role with expungeVirtualMachine

[summer-abacus]

We've created a role with expungeVirtualMachine = allowed. When a user now tries do destroy a virtual machine the "Expunge Button" does not show up.

Is there an other permission needed to allow a user to expunge virtual machines?

[Drako01]

There is an additional capability check in the current UI, beyond allowing the API in the role.

In DestroyVM.vue,
the Expunge option in the destroy dialog requires both:

• expungeVirtualMachine in the user's available APIs; and
• an Admin role type or the allowuserexpungerecovervm capability.

That capability is exposed by listCapabilities. Have an administrator check the effective
allow.user.expunge.recover.vm configuration for the affected account. Its
configuration definition
defaults to false and supports account scope. Allowing the API through a custom role does not itself
enable that configuration.

Check listCapabilities while signed in as the affected user, rather than comparing only with an
administrator session. If it returns allowuserexpungerecovervm: false, that explains the missing
option despite the role rule.

If you mean the separate Expunge action after destruction, its
visibility condition
also checks the VM state (Destroyed/Expunging) and the capability.

The setting permits recovery as well as expunge, so its effective scope should match your account
policy. These references are pinned to current source; check the corresponding files for your
deployed CloudStack version if its behavior differs. I have not executed an expunge operation.