws create-all --name <name> --region <region> --credentials-requests-dir <credentials-requests-dir>` to create resources on aws, if --name parameter given string starts with letters q to z like “ranglin,wanglin or zanglin”, when I delete those resources using the command `./ccoctl aws delete --name <name> --region <region>`, the bucket and identity_providers can be deleted, the created roles can not be deleted. But if the given string starts with letters a to p like “linwang,jinwang or kinwang”, the roles can be deleted when running the delete command. 
 
OCP version:
quay.io/openshift-release-dev/ocp-release:4.8.0-fc.7-x86_64

How reproducible:
Always

Steps to Reproduce:
 Running the ccoctl create command, --name parameter given a string start with letter in q->z
 Running the ccoctl delete command, check the command output, and aws roles from aws consoles

Actual results:
The roles can not be deleted

Expected results:
Whatever “--name” parameter given letter it starts with, the roles should be able to be deleted.

Additional info:

Comment 1 wang lin 2021-06-04 02:46:33 UTC

The code is in here https://github.com/openshift/cloud-credential-operator/blob/master/pkg/cmd/provisioning/aws/delete.go#L86

Comment 3 wang lin 2021-06-15 03:05:00 UTC

Verified on 4.8.0-0.nightly-2021-06-14-145150

Now ccoctl can delete roles which exceed 100 Items

./ccoctl aws delete --name zwan-tt-1 --region us-east-2
2021/06/15 10:37:24 Identity Provider object .well-known/openid-configuration deleted from the bucket zwan-tt-1-oidc
2021/06/15 10:37:24 Identity Provider object keys.json deleted from the bucket zwan-tt-1-oidc
2021/06/15 10:37:25 Identity Provider bucket zwan-tt-1-oidc deleted
2021/06/15 10:38:13 Policy zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o associated with IAM Role zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o deleted
2021/06/15 10:38:13 IAM Role zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o deleted
2021/06/15 10:38:14 Policy zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials associated with IAM Role zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials deleted
2021/06/15 10:38:15 IAM Role zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials deleted
2021/06/15 10:38:16 Policy zwan-tt-1-openshift-image-registry-installer-cloud-credentials associated with IAM Role zwan-tt-1-openshift-image-registry-installer-cloud-credentials deleted
2021/06/15 10:38:16 IAM Role zwan-tt-1-openshift-image-registry-installer-cloud-credentials deleted
2021/06/15 10:38:17 Policy zwan-tt-1-openshift-ingress-operator-cloud-credentials associated with IAM Role zwan-tt-1-openshift-ingress-operator-cloud-credentials deleted
2021/06/15 10:38:17 IAM Role zwan-tt-1-openshift-ingress-operator-cloud-credentials deleted
2021/06/15 10:38:18 Policy zwan-tt-1-openshift-machine-api-aws-cloud-credentials associated with IAM Role zwan-tt-1-openshift-machine-api-aws-cloud-credentials deleted
2021/06/15 10:38:18 IAM Role zwan-tt-1-openshift-machine-api-aws-cloud-credentials deleted
2021/06/15 10:38:34 Identity Provider with ARN arn:aws:iam::XXXXXXXX:oidc-provider/zwan-tt-1-oidc.s3.us-east-2.amazonaws.com deleted

Comment 6 errata-xmlrpc 2021-07-27 23:11:25 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438