Removing compute offering with related domain.

[SviridoffA]

problem

I have a zone in my infrastructure with several clusters. For each cluster, I have dedicated service offerings, which I assign via host tags. A task came up to dedicate a specific cluster to a single client, so that only this client could create resources there. I assigned these offerings to clients domain, removing them from public access. As a result, only users in that domain could see these offerings.

The client then underwent a reorganization, and two other separate domains were created, with resources distributed between them. After the reorganization was complete, the decision was made to delete the old domain. After deleting the domain, DRS stopped working. I decided to try manually migrating a VM in this cluster and discovered that all the offerings for that cluster had disappeared. I remembered that I hadn't transferred them to the new domains.

The virtual machines launched from these offerings still showed them in their properties, but when I tried to navigate from a VM to its offering, I got a 404 error. Looking at the database, I found that these offerings had a date in the "removed" field. This date matched the "removed" field of the deleted domain. I had to restore the offerings in the UI by deleting the date in the "removed" field, after which the offerings returned and DRS started working again. Afterward, I manually went through the offerings and set the permissions for the necessary domains; this field was empty everywhere.

versions

ACS 4.19.3
Ubuntu 24.04

The steps to reproduce the bug

1. Create service offering and use it to create virtual machines.

2. Restrict the offering's permissions to a specific domain.

3. Delete the domain.

4. The offering will be deleted along with the domain, even though resources associated with it still exist in the system.

What to do about it?

I believe that in such a situation, the offering shouldn't be deleted from the system. The most logical approach would be to leave it with an empty domain field, or at least mark it as inactive.

[SviridoffA]

A small clarification: I deleted the domain with the 'clean up' option.

[kiranchavala]

Thnaks @SviridoffA , This looks like an improvement request and needs wider discussion

When you delete a domain with cleanup option true it removes all the resources (vm's , account, etc) associated with the domain.

In your case since the service offering associated with the domain , cloudstsack deleted the domain which I belive is the expected behaviour

https://cloudstack.apache.org/api/apidocs-4.20/apis/deleteDomain.html

https://docs.cloudstack.apache.org/en/4.20.1.0/adminguide/accounts.html#behavior-of-dedicated-hosts-clusters-pods-and-zones

Can you try the following apis, and see if it solves your issue in future

https://cloudstack.apache.org/api/apidocs-4.20/apis/assignVirtualMachine.html

https://cloudstack.apache.org/api/apidocs-4.20/apis/moveUser.html

@DaanHoogland issue similar to improvement request

#11398

[SviridoffA]

@kiranchavala
Thanks for the explanation. This behavior is difficult to predict, especially in large infrastructures. Currently, we can't delete offers through the UI, only mark them as inactive, but for some reason, they can be deleted when a domain is deleted, which could cause potential problems with the cluster's operation.

Thanks for the API calls; I've used one of them before. I'd probably add an API call that could be useful, like https://cloudstack.apache.org/api/apidocs-4.20/apis/updateServiceOffering.html
The state field might solve my problem, I'll have to try that in future, if it's happen again.

[DaanHoogland]

@kiranchavala @SviridoffA , I t seems to me that deleting an offering while a VM is still running for it is the problem..? Maybe we should introduce a concept of disabled for offering. There is a “state” of the service offering that can be set to “Inactive”. I am not sure if that would meet our needs.

[kiranchavala]

@DaanHoogland @SviridoffA

The parameter "state" marks the service offering as Active/Inactive.

https://cloudstack.apache.org/api/apidocs-4.20/apis/updateServiceOffering.html

I think we need to follow the same behaviour as Network offering which marks state as Enabled or Disabled

https://cloudstack.apache.org/api/apidocs-4.20/apis/updateNetworkOffering.html

Logged a enhancement UI /Polish issue

#11509

[sudo87]

@kiranchavala @DaanHoogland Shall we update state as Inactive for service offering if any instance is associated with it irrespective of choosing "Clean up" option?

[sudo87]

Regardless of whether "Clean up" is selected, all associated offerings (disk, network, service, VPC) are currently being removed.

Additionally, after deleting a domain (e.g., d1), any attempt to stop an instance that was using a now-removed service offering will fail and return an error.

To avoid this, it looks like the correct approach would be to mark offerings as Inactive instead of removing them entirely. Verified it by updating state value as Inactive and removed as NULL.