// Module included in the following assemblies:
//
// * rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-deleting-cluster.adoc
// * rosa_install_access_delete_clusters/rosa-sts-deleting-cluster.adoc

ifeval::["{context}" == "rosa-sts-deleting-cluster"]
:sts:
endif::[]

:_mod-docs-content-type: PROCEDURE
[id="rosa-deleting-cluster_{context}"]
ifndef::sts[]
= Deleting a ROSA cluster

endif::sts[]
ifdef::sts[]
= Deleting a ROSA cluster and the cluster-specific IAM resources

endif::sts[]

ifndef::sts[]
[role="_abstract"]
You can delete a {product-title} (ROSA) cluster using the ROSA CLI (`rosa`).
endif::sts[]

ifdef::sts[]
[role="_abstract"]
You can delete a {product-title} (ROSA) with AWS Security Token Service (STS) cluster by using the ROSA CLI (`rosa`) or {cluster-manager-first}.

After deleting the cluster, you can clean up the cluster-specific Identity and Access Management (IAM) resources in your AWS account by using the ROSA CLI (`rosa`). The cluster-specific resources include the Operator roles and the OpenID Connect (OIDC) provider.

[NOTE]
====
The cluster deletion must complete before you remove the IAM resources, because the resources are used in the cluster deletion and clean-up processes.
====

If add-ons are installed, the cluster deletion takes longer because add-ons are uninstalled before the cluster is deleted. The amount of time depends on the number and size of the add-ons.
endif::sts[]

[IMPORTANT]
====
If the cluster that created the VPC during the installation is deleted, the associated installation program-created VPC will also be deleted, resulting in the failure of all the clusters that are using the same VPC. Additionally, any resources created with the same `tagSet` key-value pair of the resources created by the installation program and labeled with a value of `owned` will also be deleted.
====
.Prerequisites

* You have installed a ROSA cluster.
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.

.Procedure

ifdef::sts[]
. Obtain the cluster ID, the Amazon Resource Names (ARNs) for the cluster-specific Operator roles and the endpoint URL for the OIDC provider:
+
[source,terminal]
----
$ rosa describe cluster --cluster=<cluster_name>
----
+
.Example output
[source,terminal]
----
Name:                       mycluster
ID:                         1s3v4x39lhs8sm49m90mi0822o34544a
...
Operator IAM Roles:
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-machine-api-aws-cloud-credentials
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cloud-credential-operator-cloud-crede
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-image-registry-installer-cloud-creden
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-ingress-operator-cloud-credentials
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cluster-csi-drivers-ebs-cloud-credent
 - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cloud-network-config-controller-cloud
State:                      ready
Private:                    No
Created:                    May 13 2022 11:26:15 UTC
Details Page:               https://console.redhat.com/openshift/details/s/296kyEFwzoy1CREQicFRdZybrc0
OIDC Endpoint URL:          https://oidc.op1.openshiftapps.com/<oidc_config_id>
----
+
--
* The `ID` field lists the cluster ID.
* The `Operator IAM Roles` field specifies the ARNs for the cluster-specific Operator roles. For example, in the sample output the ARN for the role required by the Machine Config Operator is `arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-machine-api-aws-cloud-credentials`.
* The `OIDC Endpoint URL` field displays the endpoint URL for the cluster-specific OIDC provider.
--
+
[IMPORTANT]
====
You require the cluster ID to delete the cluster-specific STS resources using the ROSA CLI (`rosa`) after the cluster is deleted.
====
endif::sts[]

ifdef::sts[]
. Delete the cluster:
** To delete the cluster by using {cluster-manager-first}:
.. Navigate to {cluster-manager-url}.
.. Click the Options menu {kebab} next to your cluster and select *Delete cluster*.
.. Type the name of your cluster at the prompt and click *Delete*.
** To delete the cluster using the ROSA CLI (`rosa`):
.. Enter the following command to delete the cluster and watch the logs, replacing `<cluster_name>` with the name or ID of your cluster:
endif::sts[]
ifndef::sts[]
. Enter the following command to delete a cluster and watch the logs, replacing `<cluster_name>` with the name or ID of your cluster:
endif::sts[]
+
[source,terminal]
----
$ rosa delete cluster --cluster=<cluster_name> --watch
----
ifdef::sts[]
+
[IMPORTANT]
====
You must wait for the cluster deletion to complete before you remove the Operator roles and the OIDC provider. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate.
====
endif::sts[]

ifndef::sts[]
. To clean up your CloudFormation stack, enter the following command:
+
[source,terminal]
----
$ rosa init --delete
----
endif::sts[]

ifdef::sts[]
.  Delete the OIDC provider that the cluster Operators use to authenticate:
+
[source,terminal]
----
$ rosa delete oidc-provider -c <cluster_id> --mode auto
----
+
[NOTE]
====
You can use the `-y` option to automatically answer yes to the prompts.
====
+
. Optional. Delete the cluster-specific Operator IAM roles:
+
[IMPORTANT]
====
The account-wide IAM roles can be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
====
+
[source,terminal]
----
$ rosa delete operator-roles -c <cluster_id> --mode auto
----
endif::sts[]
