I've marked this as a potential security issue. If conductor fails to find a host for the evacuation, the migration record status is left in 'accepted' state and the compute service on the source node, if brought back up, will delete the guest from the source node because of this method pulling in 'accepted' state migration records:
I've marked this as a potential security issue. If conductor fails to find a host for the evacuation, the migration record status is left in 'accepted' state and the compute service on the source node, if brought back up, will delete the guest from the source node because of this method pulling in 'accepted' state migration records:
https:/ /github. com/openstack/ nova/blob/ 16.0.0. 0rc2/nova/ compute/ manager. py#L624
The guest is destroyed here:
https:/ /github. com/openstack/ nova/blob/ 16.0.0. 0rc2/nova/ compute/ manager. py#L668
And this code goes back to at least Newton.