Documentation
¶
Index ¶
- Variables
- func DeleteSecurityGroupWhenUnused(ctx context.Context, service ec2service.Service, groupID string) error
- func IsDependencyViolationError(err error) bool
- func IsGroupNotFoundError(err error) bool
- func ReapReleasedLambdaENIs(ctx context.Context, service ec2service.Service, groupID string) error
Constants ¶
This section is empty.
Variables ¶
var ( // Deliberately short. AWS releases the network interfaces holding a group anywhere // between seconds and a quarter of an hour for the very same operation, measured // against a real account, so there is no timeout worth picking: long enough for the // slow case wastes a worker in the common one, and short enough for the common case // fails constantly. This window covers only the fast case; anything longer is handed // back to the deployment engine. SecurityGroupDeleteTimeout = 30 * time.Second SecurityGroupDeletePollInterval = 5 * time.Second )
Functions ¶
func DeleteSecurityGroupWhenUnused ¶
func DeleteSecurityGroupWhenUnused( ctx context.Context, service ec2service.Service, groupID string, ) error
DeleteSecurityGroupWhenUnused deletes a security group, giving whatever still holds it a brief chance to be released and handing the work back if it is not.
A group cannot be deleted while a network interface references it, and interfaces outlive the thing that created them by an unpredictable margin: Lambda's outlive the function, and a VPC endpoint's outlive the endpoint. Rather than block a deployment worker for that margin, this tries for a short while and then returns a retryable error so the engine re-runs the destroy later. Destroys are idempotent, so re-running costs nothing.
func IsDependencyViolationError ¶
IsDependencyViolationError reports whether an EC2 call failed because the resource is still referenced by something else.
func IsGroupNotFoundError ¶
IsGroupNotFoundError reports whether a security group is already gone, which is the expected outcome of a retried teardown.
func ReapReleasedLambdaENIs ¶
func ReapReleasedLambdaENIs( ctx context.Context, service ec2service.Service, groupID string, ) error
ReapReleasedLambdaENIs deletes the network interfaces Lambda has finished with on a security group.
Only interfaces Lambda manages, and only once they are detached. An interface still in use belongs to a running workload, and one belonging to another service (a VPC endpoint, say) is that service's to remove; deleting either would break something that is still live.
The detach itself cannot be hurried from here; this removes the separate delay between AWS detaching an interface and AWS deleting it.
Types ¶
This section is empty.
Source Files