A VM that hits HookFailurePolicy_QUARANTINE (create-hook or pre-lease-hook failure) is moved to QUARANTINED by reconciler.ApplyHookFailurePolicy and then left there indefinitely:
- The sweeper only handles lease expiry and retries of
DELETING VMs; it never looks at QUARANTINED.
- No
PoolAdmin, Lease, or HostAdmin RPC lets an operator delete a specific VM, so there is no in-band way to clear one.
- Flintlock is never called for a quarantined VM, so the microVM keeps running and consuming host resources.
Consequences for host maintenance (#83): HostStatus.vm_count counts quarantined VMs, which is correct because the microVM is still on the host, but it means a drained host with even one quarantined VM never reaches 0 and the operator has no supported remedy.
Proposed:
- Add a
PoolAdmin.DeleteVM(uid) (or HostAdmin.EvictVM) RPC that runs EnsureVMDeleted / FinishVMDeletion, plus a matching poolmgrctl vm delete command (per AGENTS.md, CLI must track the API).
- Optionally a sweeper policy for a quarantine TTL after which the VM is deleted automatically.
Found while addressing review on #83.
A VM that hits
HookFailurePolicy_QUARANTINE(create-hook or pre-lease-hook failure) is moved toQUARANTINEDbyreconciler.ApplyHookFailurePolicyand then left there indefinitely:DELETINGVMs; it never looks atQUARANTINED.PoolAdmin,Lease, orHostAdminRPC lets an operator delete a specific VM, so there is no in-band way to clear one.Consequences for host maintenance (#83):
HostStatus.vm_countcounts quarantined VMs, which is correct because the microVM is still on the host, but it means a drained host with even one quarantined VM never reaches 0 and the operator has no supported remedy.Proposed:
PoolAdmin.DeleteVM(uid)(orHostAdmin.EvictVM) RPC that runsEnsureVMDeleted/FinishVMDeletion, plus a matchingpoolmgrctl vm deletecommand (per AGENTS.md, CLI must track the API).Found while addressing review on #83.