Merge pull request #39632 from pneedle-rh/osdocs-2847-update-rosa-sts-deletion-procedure

OSDOCS-2847 - Updating the ROSA STS cluster delete section

Author: pneedle-rh

modules/rosa-deleting-aws-resources-cli.adoc

@@ -10,10 +10,19 @@ endif::[]
 [id="rosa-deleting-cluster_{context}"]
 = Deleting a cluster
 
-You can delete an {product-title} cluster using the `rosa` CLI.
+You can delete an {product-title} cluster using the `rosa` CLI. 
+
+ifdef::sts[]
+You can also use the `rosa` CLI to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. The cluster deletion must complete before you remove the IAM resources, because the resources are used in the cluster deletion and clean-up processes.
 
 If add-ons are installed, the deletion takes longer because add-ons are uninstalled before the cluster is deleted. The amount of time depends on the number and size of the add-ons.
 
+[IMPORTANT]
+====
+Account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
+====
+endif::sts[]
+
 .Procedure
 
 . Enter the following command to delete a cluster and watch the logs, replacing `<cluster_name>` with the name or ID of your cluster:
@@ -22,6 +31,13 @@ If add-ons are installed, the deletion takes longer because add-ons are uninstal
 ----
 $ rosa delete cluster --cluster=<cluster_name> --watch
 ----
+ifdef::sts[]
++
+[IMPORTANT]
+====
+You must wait for the cluster deletion to complete before you remove the IAM roles, policies, and OIDC provider. The account-wide roles are required to delete the resources created by the installer. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate.
+====
+endif::sts[]
 
 ifndef::sts[]
 . To clean up your CloudFormation stack, enter the following command:
@@ -32,6 +48,44 @@ $ rosa init --delete-stack
 ----
 endif::sts[]
 
+ifdef::sts[]
+.  Delete the OIDC provider that the cluster Operators use to authenticate:
++
+[source,terminal]
+----
+$ rosa delete oidc-provider -c <cluster_id> --mode auto <1>
+----
+<1> Replace `<cluster_id>` with the ID of the cluster.
++
+[NOTE]
+====
+You can use the `-y` option to automatically answer yes to the prompts.
+====
+
+. Delete the cluster-specific Operator IAM roles:
++
+[source,terminal]
+----
+$ rosa delete operator-roles -c <cluster_id> --mode auto <1>
+----
+<1> Replace `<cluster_id>` with the ID of the cluster.
+
+. Delete the account-wide roles:
++
+[source,terminal]
+----
+$ rosa delete account-roles --prefix <prefix> --mode auto <1>
+----
+<1> You must include the `--<prefix>` argument. Replace `<prefix>` with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, `ManagedOpenShift`.
++
+[IMPORTANT]
+====
+Account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
+====
+
+. Use the AWS IAM Console to delete the account-wide inline and Operator policies. For detailed steps, see the _Deleting the AWS resources by using the AWS IAM Console_ section.
+endif::sts[]
+
 ifeval::["{context}" == "rosa-sts-deleting-cluster"]
 :!sts:
 endif::[]

modules/rosa-deleting-cluster.adoc

@@ -8,5 +8,4 @@ toc::[]
 Delete a {product-title} (ROSA) cluster using the `rosa` command-line.
 
 include::modules/rosa-deleting-cluster.adoc[leveloffset=+1]
-include::modules/rosa-deleting-aws-resources-cli.adoc[leveloffset=+1]
 include::modules/rosa-deleting-aws-resources-aws-console.adoc[leveloffset=+1]