Delete irsa roles (#232)

* Delete irsa roles

* Delete the same rolles we create for irsa

* Update CHANGELOG

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Fix not deleting all IRSA rolles.
+
 ## [0.13.1] - 2023-11-10
 
 ### Fixed

controllers/awsmachinetemplate_controller.go

@@ -153,7 +153,7 @@ func (r *AWSMachineTemplateReconciler) reconcileDelete(ctx context.Context, iamS
 		}
 		if role == iam.ControlPlaneRole {
 			if r.EnableRoute53Role {
-				err = iamService.DeleteRoute53Role()
+				err = iamService.DeleteRolesForIRSA()
 				if err != nil {
 					return ctrl.Result{}, err
 				}

pkg/iam/iam.go

@@ -158,7 +158,7 @@ func (s *IAMService) ReconcileKiamRole() error {
 func (s *IAMService) ReconcileRolesForIRSA(awsAccountID string, cloudFrontDomain string) error {
 	s.log.Info("reconciling IAM roles for IRSA")
 
-	for _, roleTypeToReconcile := range []string{Route53Role, CertManagerRole, ALBConrollerRole, EBSCSIDriverRole, ClusterAutoscalerRole} {
+	for _, roleTypeToReconcile := range getIRSARoles() {
 		var params Route53RoleParams
 		params, err := s.generateRoute53RoleParams(roleTypeToReconcile, awsAccountID, cloudFrontDomain)
 		if err != nil {
@@ -179,7 +179,6 @@ func (s *IAMService) ReconcileRolesForIRSA(awsAccountID string, cloudFrontDomain
 func (s *IAMService) generateRoute53RoleParams(roleTypeToReconcile string, awsAccountID string, cloudFrontDomain string) (Route53RoleParams, error) {
 	namespace := "kube-system"
 	serviceAccount, err := getServiceAccount(roleTypeToReconcile)
-
 	if err != nil {
 		s.log.Error(err, "failed to get service account for role")
 		return Route53RoleParams{}, err
@@ -439,26 +438,15 @@ func (s *IAMService) DeleteRoute53Role() error {
 
 func (s *IAMService) DeleteRolesForIRSA() error {
 	s.log.Info("deleting IAM roles for IRSA")
+	defer s.log.Info("finished deleting IAM roles for IRSA")
 
-	// delete cert-manager role
-	err := s.deleteRole(roleName(CertManagerRole, s.clusterName))
-	if err != nil {
-		return err
-	}
-
-	// delete route53 role
-	err = s.deleteRole(roleName(Route53Role, s.clusterName))
-	if err != nil {
-		return err
-	}
-
-	// delete AWS Load Balancer Controller role
-	err = s.deleteRole(roleName(ALBConrollerRole, s.clusterName))
-	if err != nil {
-		return err
+	for _, roleTypeToReconcile := range getIRSARoles() {
+		err := s.deleteRole(roleName(roleTypeToReconcile, s.clusterName))
+		if err != nil {
+			return err
+		}
 	}
 
-	s.log.Info("finished deleting IAM roles for IRSA")
 	return nil
 }
 
@@ -677,3 +665,13 @@ func getServiceAccount(role string) (string, error) {
 
 	return "", fmt.Errorf("cannot get service account for specified role - %s", role)
 }
+
+func getIRSARoles() []string {
+	return []string{
+		Route53Role,
+		CertManagerRole,
+		ALBConrollerRole,
+		EBSCSIDriverRole,
+		ClusterAutoscalerRole,
+	}
+}