@rulebricks/cli 2.1.1 → 2.1.3

package/dist/commands/deploy.js

@@ -5,7 +5,7 @@ import { platform } from "os";
 import { BorderBox, Spinner, StatusLine, ThemeProvider, useTheme, Logo, } from "../components/common/index.js";
 import { DNSWaitScreen } from "../components/DNSWaitScreen.js";
 import { loadDeploymentConfig, loadDeploymentState, saveDeploymentState, updateDeploymentStatus, saveTerraformVars, } from "../lib/config.js";
-import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
+import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, cleanupOrphanedResources, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
 import { checkGcpApplicationDefaultCredentials, checkAzureResourceProviders, checkAzureVmQuota, AZURE_TIER_CORES, } from "../lib/cloudCli.js";
 import { installOrUpgradeChart, upgradeChart, isHelmInstalled, } from "../lib/helm.js";
 import { isKubectlInstalled, checkClusterAccessible, } from "../lib/kubernetes.js";
@@ -32,7 +32,14 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     const handleCleanup = useCallback(async () => {
         setStep("cleanup-running");
         try {
-            await terraformDestroy(name);
+            const cloudContext = config?.infrastructure.provider && config?.infrastructure.region
+                ? {
+                    provider: config.infrastructure.provider,
+                    clusterName: config.infrastructure.clusterName || `${name}-cluster`,
+                    region: config.infrastructure.region,
+                }
+                : undefined;
+            await terraformDestroy(name, cloudContext);
             setStep("cleanup-complete");
             setTimeout(() => exit(), 3000);
         }
@@ -41,7 +48,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             setStep("cleanup-complete");
             setTimeout(() => exit(), 5000);
         }
-    }, [name, exit]);
+    }, [name, config, exit]);
     const skipCleanup = useCallback(() => {
         setStep("error");
     }, []);
@@ -167,6 +174,11 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 await terraformInit(name);
                 setStep("infra-plan");
                 await terraformPlan(name);
+                // Clean up orphaned cloud resources from prior failed deployments
+                // (e.g. CloudWatch log groups that survived an incomplete destroy)
+                if (cfg.infrastructure.provider && cfg.infrastructure.region) {
+                    await cleanupOrphanedResources(cfg.infrastructure.provider, cfg.infrastructure.clusterName || `${name}-cluster`, cfg.infrastructure.region);
+                }
                 setStep("infra-apply");
                 await terraformApply(name);
                 setStatus((s) => ({ ...s, infrastructure: "success" }));

package/dist/commands/destroy.js

@@ -16,6 +16,7 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
     const [scope, setScope] = useState(null);
     const [error, setError] = useState(null);
     const [confirmText, setConfirmText] = useState("");
+    const [infraError, setInfraError] = useState(null);
     const [status, setStatus] = useState({
         helm: "pending",
         pvc: "pending",
@@ -163,10 +164,18 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
             if (cluster && deploymentScope.hasInfrastructure) {
                 setStatus((s) => ({ ...s, infrastructure: "running" }));
                 try {
-                    await terraformDestroy(name);
+                    const cloudContext = cfg?.infrastructure.provider && cfg?.infrastructure.region
+                        ? {
+                            provider: cfg.infrastructure.provider,
+                            clusterName: cfg.infrastructure.clusterName || `${name}-cluster`,
+                            region: cfg.infrastructure.region,
+                        }
+                        : undefined;
+                    await terraformDestroy(name, cloudContext);
                     setStatus((s) => ({ ...s, infrastructure: "success" }));
                 }
-                catch {
+                catch (infraErr) {
+                    setInfraError(infraErr instanceof Error ? infraErr.message : "Infrastructure destroy failed");
                     setStatus((s) => ({ ...s, infrastructure: "error" }));
                 }
             }
@@ -220,7 +229,9 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
         const noClusterCleanup = status.helm === "skipped" &&
             status.pvc === "skipped" &&
             status.namespace === "skipped";
-        return (_jsx(BorderBox, { title: "Destruction Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { color: colors.success, bold: true, children: ["\u2713 Deployment \"", name, "\" has been destroyed"] }), cleanedItems.length > 0 && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Cleaned up:" }), cleanedItems.map((item) => (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 ", item] }, item)))] })), noClusterCleanup && status.cleanup === "success" && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Note: No cluster resources found, only local files were cleaned up." }) })), status.cleanup === "skipped" && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Local configuration files preserved in ~/.rulebricks/deployments/", name, "/"] }) }))] }) }));
+        const hasInfraFailure = status.infrastructure === "error";
+        const title = hasInfraFailure ? "Destruction Partially Complete" : "Destruction Complete";
+        return (_jsx(BorderBox, { title: title, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [hasInfraFailure ? (_jsxs(Text, { color: colors.warning, bold: true, children: ["\u26A0 Deployment \"", name, "\" was partially destroyed"] })) : (_jsxs(Text, { color: colors.success, bold: true, children: ["\u2713 Deployment \"", name, "\" has been destroyed"] })), cleanedItems.length > 0 && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Cleaned up:" }), cleanedItems.map((item) => (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 ", item] }, item)))] })), hasInfraFailure && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Infrastructure destroy failed" }), _jsx(Text, { color: colors.error, children: infraError }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, children: ["Cloud resources may still exist. Run `rulebricks destroy ", name, " ", "--cluster` to retry."] }) })] })), noClusterCleanup && status.cleanup === "success" && !hasInfraFailure && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Note: No cluster resources found, only local files were cleaned up." }) })), status.cleanup === "skipped" && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Local configuration files preserved in ~/.rulebricks/deployments/", name, "/"] }) }))] }) }));
     }
     // Destroying screen
     if (step === "destroying") {

package/dist/lib/terraform.d.ts

@@ -24,10 +24,20 @@ export declare function terraformPlan(deploymentName: string): Promise<void>;
  */
 export declare function terraformApply(deploymentName: string): Promise<void>;
 /**
- * Destroys Terraform infrastructure.
+ * Cleans up orphaned cloud resources that may linger after a failed deploy or
+ * incomplete destroy. Best-effort: failures are logged but never thrown.
+ */
+export declare function cleanupOrphanedResources(provider: CloudProvider, clusterName: string, region: string): Promise<void>;
+/**
+ * Destroys Terraform infrastructure with retry logic.
  * Runs init first to ensure .terraform folder exists (handles partial deployments).
+ * After all attempts, sweeps orphaned cloud resources that Terraform doesn't manage.
  */
-export declare function terraformDestroy(deploymentName: string): Promise<void>;
+export declare function terraformDestroy(deploymentName: string, cloudContext?: {
+    provider: CloudProvider;
+    clusterName: string;
+    region: string;
+}): Promise<void>;
 /**
  * Gets Terraform outputs
  */

package/dist/lib/terraform.js

@@ -169,37 +169,77 @@ export async function terraformApply(deploymentName) {
     }
 }
 /**
- * Destroys Terraform infrastructure.
+ * Cleans up orphaned cloud resources that may linger after a failed deploy or
+ * incomplete destroy. Best-effort: failures are logged but never thrown.
+ */
+export async function cleanupOrphanedResources(provider, clusterName, region) {
+    if (provider === 'aws') {
+        // The EKS module (or AWS itself) creates /aws/eks/<cluster>/cluster.
+        // Since we disabled Terraform management of this log group, we must
+        // delete it ourselves to ensure a clean slate.
+        const logGroupName = `/aws/eks/${clusterName}/cluster`;
+        try {
+            await execa('aws', [
+                'logs', 'delete-log-group',
+                '--log-group-name', logGroupName,
+                '--region', region,
+            ]);
+        }
+        catch {
+            // Log group may not exist — that's fine
+        }
+    }
+    // GCP and Azure don't have an equivalent orphan problem today
+}
+const DESTROY_MAX_ATTEMPTS = 3;
+const DESTROY_RETRY_DELAY_MS = 5_000;
+/**
+ * Destroys Terraform infrastructure with retry logic.
  * Runs init first to ensure .terraform folder exists (handles partial deployments).
+ * After all attempts, sweeps orphaned cloud resources that Terraform doesn't manage.
  */
-export async function terraformDestroy(deploymentName) {
+export async function terraformDestroy(deploymentName, cloudContext) {
     const workDir = getTerraformDir(deploymentName);
+    // Run init first to ensure terraform is ready
     try {
-        // Run init first to ensure terraform is ready (handles partial deployments
-        // where .terraform folder might be missing or corrupted)
+        await execa('terraform', ['init', '-upgrade'], {
+            cwd: workDir
+        });
+    }
+    catch (initError) {
+        const execaInitError = initError;
+        if (execaInitError.stdout || execaInitError.stderr) {
+            await saveLogFile(workDir, 'destroy-init', execaInitError.stdout || '', execaInitError.stderr || '');
+        }
+        // Don't throw — continue to try destroy anyway
+    }
+    let lastError;
+    for (let attempt = 1; attempt <= DESTROY_MAX_ATTEMPTS; attempt++) {
         try {
-            await execa('terraform', ['init', '-upgrade'], {
+            await execa('terraform', ['destroy', '-auto-approve'], {
                 cwd: workDir
             });
+            lastError = undefined;
+            break;
         }
-        catch (initError) {
-            // If init fails, still try destroy - it might work if state exists
-            const execaInitError = initError;
-            if (execaInitError.stdout || execaInitError.stderr) {
-                await saveLogFile(workDir, 'destroy-init', execaInitError.stdout || '', execaInitError.stderr || '');
+        catch (error) {
+            const execaError = error;
+            if (execaError.stdout || execaError.stderr) {
+                await saveLogFile(workDir, `destroy-attempt-${attempt}`, execaError.stdout || '', execaError.stderr || '');
+            }
+            lastError = new Error(`Terraform destroy failed (attempt ${attempt}/${DESTROY_MAX_ATTEMPTS}):\n` +
+                `${getErrorMessage(error, 'Unknown error')}\n\nLogs saved to: ${workDir}`);
+            if (attempt < DESTROY_MAX_ATTEMPTS) {
+                await new Promise((r) => setTimeout(r, DESTROY_RETRY_DELAY_MS));
             }
-            // Don't throw - continue to try destroy anyway
         }
-        await execa('terraform', ['destroy', '-auto-approve'], {
-            cwd: workDir
-        });
     }
-    catch (error) {
-        const execaError = error;
-        if (execaError.stdout || execaError.stderr) {
-            await saveLogFile(workDir, 'destroy', execaError.stdout || '', execaError.stderr || '');
-        }
-        throw new Error(`Terraform destroy failed:\n${getErrorMessage(error, 'Unknown error')}\n\nLogs saved to: ${workDir}`);
+    // Best-effort cleanup of orphaned cloud resources regardless of destroy outcome
+    if (cloudContext) {
+        await cleanupOrphanedResources(cloudContext.provider, cloudContext.clusterName, cloudContext.region);
+    }
+    if (lastError) {
+        throw lastError;
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {

package/terraform/aws/main.tf

@@ -142,6 +142,12 @@ module "eks" {
   cluster_endpoint_public_access  = true
   cluster_endpoint_private_access = true
 
+  # Disable Terraform-managed CloudWatch log group to prevent
+  # ResourceAlreadyExistsException on re-deploy after partial failures.
+  # AWS creates the log group automatically if control-plane logging is enabled.
+  create_cloudwatch_log_group = false
+  cluster_enabled_log_types   = []
+
   vpc_id     = module.vpc.vpc_id
   subnet_ids = module.vpc.private_subnets
 
@@ -150,7 +156,7 @@ module "eks" {
     rulebricks = {
       name           = "rulebricks-nodes"
       instance_types = [local.config.instance_type]
-      ami_type       = "AL2023_ARM_64"  # ARM AMI for Graviton instances
+      ami_type       = "AL2023_ARM_64_STANDARD"  # ARM AMI for Graviton instances
 
       min_size     = local.config.min_nodes
       max_size     = local.config.max_nodes