Clean Up

Clean up resources (avoid AWS charges)

Principle: clean up in reverse order of how you built it. The key point is to release the resources Kubernetes created (ALB, EBS) BEFORE terraform destroy — otherwise the AWS Load Balancer Controller gets deleted with the cluster and never cleans up the ALBs, leaving orphaned load balancers that make terraform destroy fail while you keep paying.

Step 0 — Prepare

If you changed code, make sure your local copy is up to date (or delete and re-clone for a clean state):

cd vprofile-app   && git pull
cd ../vprofile-helm && git pull
cd ../vprofile-infra && git pull

Identify the two load balancers that must disappear (one for vProfile, one for ArgoCD):

# Console: EC2 > Load Balancers (correct region). Or CLI:
aws elbv2 describe-load-balancers \
  --query "LoadBalancers[].{Name:LoadBalancerName,DNS:DNSName}" --output table

Step 1 — Delete Ingress and workloads to free ALB + EBS

Delete the Ingresses first so the AWS Load Balancer Controller removes both ALBs (while the controller is still alive):

kubectl get ingress -A
kubectl delete ingress vpro-ingress    -n vprofile
kubectl delete ingress argocd-ingress  -n argocd

Delete the vProfile workload so the PVC is removed → the EBS CSI driver deletes the MySQL EBS volume (reclaim policy Delete). The simplest way is to delete the namespace (or the ArgoCD Application):

kubectl delete ns vprofile
kubectl get pvc -A          # must be empty, no PVC left hanging

Step 2 — Delete the AWS Load Balancer Controller (IAM service account)

This service account was created with eksctl (plus a CloudFormation stack). Delete it with delete:

eksctl delete iamserviceaccount \
  --cluster vprofile-eks-cluster \
  --namespace kube-system \
  --name aws-load-balancer-controller

This takes a little while (it also deletes the matching CloudFormation stack). You may keep the IAM policy AWSLoadBalancerControllerIAMPolicy — it costs nothing; delete it later if you want.

Step 3 — terraform destroy (delete EKS, VPC, node group)

cd vprofile-infra
terraform init      # optional, run it to be safe if you changed code
terraform destroy

This deletes the EKS control plane, node group (EC2 workers), VPC, public subnets, route tables and the Internet Gateway. (This setup uses public subnets, with no NAT Gateway/Elastic IP, so those two are nothing to worry about.) Wait for it to finish and confirm Destroy complete!.

Step 4 — SonarQube EC2

If you are sure you won’t use it again:

• Terminate the SonarServer instance.
• Delete the sonar-sg security group.

Note: a Stopped EC2 instance is still charged for its EBS root volume (small), but not for compute.

Step 5 — IAM, GitHub PAT, ECR, DNS (the rest)

• IAM access keys: delete/deactivate the keys for github-actions and terraform-admin.
• GitHub PAT: revoke the Personal Access Token you created.
• ECR: delete the image repo if unused (image storage is billed by size).
• DNS: remove the CNAME records vprofile and argocd at your domain provider.
• (Optional) delete the IAM policy AWSLoadBalancerControllerIAMPolicy.

Verification checklist (correct region) — NO billable resources left

Go through each item in the AWS Console (in the region you used):