Skip to main content

​
Overview

Action plan policies control whether migration plans require human approval before execution or execute automatically after audit completion. The default policy requires explicit approval — ensuring operators review every migration before it occurs. Automatic execution is available for trusted, validated strategies in controlled environments.

​
Policy Options

Manual Approval (Default)

All action plans require an explicit execute call. Operators review each migration before approving. No workloads move without human oversight.

Automatic Execution

Plans execute immediately after audit completion without operator review. Suitable for fully tested strategies in non-production environments.

​
Manual Approval Policy

The default policy. All action plans are created in RECOMMENDED state and require explicit execution via the Dashboard or CLI. This policy is appropriate for:
  • Production environments with change management requirements
  • Strategies involving mission-critical instances
  • Clusters where maintenance windows must be respected
No configuration change is needed — this is the platform default.

​
Automatic Execution Policy

Enable automatic execution by setting auto_trigger at audit creation:
Create auto-executing audit
watcher audit create \
  --goal server_consolidation \
  --auto-trigger True
For scheduled audits, include --auto-trigger True in the audit creation command. All resulting action plans execute automatically within 5–10 minutes of audit completion.
Enable automatic execution only for non-production environments or after thorough testing of the strategy on your cluster topology. Automatic execution can trigger live migrations at any time — including during business hours if the audit schedule is misconfigured.

​
Action Plan Expiry

Plans become stale when the cluster state changes significantly after audit completion. Configure a maximum plan age to prevent outdated migrations from executing.

Open Advanced Configuration

Open XDeploy and navigate to Advanced Configuration. In the Service Tree (left panel), select watcher.

Edit the Expiry Setting

Click New File or select an existing watcher.conf from the File Browser (right panel). Add the following in the Code Editor (center panel):
/etc/xavs/config/watcher/watcher.conf
[DEFAULT]
action_plan_expiry = 24
Plans older than action_plan_expiry hours are automatically set to CANCELLED state. A new audit must run to generate a current plan.

Save and Apply

Click Save Current File. Return to Operations and run reconfigure to apply the expiry policy to the API and Decision Engine.
Action plan expiry policy configured and applied via XDeploy.

​
Role-Based Execution Control

By default, the admin role can create audits, approve plans, and execute them. The member role has read-only access to audits and plans. To restrict execution to cloud administrators only, verify the default policy:
Check RBAC policy
docker exec watcher_api \
  oslopolicy-list-redundant \
  --config-file /etc/watcher/watcher.conf
The default policies ensure:
  • Plan execution requires the admin role
  • Plan viewing is available to member and reader roles
  • Plan creation (via audit) requires the admin role

​
Validation

Create a test audit and verify the resulting action plan shows RECOMMENDED state (not auto-executed) when manual approval is configured.
Action plan requires explicit approval before execution can begin.

​
Next Steps

Scheduling

Set up recurring audits and configure their execution policy.

Security

Configure RBAC to restrict execution to the admin role.

Compute Integration

Ensure compute hosts support live migration for action execution.

Troubleshooting

Diagnose auto-trigger failures and execution policy issues.