refactor security groups

cloud/cleanup.go

@@ -17,6 +17,7 @@ import (
 	"strings"
 
 	"github.com/stackitcloud/cluster-api-provider-stackit/cloud/services/publicip"
+	"github.com/stackitcloud/cluster-api-provider-stackit/cloud/services/securitygroup"
 )
 
 // CleanupByTags deletes provider-managed cloud resources matching tags without
@@ -76,6 +77,18 @@ func CleanupByTags(ctx context.Context, client Client, tags map[string]string) e
 		}
 	}
 
+	sgClient := securitygroup.NewClient(client)
+	securityGroups, err := sgClient.ListByTags(ctx, tags)
+	if err != nil {
+		errs = append(errs, err.Error())
+	} else {
+		for _, sg := range securityGroups {
+			if err := sgClient.DeleteByID(ctx, sg.ID); err != nil {
+				errs = append(errs, fmt.Sprintf("delete security group %q: %v", sg.ID, err))
+			}
+		}
+	}
+
 	if len(errs) > 0 {
 		return fmt.Errorf("%w: %s", ErrTransient, strings.Join(errs, "; "))
 	}

cloud/cleanup_test.go

@@ -42,6 +42,12 @@ func TestCleanupByTagsDeletesMatchingCloudResources(t *testing.T) {
 	if _, err := client.CreatePublicIP(ctx, otherTags); err != nil {
 		t.Fatalf("CreatePublicIP() error = %v", err)
 	}
+	if _, err := client.CreateSecurityGroup(ctx, "matched-sg", tags); err != nil {
+		t.Fatalf("CreateSecurityGroup() error = %v", err)
+	}
+	if _, err := client.CreateSecurityGroup(ctx, "other-sg", otherTags); err != nil {
+		t.Fatalf("CreateSecurityGroup() error = %v", err)
+	}
 	if _, err := client.EnsureAPIServerLoadBalancer(ctx, cloud.LoadBalancerInput{
 		Name:      "matched",
 		Tags:      tags,
@@ -106,4 +112,18 @@ func TestCleanupByTagsDeletesMatchingCloudResources(t *testing.T) {
 	if len(otherPublicIPs) != 1 {
 		t.Fatalf("other public IP count = %d, want 1", len(otherPublicIPs))
 	}
+	matchedSecurityGroups, err := client.ListSecurityGroupsByTags(ctx, tags)
+	if err != nil {
+		t.Fatalf("ListSecurityGroupsByTags() error = %v", err)
+	}
+	if len(matchedSecurityGroups) != 0 {
+		t.Fatalf("matched security group count = %d, want 0", len(matchedSecurityGroups))
+	}
+	otherSecurityGroups, err := client.ListSecurityGroupsByTags(ctx, otherTags)
+	if err != nil {
+		t.Fatalf("ListSecurityGroupsByTags(other) error = %v", err)
+	}
+	if len(otherSecurityGroups) != 1 {
+		t.Fatalf("other security group count = %d, want 1", len(otherSecurityGroups))
+	}
 }

cloud/client.go

@@ -55,12 +55,6 @@ type Client interface {
 
 	DeleteBastion(ctx context.Context, input BastionInput, status Bastion) error
 
-	EnsureNodeSSHAccess(ctx context.Context, input NodeSSHAccessInput) (*SecurityGroup, error)
-
-	DeleteNodeSSHAccess(ctx context.Context, tags map[string]string) error
-
-	ListSecurityGroupsByTags(ctx context.Context, tags map[string]string) ([]*SecurityGroup, error)
-
 	EnsureAPIServerLoadBalancer(ctx context.Context, input LoadBalancerInput) (*LoadBalancer, error)
 
 	ListAPIServerLoadBalancersByTags(ctx context.Context, tags map[string]string) ([]*LoadBalancer, error)