From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 992511FF0AA for ; Tue, 03 Nov 2026 09:47:05 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 1214621881; Tue, 03 Nov 2026 09:44:44 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-manager v5 25/27] ui: guest destroy: add control for dangling IPSet references Date: Tue, 3 Nov 2026 09:43:26 +0100 Message-ID: <20261103084328.203492-26-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261103084328.203492-1-a.bied-charreton@proxmox.com> References: <20261103084328.203492-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793695420445 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.718 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: YR4TCLNGHDZGSSF4KEQWNLVBRFOZJMGY X-Message-ID-Hash: YR4TCLNGHDZGSSF4KEQWNLVBRFOZJMGY X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Destroying a guest releases its IPAM entries, so the auto-generated 'guest-ipam-' IPSet disappears as well. Rules referencing that IPSet do not resolve anymore and are dropped from the generated ruleset as a result. Add the shared selector to the destroy dialog, so those rules can be disabled or deleted along with the guest, and a hint linking to the SDN firewall integration documentation. The 'note' config only renders a single hint, so it is replaced by two display fields among the additional items. Signed-off-by: Arthur Bied-Charreton --- www/manager6/window/SafeDestroyGuest.js | 65 ++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) diff --git a/www/manager6/window/SafeDestroyGuest.js b/www/manager6/window/SafeDestroyGuest.js index 45b277e5..536bfc6a 100644 --- a/www/manager6/window/SafeDestroyGuest.js +++ b/www/manager6/window/SafeDestroyGuest.js @@ -1,6 +1,11 @@ /* * SafeDestroy window with additional checkboxes for removing guests */ +// scanned by asciidoc-pve, so the anchor lands in the documentation index +const GUEST_IPAM_IPSET_HELP = { + onlineHelp: 'pve_firewall_automatically_generated_ipsets', +}; + Ext.define('PVE.window.SafeDestroyGuest', { extend: 'Proxmox.window.SafeDestroy', alias: 'widget.pveSafeDestroyGuest', @@ -32,7 +37,62 @@ Ext.define('PVE.window.SafeDestroyGuest', { }, ], - note: gettext('Referenced disks will always be destroyed.'), + initComponent: function () { + let me = this; + + let helpLink = Ext.htmlEncode( + Proxmox.Utils.get_help_link(GUEST_IPAM_IPSET_HELP.onlineHelp), + ); + let helpLabel = Ext.htmlEncode(gettext("this guest's auto-generated IPSet")); + let refsHint = Ext.String.format( + gettext('Firewall rules referencing {0} will no longer resolve.'), + `${helpLabel}`, + ); + + me.additionalItems = [ + // pushing would append on every open + ...me.additionalItems, + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: gettext('Referenced disks will always be destroyed.'), + }, + { + xtype: 'pveFirewallReferenceAction', + reference: 'firewallDanglingReferencesButton', + name: 'dangling-ipset-references', + preferredValue: 'drop', + fieldLabel: gettext('Referencing rules'), + labelWidth: 200, + referenceActions: [ + { + text: gettext('Keep'), + value: 'keep', + description: gettext( + "Do not touch firewall rules referencing this guest's IPAM IPSet.", + ), + }, + { + text: gettext('Disable'), + value: 'disable', + description: gettext("Disable firewall rules referencing this guest's IPAM IPSet."), + }, + { + text: gettext('Delete'), + value: 'drop', + description: gettext("Delete firewall rules referencing this guest's IPAM IPSet."), + }, + ], + }, + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: refsHint, + }, + ]; + + me.callParent(); + }, getParams: function () { let me = this; @@ -43,6 +103,9 @@ Ext.define('PVE.window.SafeDestroyGuest', { let destroyUnreferencedCheckbox = me.lookupReference('destroyUnreferencedCheckbox'); me.params['destroy-unreferenced-disks'] = destroyUnreferencedCheckbox.checked ? 1 : 0; + let danglingRefs = me.lookupReference('firewallDanglingReferencesButton'); + me.params['dangling-ipset-references'] = danglingRefs.getValue(); + return me.callParent(); }, }); -- 2.47.3