1. Documentation
×

Enabling or disabling virtual machine delete protection

You can prevent the inadvertent deletion of a virtual machine (VM) by enabling delete protection for the VM. You can also disable delete protection for the VM.

You enable or disable delete protection from either the command line or the VM’s VirtualMachine details page in the OKD web console. The option is disabled by default.

You can also choose to remove availability of the delete protection option for any VMs in a cluster you administer. In this case, VMs with the feature already enabled retain the protection, while the option is unavailable for any newly created VMs.

Enabling or disabling virtual machine delete protection by using the web console

To prevent the inadvertent deletion of a virtual machine (VM), you can enable VM delete protection by using the OKD web console. You can also disable delete protection for a VM.

By default, delete protection is not enabled for VMs. You must set the option for each individual VM.

Procedure

  1. From the OKD web console, choose your view:

    • For a virtualization-focused view, select Administrator → Virtualization → VirtualMachines.

    • For a general view, navigate to Virtualization → VirtualMachines.

  2. From the VirtualMachines list, select the VM whose delete protection you want to enable or disable.

  3. Click the Configuration tab.

  4. In the VirtualMachines details, choose to enable or disable the protection as follows:

    • To enable the protection:

      1. Set the Deletion protection switch to On.

      2. Click Enable to confirm the protection.

    • To disable the protection:

      1. Set the Deletion protection switch to Off.

      2. Click Disable to disable the protection.

Enabling or disabling VM delete protection by using the command line

To prevent the inadvertent deletion of a virtual machine (VM), you can enable VM delete protection by using the command line. You can also disable delete protection for a VM.

By default, delete protection is not enabled for VMs. You must set the option for each individual VM.

Prerequisites

  • You have installed the OpenShift CLI (oc).

Procedure

  • Enable delete protection for a VM by running the following command:

    $ oc patch vm <vm_name> --type merge -p '{"metadata":{"labels":{"kubevirt.io/vm-delete-protection":"True"}}}' -n <namespace>

  • Disable delete protection for a VM by running the following command:

    $ oc patch vm <vm_name> --type json -p '[{"op": "remove", "path": "/metadata/labels/kubevirt.io~1vm-delete-protection"}]' -n <namespace>

Removing the VM delete protection option

When you enable delete protection on a virtual machine (VM), you ensure that the VM cannot be inadvertently deleted. You can also disable the protection for a VM.

As a cluster administrator, you can choose not to make the VM delete protection option available. VMs with delete protection already enabled retain that setting; for any new VMs that are created, enabling the option is not allowed.

You can remove the delete protection option by establishing a validation admission policy for the cluster and then creating the necessary binding to use the policy in the cluster.

Prerequisites

  • You must have cluster administrator privileges.

Procedure

  1. Create the validation admission policy, as shown in the following example:

    Example validation admission policy file

    apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "disable-vm-delete-protection"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:   ["kubevirt.io"]
      apiVersions: ["*"]
      operations:  ["UPDATE", "CREATE"]
      resources:   ["virtualmachines"]
  variables:
    - expression: string('kubevirt.io/vm-delete-protection')
      name: vmDeleteProtectionLabel
  validations:
  - expression: >-
      !has(object.metadata.labels) ||
      !object.metadata.labels.exists(label, label == variables.vmDeleteProtectionLabel) ||
      has(oldObject.metadata.labels) &&
      oldObject.metadata.labels.exists(label, label == variables.vmDeleteProtectionLabel)
    message: "Virtual Machine delete protection feature is disabled"

  2. Apply the validation admission policy to the cluster:

    $ oc apply -f disable-vm-delete-protection.yaml

  3. Create the validation admission policy binding, as shown in the following example:

    Example validation admission policy binding file

    apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "disable-vm-delete-protection-binding"
spec:
  policyName: "disable-vm-delete-protection"
  validationActions: [Deny]
  matchResources:

  4. Apply the validation admission policy binding to the cluster:

    $ oc apply -f disable-vm-delete-protection-binding.yaml

Additional resources