redhat-performance / cloud-governance / 30443404284
73%

DEFAULT BRANCH: main
Ran
Jobs 0
Files 0
Run time –
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
30443404284

push

travis-pro

web-flow 
Fix P1 zombie cluster policy: safety guards, call-site fixes (#1015)

* Fix P1 zombie cluster policy: F7/F16 safety guards, B1/B2/B2a call-site fixes

F7: Add ENI attachment check before revoking SG ingress rules — prevents
permanently tearing ingress rules when delete_security_group would later
fail with DependencyViolation (the root cause of the original P1 incident).

F16: Add pre-deletion cluster instance re-check in delete_zombie_resource.
If the cluster_tag still has live (non-terminated) instances at deletion
time, abort and log. Includes per-cluster_tag result cache (eliminates
30-50 redundant describe_instances calls per VPC cascade) and try/except
fail-closed guard mirroring the F7 pattern.

B1: Pass cluster_tag at ebs_snapshots and dhcp_options call sites so F16
fires for those resource types.

B2: Pass cluster_tag at elastic_ip disassociate call sites so F16 fires
on that path. Also add missing `and self.delete` dry-run guard on the
force_delete disassociate branch (pre-existing gap, all other force_delete
blocks already have this guard).

B2a: Fix TagSet→Tags field name in __delete_elastic_ip; describe_addresses
returns Tags, not TagSet. The old code made the ENI deletion branch
permanently unreachable. Drop dead TagSet fallback after fix.

Tests: 7 new negative tests covering F7 (ENI guard), F16 (pre-deletion
re-check), and B2/B2a (EIP disassociate path), exercised at
DeleteEC2Resources level to simulate the VPC cascade path that bypasses
the scan-time _filter_zombies_by_vpc safety net.

78 unit tests pass, 5 skipped (unchanged).

Fixes: CLGOVNR-96 (subtask of CLGOVNR-74)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* zombie_cluster PR3: address reviewer comments from PR #1015

- F7: tighten ENI attached-instance check: InstanceOwnerId → InstanceId,
  which is only present for actual EC2 instance attachments (not service-
  managed ENIs like NAT/ELB/Lambda where InstanceOwnerId is still set).

- F16 cache: document intenti... (continued)
Source Files on build 30443404284
Detailed source file information is not available for this build.