Skip to content

Limit the conditions for zone removal - #968

Open
bal-e wants to merge 6 commits into
mainfrom
zone-removal-limits
Open

Limit the conditions for zone removal#968
bal-e wants to merge 6 commits into
mainfrom
zone-removal-limits

Conversation

@bal-e

@bal-e bal-e commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

We don't have a good way to cancel ongoing operations, so if a zone is removed in the middle of an operation, the operation is likely to crash. This PR gates zone removal behind maintenance mode, and requires the zone to be passive or hard-halted.

While updating the documentation, I noticed that cascade zone maintenance was missing a section, so I added that too.

Fixes #888.


  • If you are changing Rust code or integration tests (Cargo.*, crates/, etc/, integration-tests/, src/):

    • Did you run the integration tests with act through the act-wrapper (as described in TESTING.md)?
  • If you are modifying man pages:

    • Did you commit the updated built man pages?

@bal-e
bal-e requested a review from Philip-NLnetLabs August 17, 2026 09:29
@bal-e bal-e self-assigned this Aug 17, 2026
Remove a zone.
.sp
Maintenance mode must be enabled (see \fBzone maintenance\fP). The
zone must be passive (with no ongoing operations) or in a hard\-halt state.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this or? I thought maintenance mode was always required.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, right, forgot to update the docs. On it.

Comment thread src/center.rs
// The zone must be in maintenance mode, and passive/halted.
// TODO(#871): support removing a zone during restoration.
if !zone.maintenance_mode || !zone.machine.is_waiting() && !zone.machine.is_halted() {
return Err(ZoneRemoveError::NotInMaintenanceMode);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be confusing if the zone is in maintenance mode but not waiting or halted

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the confusion originates from the terminology we use for maintenance mode; e.g. cascade zone maintenance enable sets a flag, but maintenance mode only really takes effect when Cascade reaches the waiting state. I think this needs a broader discussion.

@ximon18 ximon18 added UX User experience. reliability Making sure Cascade's internal invariants are upheld, always. labels Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

reliability Making sure Cascade's internal invariants are upheld, always. UX User experience.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Removing a zone whilst it is being signed causes a panic.

3 participants