8.10. Protecting the Overcloud from Removal
To avoid accidental removal of the Overcloud with the
heat stack-delete overcloud
command, Heat contains a set of policies to restrict certain actions. Edit the /etc/heat/policy.json
and find the following parameter:
"stacks:delete": "rule:deny_stack_user"
Change it to:
"stacks:delete": "rule:deny_everybody"
Save the file.
This prevents removal of the Overcloud with the
heat
client. To allow removal of the Overcloud, revert the policy to the original value.