Chapter 10. Deleting a Red Hat OpenShift Service on AWS cluster

Procedure

1. Delete the account-wide roles:

   1. List the account-wide roles in your AWS account by using the ROSA CLI (rosa):

      $ rosa list account-roles

      Copy to Clipboard Toggle word wrap

      Example output

      I: Fetching account roles
      ROLE NAME                                 ROLE TYPE      ROLE ARN                                                                 OPENSHIFT VERSION  AWS Managed
      ManagedOpenShift-HCP-ROSA-Installer-Role  Installer      arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Installer-Role  4.19               Yes
      ManagedOpenShift-HCP-ROSA-Support-Role    Support        arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Support-Role    4.19               Yes
      ManagedOpenShift-HCP-ROSA-Worker-Role     Worker         arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Worker-Role     4.19               Yes

      Copy to Clipboard Toggle word wrap

   2. Delete the account-wide roles by running one of the following commands:

      • For clusters without a shared Virtual Private Cloud (VPC):

        $ rosa delete account-roles --prefix <prefix> --mode auto 

        1

        Copy to Clipboard Toggle word wrap

        1

        You must include the --<prefix> argument. Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, ManagedOpenShift.

      • For clusters with a shared VPC:

        $ rosa delete account-roles --prefix <prefix> --delete-hosted-shared-vpc-policies --mode auto 

        1

        Copy to Clipboard Toggle word wrap

        1

        You must include the --<prefix> argument. Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, ManagedOpenShift.

        Important

        The account-wide IAM roles might be used by other Red Hat OpenShift Service on AWS clusters in the same AWS account. Only remove the roles if they are not required by other clusters.

        Example output

        W: There are no classic account roles to be deleted
        I: Deleting hosted CP account roles
        ? Delete the account role 'delete-rosa-HCP-ROSA-Installer-Role'? Yes
        I: Deleting account role 'delete-rosa-HCP-ROSA-Installer-Role'
        ? Delete the account role 'delete-rosa-HCP-ROSA-Support-Role'? Yes
        I: Deleting account role 'delete-rosa-HCP-ROSA-Support-Role'
        ? Delete the account role 'delete-rosa-HCP-ROSA-Worker-Role'? Yes
        I: Deleting account role 'delete-rosa-HCP-ROSA-Worker-Role'
        I: Successfully deleted the hosted CP account roles

        Copy to Clipboard Toggle word wrap

2. Delete the account-wide in-line and Operator policies:

   1. Under the Policies page in the AWS IAM Console, filter the list of policies by the prefix that you specified when you created the account-wide roles and policies.

      Note

      If you did not specify a custom prefix when you created the account-wide roles, search for the default prefix, ManagedOpenShift.

   2. Delete the account-wide policies and Operator policies by using the AWS IAM Console. For more information about deleting IAM policies by using the AWS IAM Console, see Deleting IAM policies in the AWS documentation.

      Important

      The account-wide and Operator IAM policies might be used by other Red Hat OpenShift Service on AWS clusters in the same AWS account. Only remove the roles if they are not required by other clusters.

Procedure

1. Unlink the OpenShift Cluster Manager IAM role from your Red Hat organization and delete the role:

   1. List the OpenShift Cluster Manager IAM roles in your AWS account:

      $ rosa list ocm-roles

      Copy to Clipboard Toggle word wrap

      Example output

      I: Fetching ocm roles
      ROLE NAME                                                     ROLE ARN                                                                                         LINKED  ADMIN  AWS Managed
      ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  Yes      Yes     Yes

      Copy to Clipboard Toggle word wrap

   2. If your OpenShift Cluster Manager IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization by running the following command:

      $ rosa unlink ocm-role --role-arn <arn> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your OpenShift Cluster Manager IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>.

      Example output

      I: Unlinking OCM role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role from organization '<red_hat_organization_id>'? Yes
      I: Successfully unlinked role-arn 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' from organization account '<red_hat_organization_id>'

      Copy to Clipboard Toggle word wrap

   3. Delete the OpenShift Cluster Manager IAM role and policies:

      $ rosa delete ocm-role --role-arn <arn>

      Copy to Clipboard Toggle word wrap

      Example output

      I: Deleting OCM role
      ? OCM Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>
      ? Delete 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' ocm role? Yes
      ? OCM role deletion mode: auto 

      1

      
      I: Successfully deleted the OCM role

      Copy to Clipboard Toggle word wrap

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the OpenShift Cluster Manager IAM role and policies. In manual mode, the ROSA CLI generates the aws commands needed to delete the role and policies. manual mode enables you to review the details before running the aws commands manually.

2. Unlink the user IAM role from your Red Hat organization and delete the role:

   1. List the user IAM roles in your AWS account:

      $ rosa list user-roles

      Copy to Clipboard Toggle word wrap

      Example output

      I: Fetching user roles
      ROLE NAME                                  ROLE ARN                                                                  LINKED
      ManagedOpenShift-User-<ocm_user_name>-Role  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role  Yes

      Copy to Clipboard Toggle word wrap

   2. If your user IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization:

      $ rosa unlink user-role --role-arn <arn> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your user IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role.

      Example output

      I: Unlinking user role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the current account '<ocm_user_account_id>'? Yes
      I: Successfully unlinked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' from account '<ocm_user_account_id>'

      Copy to Clipboard Toggle word wrap

   3. Delete the user IAM role:

      $ rosa delete user-role --role-arn <arn>

      Copy to Clipboard Toggle word wrap

      Example output

      I: Deleting user role
      ? User Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role
      ? Delete the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the AWS account? Yes
      ? User role deletion mode: auto 

      1

      
      I: Successfully deleted the user role

      Copy to Clipboard Toggle word wrap

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the user IAM role. In manual mode, the ROSA CLI generates the aws command needed to delete the role. manual mode enables you to review the details before running the aws command manually.