## Feature Request: Add Delete Protection Support for ROSA HCP Clusters

[paulczar]

Summary

Add support for the delete_protection attribute to the rhcs_cluster_rosa_hcp resource to prevent accidental cluster deletion, matching the functionality available in the ROSA CLI.

Use Case

Delete protection is a critical safety feature for production clusters that prevents accidental deletion. Currently, users can enable delete protection via the ROSA CLI (rosa edit cluster --enable-delete-protection), but this functionality is not available in the Terraform provider, creating a gap in infrastructure-as-code workflows.

Current Behavior

• The rhcs_cluster_rosa_hcp resource does not support delete protection
• Users must manually enable/disable delete protection via ROSA CLI or OCM API
• This creates a disconnect between Terraform-managed infrastructure and manual operations

Desired Behavior

Add a delete_protection boolean attribute to rhcs_cluster_rosa_hcp that:

• Enables delete protection when set to true during cluster creation
• Allows updating delete protection status (enable/disable) via Terraform
• Automatically disables delete protection before cluster deletion (so terraform destroy works)
• Reads the current delete protection status from the API

Proposed Implementation

resource "rhcs_cluster_rosa_hcp" "example" {
  name           = "my-cluster"
  cloud_region   = "us-east-1"
  # ... other required attributes ...
  
  delete_protection = true  # New attribute
}

API Support

The OCM API already supports delete protection via:

• GET /api/clusters_mgmt/v1/clusters/{cluster_id}/delete_protection - Read status
• PATCH /api/clusters_mgmt/v1/clusters/{cluster_id}/delete_protection - Update status

The API endpoint accepts a DeleteProtection object with an enabled boolean field.

Benefits

1. Safety: Prevents accidental cluster deletion in production environments
2. Consistency: Aligns Terraform provider with ROSA CLI functionality
3. Automation: Enables full infrastructure-as-code workflows without manual steps
4. Compliance: Supports organizations requiring delete protection for production resources

Additional Context

• ROSA CLI command: rosa edit cluster --enable-delete-protection
• API documentation: The delete protection endpoint is documented in the OCM API specification
• Default behavior: Should default to false (disabled) to maintain backward compatibility

References

• ROSA CLI documentation: rosa edit cluster --help
• OCM API: /api/clusters_mgmt/v1/clusters/{cluster_id}/delete_protection

[supernovae]

👍

[openshift-ci]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[seanmalloy]

/remove-lifecycle stale
/lifecycle frozen

[amandahla]

Issue closed by #1256