Removing Expired Clones

At the end of the VDI life cycle, the clone VM is deleted from the hypervisor. This can happen as a result of administrator action through the vSphere Web Client or the VMware Horizon View GUI.

Before a clone VM is deleted, you need to unregister it from KeyControl. This removes the address of the clone from KeyControl so that the same address can be used again later. Otherwise, you will have "orphan" names in KeyControl which will prevent you from reusing those addresses.

1. For Linux, log into the VM as root. For Windows, log in as a System Administrator and open a Command Prompt or start Windows PowerShell.

2. Remove the VM using the CLI or the HyTrust Python-based REST API. After the clone VM has been removed, none of its encrypted drives can be accessed. If the clone boot partition was encrypted, the clone is powered off after it is removed from KeyControl.

   • If you want to use the CLI, enter the command hcl unregister [-a] [-u username [-p password]] [-y], where:

     • -a tells hcl that the VM is registered with KeyControl but it is currently unauthenticated. This option requires KeyControl Cloud Admin user account credentials. Omit this option if the VM is currently registered and authenticated with KeyControl.
     • -u is a KeyControl user account with Cloud Admin privileges. If you do not specify the account name, hcl prompts you for the information.
     • -p is the password for the KeyControl account. If you do not specify this password you will be prompted for the information.
     • -y tells the command to run non-interactively.

   • If you want to use the API:

     1. Make sure Python is available on the VM.
     2. If needed, install the HyTrust APIs on the machine from which you want to do the clean up. You can download the API package from the KeyControl webGUI by clicking Cloud in the top menu bar, selecting Actions > Download Policy Agent, then downloading the file called hcs-api-RelaseNumber-BuildNumber.tgz. For example, hcs-api-4.2.1-12346M.tgz.
     3. Copy the hcs-api-RelaseNumber-BuildNumber.tgz file to the VM and unpack the archive so that you have an hcs-api directory with 5 python files and one executable called hicli.

     4. Create a Python script with the following lines:

        keycontrol=$1
        cvmset=$2
        clonevm=$3
        username=$4
        password=$5
        hicli kc select $keycontrol
        hicli user login $username --password=$password
        hicli cvmset select $cvmset
        yes | hicli cvm rm $clonevm

        Where $username is a KeyControl user account with Cloud Admin privileges and $password is the password for that KeyControl account.