Bug 1967531 - the ccoctl tool should extend MaxItems when listRoles, the default value 100 is a little small
Summary: the ccoctl tool should extend MaxItems when listRoles, the default value 100 ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Cloud Credential Operator
Version: 4.8
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: 4.8.0
Assignee: Akhil Rane
QA Contact: wang lin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-06-03 10:20 UTC by wang lin
Modified: 2021-07-27 23:11 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: aws-sdk list roles is paginated to return only 100 items as default Consequence: if account contained more than 100 roles, some of the roles were skipped from deletion Fix: list roles paginated results are evaluated until all the roles are deleted Result: All the roles are deleted as expected
Clone Of:
Environment:
Last Closed: 2021-07-27 23:11:25 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift cloud-credential-operator pull 351 0 None open Bug 1967531: Fix ccoctl delete not removing iam roles 2021-06-07 15:53:24 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 23:11:42 UTC

Description wang lin 2021-06-03 10:20:20 UTC
Description of problem:
When using the command `./ccoctl aws create-all --name <name> --region <region> --credentials-requests-dir <credentials-requests-dir>` to create resources on aws, if --name parameter given string starts with letters q to z like “ranglin,wanglin or zanglin”, when I delete those resources using the command `./ccoctl aws delete --name <name> --region <region>`, the bucket and identity_providers can be deleted, the created roles can not be deleted. But if the given string starts with letters a to p like “linwang,jinwang or kinwang”, the roles can be deleted when running the delete command. 
 
OCP version:
quay.io/openshift-release-dev/ocp-release:4.8.0-fc.7-x86_64

How reproducible:
Always

Steps to Reproduce:
 Running the ccoctl create command, --name parameter given a string start with letter in q->z
 Running the ccoctl delete command, check the command output, and aws roles from aws consoles

Actual results:
The roles can not be deleted

Expected results:
Whatever “--name” parameter given letter it starts with, the roles should be able to be deleted.

Additional info:

Comment 3 wang lin 2021-06-15 03:05:00 UTC
Verified on 4.8.0-0.nightly-2021-06-14-145150

Now ccoctl can delete roles which exceed 100 Items

./ccoctl aws delete --name zwan-tt-1 --region us-east-2
2021/06/15 10:37:24 Identity Provider object .well-known/openid-configuration deleted from the bucket zwan-tt-1-oidc
2021/06/15 10:37:24 Identity Provider object keys.json deleted from the bucket zwan-tt-1-oidc
2021/06/15 10:37:25 Identity Provider bucket zwan-tt-1-oidc deleted
2021/06/15 10:38:13 Policy zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o associated with IAM Role zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o deleted
2021/06/15 10:38:13 IAM Role zwan-tt-1-openshift-cloud-credential-operator-cloud-credential-o deleted
2021/06/15 10:38:14 Policy zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials associated with IAM Role zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials deleted
2021/06/15 10:38:15 IAM Role zwan-tt-1-openshift-cluster-csi-drivers-ebs-cloud-credentials deleted
2021/06/15 10:38:16 Policy zwan-tt-1-openshift-image-registry-installer-cloud-credentials associated with IAM Role zwan-tt-1-openshift-image-registry-installer-cloud-credentials deleted
2021/06/15 10:38:16 IAM Role zwan-tt-1-openshift-image-registry-installer-cloud-credentials deleted
2021/06/15 10:38:17 Policy zwan-tt-1-openshift-ingress-operator-cloud-credentials associated with IAM Role zwan-tt-1-openshift-ingress-operator-cloud-credentials deleted
2021/06/15 10:38:17 IAM Role zwan-tt-1-openshift-ingress-operator-cloud-credentials deleted
2021/06/15 10:38:18 Policy zwan-tt-1-openshift-machine-api-aws-cloud-credentials associated with IAM Role zwan-tt-1-openshift-machine-api-aws-cloud-credentials deleted
2021/06/15 10:38:18 IAM Role zwan-tt-1-openshift-machine-api-aws-cloud-credentials deleted
2021/06/15 10:38:34 Identity Provider with ARN arn:aws:iam::XXXXXXXX:oidc-provider/zwan-tt-1-oidc.s3.us-east-2.amazonaws.com deleted

Comment 6 errata-xmlrpc 2021-07-27 23:11:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.