What were you trying to do that didn't work?

Remove elements form CIB using 'cibadmin --delete-all --xpath':

cibadmin --force --delete-all --xpath '/cib/configuration/*[not(
  self::crm_config or
  self::nodes or
  self::resources or
  self::constraints
)]
| /cib/configuration/*[self::resources or self::constraints]/*
| /cib/configuration/nodes/*/*
| /cib/configuration/crm_config//nvpair[not(
  @name="cluster-infrastructure" or
  @name="cluster-name" or
  @name="dc-version" or
  @name="have-watchdog" or
  @name="last-lrm-refresh" or
  @name="stonith-watchdog-timeout" or
  @name="fencing-watchdog-timeout"
)]'

What is the impact of this issue to you?

• the command no longer works
• the command is used in ha_cluster system role, and its failure makes the role fail

Please provide the package NVR for which the bug is seen:

pacemaker-3.0.1-812.7568885bf4.git.el10.x86_64, installed from pacemaker-main CI branch https://ci.kronosnet.org/builds/pacemaker/rhel-10-x86-64/main/latest/

How reproducible is this bug?:

always, reliably, rather easily

Steps to reproduce

1. Have a CIB with a resource, a constraint referencing that resource, and ACLs referencing that resource. I suppose it is not limited to these specific relationships, it may be reproducible with any CIB element dependencies, but I haven't tried that.
2. Run the 'cibadmin --delete --xpath' comand listed above to delete all resources, constraints and ACLs.

Expected results

Command succeeds. This is working in pacemaker-3.0.1-3.el10.x86_64. See attached file for full log.

Actual results

Command fails, as it only removes the resources and reports the CIB is invalid, due to constraints and ACLs referencing the now missing resource. See attached file for full log.