if I understand it correctly, for clusters with a shared system datastore, there is almost no performance difference between shuting down a VM to the POWEROFF state and shutting it down to the UNDEPLOYED state. The only visible difference (for me) is that the POWEROFF VM is still assigned to the particular host, and its RAM is accounted to this host as occupied, even though it is not really used. Network leases are allocated for both types, and the handling of non-persistent images is also the same, as far as I can see.
My cluster is mostly memory-limited, so this not-so-correct RAM accounting is a problem for me. I would prefer if my users can disable their VMs using UNDEPLOY instead of POWEROFF. For them, there is no difference (except that “POWEROFF” sounds more familiar than “UNDEPLOY” to them, so given both options, they prefer POWEROFF).
I think a nice clean solution would be a configuration option to disable POWEROFF in Sunstone altogether,
and present only the UNDEPLOY option to users.
I plan to write a maintenance script to UNDEPLOY VMs which are in POWEROFF state for more than a day, but disabling POWEROFF is IMHO a better solution.
Well, it is not so easy as it looks - the user can still put the VM into the POWEROFF state by shutting it down from the inside. So a maintenance script for UNDEPLOYing the VMs in the POWEROFF state is still necessary.