@rulebricks/cli 2.1.2 → 2.1.4

package/dist/commands/deploy.js

@@ -5,7 +5,7 @@ import { platform } from "os";
 import { BorderBox, Spinner, StatusLine, ThemeProvider, useTheme, Logo, } from "../components/common/index.js";
 import { DNSWaitScreen } from "../components/DNSWaitScreen.js";
 import { loadDeploymentConfig, loadDeploymentState, saveDeploymentState, updateDeploymentStatus, saveTerraformVars, } from "../lib/config.js";
-import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
+import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, cleanupOrphanedResources, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
 import { checkGcpApplicationDefaultCredentials, checkAzureResourceProviders, checkAzureVmQuota, AZURE_TIER_CORES, } from "../lib/cloudCli.js";
 import { installOrUpgradeChart, upgradeChart, isHelmInstalled, } from "../lib/helm.js";
 import { isKubectlInstalled, checkClusterAccessible, } from "../lib/kubernetes.js";
@@ -32,7 +32,14 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     const handleCleanup = useCallback(async () => {
         setStep("cleanup-running");
         try {
-            await terraformDestroy(name);
+            const cloudContext = config?.infrastructure.provider && config?.infrastructure.region
+                ? {
+                    provider: config.infrastructure.provider,
+                    clusterName: config.infrastructure.clusterName || `${name}-cluster`,
+                    region: config.infrastructure.region,
+                }
+                : undefined;
+            await terraformDestroy(name, cloudContext);
             setStep("cleanup-complete");
             setTimeout(() => exit(), 3000);
         }
@@ -41,7 +48,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             setStep("cleanup-complete");
             setTimeout(() => exit(), 5000);
         }
-    }, [name, exit]);
+    }, [name, config, exit]);
     const skipCleanup = useCallback(() => {
         setStep("error");
     }, []);
@@ -167,6 +174,11 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                 await terraformInit(name);
                 setStep("infra-plan");
                 await terraformPlan(name);
+                // Clean up orphaned cloud resources from prior failed deployments
+                // (e.g. CloudWatch log groups that survived an incomplete destroy)
+                if (cfg.infrastructure.provider && cfg.infrastructure.region) {
+                    await cleanupOrphanedResources(cfg.infrastructure.provider, cfg.infrastructure.clusterName || `${name}-cluster`, cfg.infrastructure.region);
+                }
                 setStep("infra-apply");
                 await terraformApply(name);
                 setStatus((s) => ({ ...s, infrastructure: "success" }));

package/dist/commands/destroy.js

@@ -16,6 +16,7 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
     const [scope, setScope] = useState(null);
     const [error, setError] = useState(null);
     const [confirmText, setConfirmText] = useState("");
+    const [infraError, setInfraError] = useState(null);
     const [status, setStatus] = useState({
         helm: "pending",
         pvc: "pending",
@@ -163,10 +164,18 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
             if (cluster && deploymentScope.hasInfrastructure) {
                 setStatus((s) => ({ ...s, infrastructure: "running" }));
                 try {
-                    await terraformDestroy(name);
+                    const cloudContext = cfg?.infrastructure.provider && cfg?.infrastructure.region
+                        ? {
+                            provider: cfg.infrastructure.provider,
+                            clusterName: cfg.infrastructure.clusterName || `${name}-cluster`,
+                            region: cfg.infrastructure.region,
+                        }
+                        : undefined;
+                    await terraformDestroy(name, cloudContext);
                     setStatus((s) => ({ ...s, infrastructure: "success" }));
                 }
-                catch {
+                catch (infraErr) {
+                    setInfraError(infraErr instanceof Error ? infraErr.message : "Infrastructure destroy failed");
                     setStatus((s) => ({ ...s, infrastructure: "error" }));
                 }
             }
@@ -220,7 +229,9 @@ function DestroyCommandInner({ name, cluster, config, force, }) {
         const noClusterCleanup = status.helm === "skipped" &&
             status.pvc === "skipped" &&
             status.namespace === "skipped";
-        return (_jsx(BorderBox, { title: "Destruction Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { color: colors.success, bold: true, children: ["\u2713 Deployment \"", name, "\" has been destroyed"] }), cleanedItems.length > 0 && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Cleaned up:" }), cleanedItems.map((item) => (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 ", item] }, item)))] })), noClusterCleanup && status.cleanup === "success" && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Note: No cluster resources found, only local files were cleaned up." }) })), status.cleanup === "skipped" && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Local configuration files preserved in ~/.rulebricks/deployments/", name, "/"] }) }))] }) }));
+        const hasInfraFailure = status.infrastructure === "error";
+        const title = hasInfraFailure ? "Destruction Partially Complete" : "Destruction Complete";
+        return (_jsx(BorderBox, { title: title, children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [hasInfraFailure ? (_jsxs(Text, { color: colors.warning, bold: true, children: ["\u26A0 Deployment \"", name, "\" was partially destroyed"] })) : (_jsxs(Text, { color: colors.success, bold: true, children: ["\u2713 Deployment \"", name, "\" has been destroyed"] })), cleanedItems.length > 0 && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, children: "Cleaned up:" }), cleanedItems.map((item) => (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 ", item] }, item)))] })), hasInfraFailure && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.error, bold: true, children: "\u2717 Infrastructure destroy failed" }), _jsx(Text, { color: colors.error, children: infraError }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, children: ["Cloud resources may still exist. Run `rulebricks destroy ", name, " ", "--cluster` to retry."] }) })] })), noClusterCleanup && status.cleanup === "success" && !hasInfraFailure && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: colors.muted, dimColor: true, children: "Note: No cluster resources found, only local files were cleaned up." }) })), status.cleanup === "skipped" && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Local configuration files preserved in ~/.rulebricks/deployments/", name, "/"] }) }))] }) }));
     }
     // Destroying screen
     if (step === "destroying") {

package/dist/lib/terraform.d.ts

@@ -24,10 +24,25 @@ export declare function terraformPlan(deploymentName: string): Promise<void>;
  */
 export declare function terraformApply(deploymentName: string): Promise<void>;
 /**
- * Destroys Terraform infrastructure.
- * Runs init first to ensure .terraform folder exists (handles partial deployments).
+ * Lightweight pre-deploy cleanup for the CloudWatch log group that the EKS module
+ * no longer manages (create_cloudwatch_log_group = false). Safe to call before
+ * terraform apply since it targets a resource outside terraform's control.
  */
-export declare function terraformDestroy(deploymentName: string): Promise<void>;
+export declare function cleanupOrphanedResources(provider: CloudProvider, clusterName: string, region: string): Promise<void>;
+/**
+ * Destroys Terraform infrastructure, then sweeps remaining cloud resources.
+ *
+ * Flow:
+ *   1. terraform destroy (single attempt)
+ *   2. Cloud-native cleanup ALWAYS runs (terraform can report success while
+ *      resources still exist)
+ *   3. If terraform reported failure, try once more now that blockers are gone
+ */
+export declare function terraformDestroy(deploymentName: string, cloudContext?: {
+    provider: CloudProvider;
+    clusterName: string;
+    region: string;
+}): Promise<void>;
 /**
  * Gets Terraform outputs
  */

package/dist/lib/terraform.js

@@ -169,37 +169,274 @@ export async function terraformApply(deploymentName) {
     }
 }
 /**
- * Destroys Terraform infrastructure.
- * Runs init first to ensure .terraform folder exists (handles partial deployments).
+ * Lightweight pre-deploy cleanup for the CloudWatch log group that the EKS module
+ * no longer manages (create_cloudwatch_log_group = false). Safe to call before
+ * terraform apply since it targets a resource outside terraform's control.
  */
-export async function terraformDestroy(deploymentName) {
-    const workDir = getTerraformDir(deploymentName);
+export async function cleanupOrphanedResources(provider, clusterName, region) {
+    if (provider === 'aws') {
+        const logGroupName = `/aws/eks/${clusterName}/cluster`;
+        try {
+            await execa('aws', [
+                'logs', 'delete-log-group',
+                '--log-group-name', logGroupName,
+                '--region', region,
+            ]);
+        }
+        catch {
+            // Log group may not exist — that's fine
+        }
+    }
+}
+// ============================================================================
+// Post-destroy cloud-native cleanup (AWS)
+//
+// Handles every uniquely-named resource that terraform tends to leave behind
+// after a failed destroy or partial apply. Runs unconditionally after every
+// terraform destroy since terraform can report success while resources linger.
+// Every step is best-effort: failures are silently swallowed.
+// ============================================================================
+async function deleteAwsEksNodeGroups(clusterName, region) {
+    let nodeGroups;
     try {
-        // Run init first to ensure terraform is ready (handles partial deployments
-        // where .terraform folder might be missing or corrupted)
+        const { stdout } = await execa('aws', [
+            'eks', 'list-nodegroups',
+            '--cluster-name', clusterName,
+            '--region', region,
+            '--output', 'json',
+        ]);
+        const parsed = JSON.parse(stdout);
+        nodeGroups = parsed.nodegroups ?? [];
+    }
+    catch {
+        return; // Cluster may not exist
+    }
+    for (const ng of nodeGroups) {
         try {
-            await execa('terraform', ['init', '-upgrade'], {
-                cwd: workDir
-            });
+            await execa('aws', [
+                'eks', 'delete-nodegroup',
+                '--cluster-name', clusterName,
+                '--nodegroup-name', ng,
+                '--region', region,
+            ]);
         }
-        catch (initError) {
-            // If init fails, still try destroy - it might work if state exists
-            const execaInitError = initError;
-            if (execaInitError.stdout || execaInitError.stderr) {
-                await saveLogFile(workDir, 'destroy-init', execaInitError.stdout || '', execaInitError.stderr || '');
+        catch { /* already gone */ }
+    }
+    // Wait for all node groups to finish deleting
+    for (const ng of nodeGroups) {
+        try {
+            await execa('aws', [
+                'eks', 'wait', 'nodegroup-deleted',
+                '--cluster-name', clusterName,
+                '--nodegroup-name', ng,
+                '--region', region,
+            ]);
+        }
+        catch { /* timeout or already gone */ }
+    }
+}
+async function deleteAwsEksCluster(clusterName, region) {
+    try {
+        await execa('aws', [
+            'eks', 'delete-cluster',
+            '--name', clusterName,
+            '--region', region,
+        ]);
+    }
+    catch {
+        return; // Cluster may not exist
+    }
+    try {
+        await execa('aws', [
+            'eks', 'wait', 'cluster-deleted',
+            '--name', clusterName,
+            '--region', region,
+        ]);
+    }
+    catch { /* timeout or already gone */ }
+}
+async function deleteAwsCloudWatchLogGroup(clusterName, region) {
+    try {
+        await execa('aws', [
+            'logs', 'delete-log-group',
+            '--log-group-name', `/aws/eks/${clusterName}/cluster`,
+            '--region', region,
+        ]);
+    }
+    catch { /* may not exist */ }
+}
+async function deleteAwsOidcProvider(clusterName) {
+    let providerArns;
+    try {
+        const { stdout } = await execa('aws', [
+            'iam', 'list-open-id-connect-providers',
+            '--output', 'json',
+        ]);
+        const parsed = JSON.parse(stdout);
+        providerArns = (parsed.OpenIDConnectProviderList ?? []).map((p) => p.Arn);
+    }
+    catch {
+        return;
+    }
+    for (const arn of providerArns) {
+        try {
+            const { stdout } = await execa('aws', [
+                'iam', 'get-open-id-connect-provider',
+                '--open-id-connect-provider-arn', arn,
+                '--output', 'json',
+            ]);
+            const parsed = JSON.parse(stdout);
+            if (parsed.Url && parsed.Url.includes(clusterName)) {
+                await execa('aws', [
+                    'iam', 'delete-open-id-connect-provider',
+                    '--open-id-connect-provider-arn', arn,
+                ]);
             }
-            // Don't throw - continue to try destroy anyway
         }
+        catch { /* skip */ }
+    }
+}
+async function deleteAwsIamRole(roleName) {
+    // Detach all managed policies
+    try {
+        const { stdout } = await execa('aws', [
+            'iam', 'list-attached-role-policies',
+            '--role-name', roleName,
+            '--output', 'json',
+        ]);
+        const parsed = JSON.parse(stdout);
+        for (const policy of parsed.AttachedPolicies ?? []) {
+            try {
+                await execa('aws', [
+                    'iam', 'detach-role-policy',
+                    '--role-name', roleName,
+                    '--policy-arn', policy.PolicyArn,
+                ]);
+            }
+            catch { /* skip */ }
+        }
+    }
+    catch { /* role may not exist */ }
+    // Delete inline policies
+    try {
+        const { stdout } = await execa('aws', [
+            'iam', 'list-role-policies',
+            '--role-name', roleName,
+            '--output', 'json',
+        ]);
+        const parsed = JSON.parse(stdout);
+        for (const policyName of parsed.PolicyNames ?? []) {
+            try {
+                await execa('aws', [
+                    'iam', 'delete-role-policy',
+                    '--role-name', roleName,
+                    '--policy-name', policyName,
+                ]);
+            }
+            catch { /* skip */ }
+        }
+    }
+    catch { /* role may not exist */ }
+    // Delete the role itself
+    try {
+        await execa('aws', ['iam', 'delete-role', '--role-name', roleName]);
+    }
+    catch { /* may not exist */ }
+}
+async function deleteAwsIamPolicy(policyName) {
+    try {
+        const { stdout } = await execa('aws', [
+            'iam', 'list-policies',
+            '--query', `Policies[?PolicyName=='${policyName}']`,
+            '--output', 'json',
+        ]);
+        const policies = JSON.parse(stdout);
+        for (const policy of policies) {
+            try {
+                await execa('aws', ['iam', 'delete-policy', '--policy-arn', policy.Arn]);
+            }
+            catch { /* may have attachments or not exist */ }
+        }
+    }
+    catch { /* skip */ }
+}
+/**
+ * Comprehensive post-destroy cleanup of AWS resources that terraform leaves
+ * behind. Handles the full dependency chain in the correct order.
+ * Entirely best-effort: every step silently swallows errors.
+ */
+async function cleanupAwsResources(clusterName, region) {
+    // 1. EKS node groups (must be deleted before cluster)
+    await deleteAwsEksNodeGroups(clusterName, region);
+    // 2. EKS cluster
+    await deleteAwsEksCluster(clusterName, region);
+    // 3. CloudWatch log group (now safe -- cluster is gone, won't be recreated)
+    await deleteAwsCloudWatchLogGroup(clusterName, region);
+    // 4. OIDC provider (created by EKS module for IRSA)
+    await deleteAwsOidcProvider(clusterName);
+    // 5. IAM roles created by terraform modules
+    await deleteAwsIamRole(`${clusterName}-ebs-csi`);
+    await deleteAwsIamRole(`${clusterName}-external-dns`);
+    await deleteAwsIamRole(`${clusterName}-vector`);
+    // 6. Customer-managed IAM policies
+    await deleteAwsIamPolicy(`${clusterName}-vector-s3`);
+}
+/**
+ * Destroys Terraform infrastructure, then sweeps remaining cloud resources.
+ *
+ * Flow:
+ *   1. terraform destroy (single attempt)
+ *   2. Cloud-native cleanup ALWAYS runs (terraform can report success while
+ *      resources still exist)
+ *   3. If terraform reported failure, try once more now that blockers are gone
+ */
+export async function terraformDestroy(deploymentName, cloudContext) {
+    const workDir = getTerraformDir(deploymentName);
+    // Run init first to ensure terraform is ready
+    try {
+        await execa('terraform', ['init', '-upgrade'], {
+            cwd: workDir
+        });
+    }
+    catch (initError) {
+        const execaInitError = initError;
+        if (execaInitError.stdout || execaInitError.stderr) {
+            await saveLogFile(workDir, 'destroy-init', execaInitError.stdout || '', execaInitError.stderr || '');
+        }
+    }
+    // First terraform destroy attempt
+    let firstAttemptFailed = false;
+    try {
         await execa('terraform', ['destroy', '-auto-approve'], {
             cwd: workDir
         });
     }
     catch (error) {
+        firstAttemptFailed = true;
         const execaError = error;
         if (execaError.stdout || execaError.stderr) {
             await saveLogFile(workDir, 'destroy', execaError.stdout || '', execaError.stderr || '');
         }
-        throw new Error(`Terraform destroy failed:\n${getErrorMessage(error, 'Unknown error')}\n\nLogs saved to: ${workDir}`);
+    }
+    // ALWAYS run cloud-native cleanup -- terraform can't be trusted to report
+    // accurately whether all resources were actually destroyed
+    if (cloudContext?.provider === 'aws') {
+        await cleanupAwsResources(cloudContext.clusterName, cloudContext.region);
+    }
+    // If terraform failed, try once more now that cloud-native cleanup removed blockers
+    if (firstAttemptFailed) {
+        try {
+            await execa('terraform', ['destroy', '-auto-approve'], {
+                cwd: workDir
+            });
+        }
+        catch (error) {
+            const execaError = error;
+            if (execaError.stdout || execaError.stderr) {
+                await saveLogFile(workDir, 'destroy-final', execaError.stdout || '', execaError.stderr || '');
+            }
+            throw new Error(`Terraform destroy failed:\n${getErrorMessage(error, 'Unknown error')}\n\nLogs saved to: ${workDir}`);
+        }
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {

package/terraform/aws/main.tf

@@ -142,6 +142,12 @@ module "eks" {
   cluster_endpoint_public_access  = true
   cluster_endpoint_private_access = true
 
+  # Disable Terraform-managed CloudWatch log group to prevent
+  # ResourceAlreadyExistsException on re-deploy after partial failures.
+  # AWS creates the log group automatically if control-plane logging is enabled.
+  create_cloudwatch_log_group = false
+  cluster_enabled_log_types   = []
+
   vpc_id     = module.vpc.vpc_id
   subnet_ids = module.vpc.private_subnets