From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id B47941FF0C2 for ; Thu, 22 Oct 2026 14:50:33 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id A0B3C21A2A; Thu, 22 Oct 2026 14:48:35 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-manager v4 25/27] ui: guest destroy: add control for dangling IPSet references Date: Thu, 22 Oct 2026 14:47:06 +0200 Message-ID: <20261022124708.429069-26-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com> References: <20261022124708.429069-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792673238119 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.820 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 6K4VG62CDMCVCK5FRMNZUYIO4YT3OM7G X-Message-ID-Hash: 6K4VG62CDMCVCK5FRMNZUYIO4YT3OM7G X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Destroying a guest releases its IPAM entries, so the auto-generated 'guest-ipam-' IPSet disappears as well. Rules referencing that IPSet do not resolve anymore and are dropped from the generated ruleset as a result. Add the shared selector to the destroy dialog, so those rules can be disabled or deleted along with the guest, and a hint linking to the SDN firewall integration documentation. The 'note' config only renders a single hint, so it is replaced by two display fields among the additional items. Signed-off-by: Arthur Bied-Charreton --- www/manager6/window/SafeDestroyGuest.js | 65 ++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) diff --git a/www/manager6/window/SafeDestroyGuest.js b/www/manager6/window/SafeDestroyGuest.js index 45b277e5..536bfc6a 100644 --- a/www/manager6/window/SafeDestroyGuest.js +++ b/www/manager6/window/SafeDestroyGuest.js @@ -1,6 +1,11 @@ /* * SafeDestroy window with additional checkboxes for removing guests */ +// scanned by asciidoc-pve, so the anchor lands in the documentation index +const GUEST_IPAM_IPSET_HELP = { + onlineHelp: 'pve_firewall_automatically_generated_ipsets', +}; + Ext.define('PVE.window.SafeDestroyGuest', { extend: 'Proxmox.window.SafeDestroy', alias: 'widget.pveSafeDestroyGuest', @@ -32,7 +37,62 @@ Ext.define('PVE.window.SafeDestroyGuest', { }, ], - note: gettext('Referenced disks will always be destroyed.'), + initComponent: function () { + let me = this; + + let helpLink = Ext.htmlEncode( + Proxmox.Utils.get_help_link(GUEST_IPAM_IPSET_HELP.onlineHelp), + ); + let helpLabel = Ext.htmlEncode(gettext("this guest's auto-generated IPSet")); + let refsHint = Ext.String.format( + gettext('Firewall rules referencing {0} will no longer resolve.'), + `${helpLabel}`, + ); + + me.additionalItems = [ + // pushing would append on every open + ...me.additionalItems, + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: gettext('Referenced disks will always be destroyed.'), + }, + { + xtype: 'pveFirewallReferenceAction', + reference: 'firewallDanglingReferencesButton', + name: 'dangling-ipset-references', + preferredValue: 'drop', + fieldLabel: gettext('Referencing rules'), + labelWidth: 200, + referenceActions: [ + { + text: gettext('Keep'), + value: 'keep', + description: gettext( + "Do not touch firewall rules referencing this guest's IPAM IPSet.", + ), + }, + { + text: gettext('Disable'), + value: 'disable', + description: gettext("Disable firewall rules referencing this guest's IPAM IPSet."), + }, + { + text: gettext('Delete'), + value: 'drop', + description: gettext("Delete firewall rules referencing this guest's IPAM IPSet."), + }, + ], + }, + { + xtype: 'displayfield', + userCls: 'pmx-hint', + value: refsHint, + }, + ]; + + me.callParent(); + }, getParams: function () { let me = this; @@ -43,6 +103,9 @@ Ext.define('PVE.window.SafeDestroyGuest', { let destroyUnreferencedCheckbox = me.lookupReference('destroyUnreferencedCheckbox'); me.params['destroy-unreferenced-disks'] = destroyUnreferencedCheckbox.checked ? 1 : 0; + let danglingRefs = me.lookupReference('firewallDanglingReferencesButton'); + me.params['dangling-ipset-references'] = danglingRefs.getValue(); + return me.callParent(); }, }); -- 2.47.3