Skip to content

Commit 3c1efc2

Browse files
akananthakananth
authored
Create destroy-nic-nap.yml
1 parent 4d0270f commit 3c1efc2

File tree

1 file changed

+365
-0
lines changed

1 file changed

+365
-0
lines changed

‎.github/workflows/destroy-nic-nap.yml

Lines changed: 365 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,365 @@
1+
name: "NGINX V5-NIC/NAP Destroy"
2+
on:
3+
push:
4+
branches:
5+
- destroy-nic-napv5
6+
pull_request:
7+
env:
8+
AWS_REGION: us-east-1
9+
jobs:
10+
terraform_arcadia:
11+
name: "Destroy Arcadia WebApp"
12+
runs-on: ubuntu-latest
13+
defaults:
14+
run:
15+
working-directory: ./arcadia
16+
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
21+
- name: Configure AWS Credentials
22+
uses: aws-actions/configure-aws-credentials@v3
23+
with:
24+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
25+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
26+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
27+
aws-region: ${{ env.AWS_REGION }}
28+
29+
- name: Setup Terraform
30+
uses: hashicorp/setup-terraform@v3
31+
32+
- name: Terraform Init
33+
run: terraform init
34+
35+
- name: Terraform Validate
36+
run: terraform validate -no-color
37+
38+
- name: Terraform Plan (Destroy)
39+
if: github.event_name == 'pull_request' || github.event_name == 'push'
40+
run: |
41+
terraform plan -destroy -no-color -input=false -lock=false -out=tfplan
42+
terraform show -no-color tfplan > plan.txt
43+
44+
- name: Check Changes
45+
id: check_changes
46+
run: |
47+
if grep -q "No changes." plan.txt; then
48+
echo "has_changes=false" >> $GITHUB_OUTPUT
49+
else
50+
echo "has_changes=true" >> $GITHUB_OUTPUT
51+
fi
52+
53+
- name: Terraform Destroy
54+
if: github.event_name == 'push' && github.ref == 'refs/heads/destroy-nic-napv5' && steps.check_changes.outputs.has_changes == 'true'
55+
run: terraform destroy -auto-approve -lock=false -input=false
56+
57+
terraform_policy:
58+
name: "Destroy NGINX Policy"
59+
runs-on: ubuntu-latest
60+
needs: terraform_arcadia
61+
defaults:
62+
run:
63+
working-directory: ./policy
64+
steps:
65+
- name: Checkout
66+
uses: actions/checkout@v4
67+
68+
- name: Configure AWS Credentials
69+
uses: aws-actions/configure-aws-credentials@v3
70+
with:
71+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
72+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
73+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
74+
aws-region: ${{ env.AWS_REGION }}
75+
76+
- name: Setup Terraform
77+
uses: hashicorp/setup-terraform@v3
78+
79+
- name: Terraform Init
80+
run: terraform init
81+
82+
- name: Terraform Destroy
83+
run: terraform destroy -auto-approve -lock=false
84+
85+
terraform_nap:
86+
name: "Destroy NGINX NIC/App Protect"
87+
runs-on: ubuntu-latest
88+
needs: terraform_policy
89+
defaults:
90+
run:
91+
working-directory: ./nap
92+
steps:
93+
- name: Checkout
94+
uses: actions/checkout@v4
95+
96+
- name: Configure AWS Credentials
97+
uses: aws-actions/configure-aws-credentials@v3
98+
with:
99+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
100+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
101+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
102+
aws-region: ${{ env.AWS_REGION }}
103+
104+
- name: Setup Terraform
105+
uses: hashicorp/setup-terraform@v3
106+
107+
- name: Terraform Init
108+
run: terraform init
109+
110+
- name: Terraform Plan (Destroy)
111+
run: |
112+
terraform plan -destroy -no-color -input=false -lock=false -out=tfplan \
113+
-var="workspace_path=${{ env.WORKSPACE_PATH }}" \
114+
-var="nginx_jwt=${{ secrets.NGINX_JWT }}" \
115+
-var="nginx_pwd=none"
116+
env:
117+
WORKSPACE_PATH: "./nap"
118+
119+
- name: Check Changes
120+
id: check_changes
121+
run: |
122+
if grep -q "No changes." plan.txt; then
123+
echo "has_changes=false" >> $GITHUB_OUTPUT
124+
else
125+
echo "has_changes=true" >> $GITHUB_OUTPUT
126+
fi
127+
128+
- name: Terraform Destroy
129+
if: github.event_name == 'push' && github.ref == 'refs/heads/destroy-nic-napv5' && steps.check_changes.outputs.has_changes == 'true'
130+
run: |
131+
terraform destroy -auto-approve -input=false -lock=false \
132+
-var="workspace_path=${{ env.WORKSPACE_PATH }}" \
133+
-var="nginx_jwt=${{ secrets.NGINX_JWT }}" \
134+
-var="nginx_pwd=none"
135+
env:
136+
WORKSPACE_PATH: "./nap"
137+
138+
terraform_eks:
139+
name: "Destroy AWS EKS"
140+
runs-on: ubuntu-latest
141+
needs: terraform_nap
142+
defaults:
143+
run:
144+
working-directory: ./eks-cluster
145+
steps:
146+
- name: Checkout
147+
uses: actions/checkout@v4
148+
149+
- name: Configure AWS Credentials
150+
uses: aws-actions/configure-aws-credentials@v3
151+
with:
152+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
153+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
154+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
155+
aws-region: ${{ env.AWS_REGION }}
156+
157+
- name: Setup Terraform
158+
uses: hashicorp/setup-terraform@v3
159+
160+
- name: Terraform Init
161+
run: terraform init
162+
163+
- name: Terraform Plan (Destroy)
164+
if: github.event_name == 'pull_request' || github.event_name == 'push'
165+
run: |
166+
terraform plan -destroy -no-color -input=false -out=tfplan -lock=false
167+
terraform show -no-color tfplan > plan.txt
168+
169+
- name: Check Changes
170+
id: check_changes
171+
run: |
172+
if grep -q "No changes." plan.txt; then
173+
echo "has_changes=false" >> $GITHUB_OUTPUT
174+
else
175+
echo "has_changes=true" >> $GITHUB_OUTPUT
176+
fi
177+
178+
- name: Terraform Destroy
179+
if: github.event_name == 'push' && github.ref == 'refs/heads/destroy-nic-napv5' && steps.check_changes.outputs.has_changes == 'true'
180+
run: terraform destroy -auto-approve -input=false -lock=false
181+
182+
terraform_infra:
183+
name: "Destroy AWS Infra"
184+
runs-on: ubuntu-latest
185+
needs: terraform_eks
186+
defaults:
187+
run:
188+
working-directory: ./infra
189+
steps:
190+
- name: Checkout
191+
uses: actions/checkout@v4
192+
193+
- name: Configure AWS Credentials
194+
uses: aws-actions/configure-aws-credentials@v3
195+
with:
196+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
197+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
198+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
199+
aws-region: ${{ env.AWS_REGION }}
200+
201+
- name: Setup Terraform
202+
uses: hashicorp/setup-terraform@v3
203+
204+
- name: Terraform Init
205+
run: terraform init
206+
207+
- name: Terraform Plan (Destroy)
208+
if: github.event_name == 'pull_request' || github.event_name == 'push'
209+
run: |
210+
terraform plan -destroy -no-color -input=false -out=tfplan -lock=false
211+
terraform show -no-color tfplan > plan.txt
212+
213+
- name: Check Changes
214+
id: check_changes
215+
run: |
216+
if grep -q "No changes." plan.txt; then
217+
echo "has_changes=false" >> $GITHUB_OUTPUT
218+
else
219+
echo "has_changes=true" >> $GITHUB_OUTPUT
220+
fi
221+
222+
- name: Terraform Destroy
223+
if: github.event_name == 'push' && github.ref == 'refs/heads/destroy-nic-napv5' && steps.check_changes.outputs.has_changes == 'true'
224+
run: terraform destroy -auto-approve -input=false -lock=false
225+
226+
227+
terraform_S3:
228+
name: "Delete S3/DynamoDB"
229+
needs: terraform_infra
230+
runs-on: ubuntu-latest
231+
defaults:
232+
run:
233+
working-directory: ./s3
234+
steps:
235+
- name: Checkout code
236+
uses: actions/checkout@v4
237+
238+
- name: Install jq
239+
run: sudo apt-get install -y jq
240+
241+
- name: Configure AWS Credentials
242+
uses: aws-actions/configure-aws-credentials@v3
243+
with:
244+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
245+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
246+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
247+
aws-region: ${{ env.AWS_REGION }}
248+
249+
- name: Set Bucket Name
250+
id: set_bucket
251+
run: |
252+
echo "bucket_name=akash-terraform-state-bucket" >> $GITHUB_OUTPUT
253+
254+
- name: Nuclear S3 Bucket Deletion
255+
run: |
256+
set -e
257+
BUCKET_NAME="${{ steps.set_bucket.outputs.bucket_name }}"
258+
259+
# 1. Delete all object versions (with null checks)
260+
echo "🔥 Deleting ALL object versions..."
261+
versions=$(aws s3api list-object-versions --bucket $BUCKET_NAME --output json || echo '{"Versions":[],"DeleteMarkers":[]}')
262+
versions_to_delete=$(echo $versions | jq '{Objects: [.Versions[]? | {Key:.Key, VersionId:.VersionId}]}' || echo '{"Objects":[]}')
263+
if [ "$(echo $versions_to_delete | jq '.Objects | length')" -gt 0 ]; then
264+
aws s3api delete-objects --bucket $BUCKET_NAME --delete "$versions_to_delete" || true
265+
fi
266+
267+
# 2. Delete all delete markers (with null checks)
268+
echo "🗑️ Deleting ALL delete markers..."
269+
markers_to_delete=$(echo $versions | jq '{Objects: [.DeleteMarkers[]? | {Key:.Key, VersionId:.VersionId}]}' || echo '{"Objects":[]}')
270+
if [ "$(echo $markers_to_delete | jq '.Objects | length')" -gt 0 ]; then
271+
aws s3api delete-objects --bucket $BUCKET_NAME --delete "$markers_to_delete" || true
272+
fi
273+
274+
# 3. Force delete any remaining objects
275+
echo "💥 Force deleting any remaining objects..."
276+
aws s3 rm s3://$BUCKET_NAME --recursive --include "*" || true
277+
278+
# 4. Delete bucket
279+
echo "🚀 Deleting bucket..."
280+
aws s3api delete-bucket --bucket $BUCKET_NAME || true
281+
282+
# 5. Final verification
283+
if aws s3api head-bucket --bucket $BUCKET_NAME 2>/dev/null; then
284+
echo "::error::Bucket $BUCKET_NAME still exists after deletion attempts!"
285+
exit 1
286+
else
287+
echo "✅ Bucket $BUCKET_NAME successfully deleted"
288+
fi
289+
290+
- name: Delete DynamoDB Table
291+
run: |
292+
set -e
293+
TABLE_NAME="terraform-lock-table"
294+
echo "💥 Deleting DynamoDB table..."
295+
if aws dynamodb describe-table --table-name $TABLE_NAME 2>/dev/null; then
296+
aws dynamodb delete-table --table-name $TABLE_NAME || true
297+
echo "⌛ Waiting for table to be deleted..."
298+
aws dynamodb wait table-not-exists --table-name $TABLE_NAME || true
299+
fi
300+
if aws dynamodb describe-table --table-name $TABLE_NAME 2>/dev/null; then
301+
echo "::error::Table $TABLE_NAME still exists!"
302+
exit 1
303+
else
304+
echo "✅ Table $TABLE_NAME successfully deleted"
305+
fi
306+
307+
- name: Clean Up IAM Resources
308+
run: |
309+
set -e
310+
# Delete policy
311+
POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='TerraformStateAccess'].Arn" --output text || echo "")
312+
if [ -n "$POLICY_ARN" ]; then
313+
echo "🔗 Detaching policy from roles..."
314+
ATTACHED_ROLES=$(aws iam list-entities-for-policy --policy-arn $POLICY_ARN --query "PolicyRoles[].RoleName" --output text || echo "")
315+
for ROLE in $ATTACHED_ROLES; do
316+
aws iam detach-role-policy --role-name $ROLE --policy-arn $POLICY_ARN || true
317+
done
318+
319+
echo "🗑️ Deleting policy..."
320+
aws iam delete-policy --policy-arn $POLICY_ARN || true
321+
fi
322+
323+
# Delete role
324+
ROLE_NAME="TerraformCIExecutionRole"
325+
if aws iam get-role --role-name $ROLE_NAME 2>/dev/null; then
326+
echo "🗑️ Deleting role..."
327+
aws iam delete-role --role-name $ROLE_NAME || true
328+
fi
329+
330+
- name: Verify Deletion
331+
run: |
332+
echo "✅ Verification:"
333+
334+
# Verify S3 bucket
335+
BUCKET_NAME="${{ steps.set_bucket.outputs.bucket_name }}"
336+
if aws s3api head-bucket --bucket "$BUCKET_NAME" 2>/dev/null; then
337+
echo "::error::Bucket $BUCKET_NAME still exists!"
338+
exit 1
339+
else
340+
echo "Bucket $BUCKET_NAME deleted successfully"
341+
fi
342+
343+
# Verify DynamoDB table
344+
TABLE_NAME="terraform-lock-table"
345+
if aws dynamodb describe-table --table-name "$TABLE_NAME" 2>/dev/null; then
346+
echo "::error::Table $TABLE_NAME still exists!"
347+
exit 1
348+
else
349+
echo "Table $TABLE_NAME deleted successfully"
350+
fi
351+
352+
# Verify IAM resources
353+
if aws iam get-policy --policy-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):policy/TerraformStateAccess" 2>/dev/null; then
354+
echo "::error::IAM Policy still exists!"
355+
exit 1
356+
else
357+
echo "IAM Policy deleted successfully"
358+
fi
359+
360+
if aws iam get-role --role-name "TerraformCIExecutionRole" 2>/dev/null; then
361+
echo "::error::IAM Role still exists!"
362+
exit 1
363+
else
364+
echo "IAM Role deleted successfully"
365+
fi

0 commit comments

Comments
 (0)