Orphan Instances Sanitizer

The stx-openstack application includes an opt-in automated cleanup job for orphan libvirt domains on compute nodes.

About this task

An orphan domain is a virtual machine that exists on a compute node’s hypervisor (libvirt) but is no longer tracked by the Nova service. This can happen when stx-openstack is removed (system application-remove stx-openstack) while virtual machines are still running. If the orphan domain is not cleaned up before re-applying the application, nova-compute pods may fail to start on that compute node.

Enable the CronJob

The cleanup job is disabled by default. To enable it, run the following commands on the active controller:

~(keystone_admin)]$ system helm-override-update stx-openstack nova openstack --reuse-values --set manifests.cron_job_instances_sanitizer=true
~(keystone_admin)]$ system application-apply stx-openstack

Once enabled, the CronJob runs daily at midnight (configurable via jobs.instances_sanitizer.cron). It can also be triggered manually:

~(keystone_admin)]$ kubectl -n openstack create job --from=cronjob/nova-instances-sanitizer manual-cleanup
~(keystone_admin)]$ kubectl -n openstack logs -l job-name=manual-cleanup

Note

The CronJob is scheduled per-execution (single Pod), so each run cleans one compute node. Over multiple runs, all compute nodes are covered. The init container variant runs on every compute node at pod startup.