CLI/SSH delete VMs that were set as "Protect from accidental deletion" in XO

[bobafetthotmail]

I have seen that in XO, in the VM advanced settings tab I can flip some switches like "Protect from accidental deletion" and "Protect from accidental shutdown".
This will be reflected in the VM's settings with the "blocked-operations"

blocked-operations (MRW): (unknown operation): true; suspend: true; hard_shutdown: true; clean_shutdown: true; clean_reboot: true; pause: true; hard_reboot: true; destroy: true

I've tried editing that with xe vm-param-set from SSH connection to the XCP-ng server but even if I set all of them as false I can't shut down the VM or delete it and I only get an error message

You attempted an operation that was explicitly blocked (see the blocked_operations field of the given object).

Now, I know that I can just flip the switch again from XO and it will remove these locks, then I can delete it from XO or with xe vm-uninstall uuid=<whatever> through CLI

I was just wondering about how to disable these locks from command line, because I assume the command line interface can do it too, but I didn't find anything about that in the docs.

[jedimarcus]

What commands did you try?

Running

xe vm-param-cleaner uuid=<vm_uuid> param-name=blocked-operations

Will unset most of the fields and in a quick test I saw that I could reboot the machine again.

Maybe setting something to false is just not enough.

[olivierlambert]

You have weird keys also. Please be sure to remove the key entirely.

[bobafetthotmail]

@jedimarcus I just used xe vm-param-set to set all the entries in that parameter as false, I didn't see that there is also xe vm-param-cleaner.
That works and solves the question, thank you.

[bobafetthotmail]

@olivierlambert what is a "weird key" here?
that entry was populated (or cleaned) by clicking on the "Protect from accidental deletion" and "Protect from accidental shutdown" switches in XO on a source build (in a Debian VM) with latest XCP-ng 8.2

[olivierlambert]

@bobafetthotmail (unknown operation): true;

[bobafetthotmail]

@olivierlambert That key is added (or removed) as part of this block of keys

blocked-operations (MRW): (unknown operation): true; hard_reboot: true; pause: true; suspend: true; hard_shutdown: true; clean_reboot: true; clean_shutdown: true

when I click on the "Protect from accidental shutdown" switch in the Advanced settings of the VM in Xen Orchestra.

From the version page in XO I see
xo-server 5.71.1
xo-web 5.75.0

And I have XCP-ng at 8.2 and updated packages with yum upgrade.

[olivierlambert]

Weird. Ping @julien-f

[julien-f]

@pdonias I believe this is due to https://github.com/vatesfr/xen-orchestra/blob/4a6724f664014630b41a38f820af49335f7cf3a1/packages/xo-web/src/xo-app/vm/tab-advanced.js#L71

[olivierlambert]

Indeed, shutdown alone isn't a valid operation in the XAPI enum.

[pdonias]

@olivierlambert That's weird because it can be set and read with XAPI calls but not with xe and if I remove it from the blocked operations (and leave all the other operations), I'm able to stop the VM with a VM.shutdown call, which is what we're trying to avoid when the option is enabled.

[olivierlambert]

@pdonias so maybe a bug in xe itself? It seems xe doesn't have the full enum in XAPI, that is indeed containing shutdown (cf https://xapi-project.github.io/xen-api/classes/vm.html

vm_operations
Values: 	snapshot 	refers to the operation "snapshot"
	clone 	refers to the operation "clone"
	copy 	refers to the operation "copy"
	create_template 	refers to the operation "create_template"
	revert 	refers to the operation "revert"
	checkpoint 	refers to the operation "checkpoint"
	snapshot_with_quiesce 	refers to the operation "snapshot_with_quiesce"
	provision 	refers to the operation "provision"
	start 	refers to the operation "start"
	start_on 	refers to the operation "start_on"
	pause 	refers to the operation "pause"
	unpause 	refers to the operation "unpause"
	clean_shutdown 	refers to the operation "clean_shutdown"
	clean_reboot 	refers to the operation "clean_reboot"
	hard_shutdown 	refers to the operation "hard_shutdown"
	power_state_reset 	refers to the operation "power_state_reset"
	hard_reboot 	refers to the operation "hard_reboot"
	suspend 	refers to the operation "suspend"
	csvm 	refers to the operation "csvm"
	resume 	refers to the operation "resume"
	resume_on 	refers to the operation "resume_on"
	pool_migrate 	refers to the operation "pool_migrate"
	migrate_send 	refers to the operation "migrate_send"
	get_boot_record 	refers to the operation "get_boot_record"
	send_sysrq 	refers to the operation "send_sysrq"
	send_trigger 	refers to the operation "send_trigger"
	query_services 	refers to the operation "query_services"
	shutdown 	refers to the operation "shutdown"
	call_plugin 	refers to the operation "call_plugin"
	changing_memory_live 	Changing the memory settings
	awaiting_memory_live 	Waiting for the memory settings to change
	changing_dynamic_range 	Changing the memory dynamic range
	changing_static_range 	Changing the memory static range
	changing_memory_limits 	Changing the memory limits
	changing_shadow_memory 	Changing the shadow memory for a halted VM.
	changing_shadow_memory_live 	Changing the shadow memory for a running VM.
	changing_VCPUs 	Changing VCPU settings for a halted VM.
	changing_VCPUs_live 	Changing VCPU settings for a running VM.
	changing_NVRAM 	Changing NVRAM for a halted VM.
	assert_operation_valid 	
	data_source_op 	Add, remove, query or list data sources
	update_allowed_operations 	
	make_into_template 	Turning this VM into a template
	import 	importing a VM from a network stream
	export 	exporting a VM to a network stream
	metadata_export 	exporting VM metadata to a network stream
	reverting 	Reverting the VM to a previous snapshotted state
	destroy 	refers to the act of uninstalling the VM

[pdonias]

@olivierlambert It would look like it. I also tried to remove everything from blocked-operations except shutdown and I was able to xe vm-shutdown the VM. But as soon as I add clean_shutdown, xe doesn't allow the shutdown anymore.

[olivierlambert]

@pdonias Yeah I think shutdown is a kind of an alias for clean_shutdown. Probably for historical reasons. It explains why xe is confused.

[Zevgeny]

I came across this post in a google search.

"xe vm-param-cleaner" mentioned earlier doesnt seem to exist anymore. However the following command worked for me:

xe vm-param-clear uuid=<vm_uuid> param-name=blocked-operations

[luca steinke]

I had to do the following to remove the reboot block:

xe vm-param-remove param-name=blocked-operations param-key=hard_reboot uuid=$UUID

And then:

xe vm-reboot force=true vm=$UUID