Deployed models can be protected from unintentional changes by disabling commands that can alter a model.
This is accomplished through the use of the
disable-command command with one
of three progressively restrictive command groups:
By disabling the
destroy-model group, for instance, the user loses the ability
to destroy both the model and its controller. Specifying the
group adds to these restrictions by disabling the removal of machines,
relations, applications and units. The
all group disables the complete set of
commands that can change the configuration of a model.
To give the user some feedback on why a command might be disabled, an optional message argument can be passed as part of the disable command.
For example, the following could be used to prevent execution of both the
juju disable-command destroy-model "Check with SA before destruction."
If a user now attempts to destroy a protected model, they'd encounter an error similar to the following:
Destroying model ERROR cannot destroy model: Check with SA before destruction. destroy-model operation has been disabled for the current model. To enable the command run juju enable-command destroy-model
The reverse of
enable-command. This can be used with
the corresponding group to restore a user's access to that group's commands:
juju enable-command destroy-model
By default, these actions are performed against the currently selected controller and model, but specific models can be targeted by using the additional '-m' or '--model' argument.
If you need to list which commands have been disabled, use
This will output will list any group that's currently disabled:
Disabled commands Message all
Warning: In some cases, the disable command will only take effect after the user has logged out of Juju and logged back in again.
Note: The '--force' option recognized by some Juju commands bypasses any restriction level that would otherwise apply. If your policy is to use restrictions then the immediate use of the '--force' option should not be part of your workflow. If you must use it, do so after having first run the Juju command without it to ensure you are aware of any possible restrictions.