(aws eks): EKS stack deletes resources in the wrong order, causing DELETE_FAILED
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### What is the problem?
Running `cdk destroy` on an EKS cluster stack always results in DELETE_FAILED.
It appears to be attempting to delete the security group before deleting the cluster, causing a failure to delete as the resource is in use.
This error returns from the control plane security group deletion in cloudformation:
```
resource has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: ; Proxy: null)
```
The cloudformation stack itself then fails to delete with an error like this:
```
The following resource(s) failed to delete: [].
```
### Reproduction Steps
Define a new cluster:
```
new aws_eks.FargateCluster(this, id, {
version: this.props.version,
vpc: this.props.vpc,
endpointAccess: EndpointAccess.PRIVATE,
placeClusterHandlerInVpc: true,
vpcSubnets: [{
subnetType: SubnetType.PRIVATE_WITH_NAT
}]
});
```
then run `cdk deploy`.
After it succeeds, run `cdk destroy` and the error will happen.
### What did you expect to happen?
Handler should delete the EKS cluster first, and then delete the security group.
### What actually happened?
Handler deletes the security group first, which fails because the resource is in use. It then causes rollback failed and/or delete failed.
### CDK CLI Version
2.8.0 (build 8a5eb49)
### Framework Version
_No response_
### Node.js Version
v17.3.1
### OS
MacOS Catalina 10.15.7
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with the aws_eks.FargateCluster construct and reproduce the issue using the configuration in the report, then run cdk deploy followed by cdk destroy. Trace the generated resources and deletion dependencies, focusing on the cluster, Fargate profile, and control plane security group. Done means the EKS cluster is deleted before its dependent security group and the stack completes deletion without DELETE_FAILED.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100