1. Documentation
×

Enable or disable virtual machine delete protection

You can prevent accidental deletion of a virtual machine (VM) by enabling delete protection. If delete protection is enabled, you must disable it before you can delete that VM.

You enable or disable delete protection from either the command line or the VM’s VirtualMachine details page in the OKD web console. The option is disabled by default.

You can also choose to remove availability of the delete protection option for any VMs in a cluster you administer. In this case, VMs with the feature already enabled retain the protection, while the option is unavailable for any newly created VMs.

Enable or disable VM delete protection by using the web console

You can enable or disable delete protection on a virtual machine (VM), which prevents inadvertent deletion. The default is disabled.

By default, delete protection is not enabled for VMs. You must set the option for each individual VM.

Procedure

  1. From the OKD web console, choose your view:

    • For a virtualization-focused view, select Administrator → Virtualization → VirtualMachines.

    • For a general view, navigate to Virtualization → VirtualMachines.

  2. From the VirtualMachines list, select the VM whose delete protection you want to enable or disable.

  3. Click the Configuration tab.

  4. In the VirtualMachines details, choose to enable or disable the protection as follows:

    • To enable the protection:

      1. Set the Deletion protection switch to On.

      2. Click Enable to confirm the protection.

    • To disable the protection:

      1. Set the Deletion protection switch to Off.

      2. Click Disable to disable the protection.

Enable or disable VM delete protection by using the CLI

You can enable or disable delete protection on a virtual machine (VM) by using the command line. Delete protection prevents inadvertent deletion.

By default, delete protection is not enabled for VMs. You must set the option for each individual VM.

Prerequisites

  • You have installed the OpenShift CLI (oc).

Procedure

  • Enable delete protection for a VM by running the following command:

    $ oc patch vm <vm_name> --type merge -p '{"metadata":{"labels":{"kubevirt.io/vm-delete-protection":"True"}}}' -n <namespace>

  • Disable delete protection for a VM by running the following command:

    $ oc patch vm <vm_name> --type json -p '[{"op": "remove", "path": "/metadata/labels/kubevirt.io~1vm-delete-protection"}]' -n <namespace>

Remove the VM delete protection option from the cluster

You can make the delete protection option unavailable on your cluster by applying a ValidatingAdmissionPolicy. A virtual machine (VM) that already has delete protection keeps the setting, but you cannot enable protection on a new VM.

As a cluster administrator, you can choose not to make the VM delete protection option available. VMs with delete protection already enabled retain that setting; for any new VMs that are created, enabling the option is not allowed.

You can remove the delete protection option by establishing a validation admission policy for the cluster and then creating the necessary binding to use the policy in the cluster.

Prerequisites

  • You must have cluster administrator privileges.

  • You have installed the OpenShift CLI (oc).

Procedure

  1. Create the validation admission policy, as shown in the following example:

    apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "disable-vm-delete-protection"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:   ["kubevirt.io"]
      apiVersions: ["*"]
      operations:  ["UPDATE", "CREATE"]
      resources:   ["virtualmachines"]
  variables:
    - expression: string('kubevirt.io/vm-delete-protection')
      name: vmDeleteProtectionLabel
  validations:
  - expression: >-
      !has(object.metadata.labels) ||
      !object.metadata.labels.exists(label, label == variables.vmDeleteProtectionLabel) ||
      has(oldObject.metadata.labels) &&
      oldObject.metadata.labels.exists(label, label == variables.vmDeleteProtectionLabel)
    message: "Virtual Machine delete protection feature is disabled"

  2. Apply the validation admission policy to the cluster:

    $ oc apply -f disable-vm-delete-protection.yaml

  3. Create the validation admission policy binding, as shown in the following example:

    apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "disable-vm-delete-protection-binding"
spec:
  policyName: "disable-vm-delete-protection"
  validationActions: [Deny]
  matchResources:

  4. Apply the validation admission policy binding to the cluster:

    $ oc apply -f disable-vm-delete-protection-binding.yaml

Additional resources