GCP VM Teardown with Terraform and AD/DNS Cleanup

id: gcp-vm-teardown-terraform-dns-cleanup
namespace: company.team
description: |
  Deprovision a Google Cloud VM with Terraform using the state written at
  provisioning time, then clean up its Active Directory computer account and
  forward/reverse DNS records via an Ansible playbook against the Windows DC.

inputs:
  - id: vmName
    type: STRING
    defaults: gcpdevlnxap08

  - id: ipAddress
    type: STRING
    defaults: 10.128.10.8

  - id: vmSize
    type: STRING
    defaults: n1-standard-1

  - id: zone
    type: STRING
    defaults: us-central1-a

  - id: billingAccount
    type: STRING
    description: GCP project ID.
    defaults: my-gcp-project

  - id: osFlavor
    type: STRING
    defaults: ubuntu-os-cloud/ubuntu-2204-lts

  - id: network
    type: STRING
    defaults: default

  - id: subnet
    type: STRING
    defaults: default

tasks:
  - id: deleteVM
    type: io.kestra.plugin.terraform.cli.TerraformCLI
    description: Destroy the VM from the state created at provisioning time.
    env:
      GOOGLE_APPLICATION_CREDENTIALS: gcp-svc-account.json
    inputFiles:
      gcp-svc-account.json: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
      backend.tf: |
        terraform {
          backend "gcs" {
            # Replace with the state bucket used by your provisioning flow
            bucket = "my-terraform-state-bucket"
          }
        }
      main.tf: |
        # Must match the configuration used to provision the VM
        resource "google_compute_instance" "default" {
          name         = "{{ inputs.vmName }}"
          machine_type = "{{ inputs.vmSize }}"
          zone         = "{{ inputs.zone }}"
          project      = "{{ inputs.billingAccount }}"

          boot_disk {
            initialize_params {
              image = "{{ inputs.osFlavor }}"
            }
          }

          network_interface {
            network            = "{{ inputs.network }}"
            subnetwork         = "{{ inputs.subnet }}"
            subnetwork_project = "{{ inputs.billingAccount }}"
            access_config {}
            network_ip = "{{ inputs.ipAddress }}"
          }
        }
    beforeCommands:
      - terraform init -backend-config="prefix={{ inputs.vmName }}"
    commands:
      - terraform plan
      - terraform destroy -auto-approve -json
    assets:
      inputs:
        - id: "{{ inputs.vmName }}"
      outputs:
        - id: "{{ inputs.vmName }}"
          type: io.kestra.plugin.ee.assets.VM
          metadata:
            vmName: "{{ inputs.vmName }}"
            vmSize: "{{ inputs.vmSize }}"
            zone: "{{ inputs.zone }}"
            billingAccount: "{{ inputs.billingAccount }}"
            osFlavor: "{{ inputs.osFlavor }}"
            network: "{{ inputs.network }}"
            subnet: "{{ inputs.subnet }}"
            ipAddress: "{{ inputs.ipAddress }}"
            state: deleted

  - id: removeDNSentry
    type: io.kestra.plugin.ansible.cli.AnsibleCLI
    description: Remove the AD computer account and DNS records on the Windows DC.
    beforeCommands:
      - pip install pywinrm
    inputFiles:
      inventory.ini: |
        [windows_vms]
        {{ kv('dcConfig').externalIPAddress }}

        [windows_vms:vars]
        ansible_user={{ kv('dcConfig').username }}
        ansible_password="{{ secret('AD_ADMIN_PASSWORD') }}"
        ansible_connection=winrm
        ansible_port=5985
        ansible_winrm_server_cert_validation=ignore
        ansible_winrm_transport=ntlm
      removeDNSEntry-playbook.yml: |
        ---
        - name: Clean up AD and DNS for the removed VM
          hosts: windows_vms
          gather_facts: no
          tasks:
            - name: Remove AD computer account and DNS records
              ansible.windows.win_shell: |
                $ReverseZone = "{{ (kv('dcConfig').subnetCIDR | split('\.'))[1] }}.{{ (kv('dcConfig').subnetCIDR | split('\.'))[0] }}.in-addr.arpa"
                $ClientName  = "{{ inputs.vmName }}"
                $Domain      = "{{ kv('dcConfig').domainName }}"
                $PtrName     = "{{ (inputs.ipAddress | split('\.'))[3] }}.{{ (inputs.ipAddress | split('\.'))[2] }}"

                Write-Host "Removing $ClientName from Active Directory..."
                Get-ADComputer -Identity $ClientName -ErrorAction SilentlyContinue | Remove-ADComputer -Confirm:$false

                Write-Host "Deleting forward DNS record..."
                Remove-DnsServerResourceRecord -ZoneName $Domain -Name $ClientName -RRType "A" -Force -ErrorAction SilentlyContinue

                Write-Host "Deleting reverse DNS record..."
                Remove-DnsServerResourceRecord -ZoneName $ReverseZone -Name $PtrName -RRType "PTR" -Force -ErrorAction SilentlyContinue

                Write-Host "Cleanup complete for $ClientName."
              register: dns_script_output

            - name: Print output to Kestra logs
              debug:
                var: dns_script_output.stdout_lines
    commands:
      - ansible-playbook -i inventory.ini removeDNSEntry-playbook.yml