(feature) The orgadm command should include remove/delete functionality

[nkinkade]

The orgadm command creates numerous resources in GCP (service account, datastore entity, secret, etc.). Sometimes if may be necessary to remove an organization and all the resources associated with it. Today, it is necessary to manually delete each of the separate resources created by orgadm. It would be nice if this utility included a flag or option to be able to delete all resources associated with a given org name.

[mahmoudnasser1561]

Hi @nkinkade — I’d like to help on this (happy to coordinate with @robertodauria since it’s assigned).

I traced the setup path end-to-end (cmd/orgadm/main.go -> internal/adminx/* + internal/dnsx/register.go + token-exchange/store/autojoin.go) and here’s the reverse mapping:

• Datastore Organization/<org> (namespace platform-credentials) -> delete org entity (after children).
• Datastore child APIKey/<apiKeyValue> under Organization/<org> -> delete all APIKey children for <org>.
• Service account autonode-<org> (autonode-<org>@<project>.iam.gserviceaccount.com) -> delete SA.
• Secret Manager autojoin-serviceaccount-key-<org> -> delete secret.
• DNS managed zone autojoin-<org>-<trimPrefix(project,"mlab-")>-measurement-lab-org -> delete managed zone.
• Parent-zone NS split at <org>.<trimPrefix(project,"mlab-")>.measurement-lab.org. in zone autojoin-<trimPrefix(project,"mlab-")>-measurement-lab-org -> delete that NS RRSet.
• Two conditional IAM bindings (upload/read) for serviceAccount:<autonode email> -> remove only those exact bindings.

Safety/UX: I will add -delete, -dry-run, -force (no prompts). Strict idempotency: treat NotFound as success and continue; -dry-run prints the ordered plan and exits 0.

Proposed deletion order: NS split RRSet → org managed zone → secret → IAM bindings → service account → Datastore APIKeys → Datastore org entity (prevents dangling DNS delegation + avoids removing unrelated IAM).

Testing: I will use existing fakes (fakeDNS, fakeCRM, fakeIAMService, fakeSMC, fakeOrgManager) and add targeted delete tests: full happy-path, idempotent rerun with missing resources, IAM cleanup removes only the intended bindings, DNS split missing while zone exists.

If that direction matches expectations, I’ll open a draft PR with the CLI wiring + core delete path first, then iterate quickly on edge cases from feedback.

[robertodauria]

@mahmoudnasser1561 All of that seems reasonable to me. I have not started working on this, so if it's something interesting to you feel free to make the changes and open a PR, I'll review it. Thanks!

[mahmoudnasser1561]

I’m definitely interested and will get started.

[mahmoudnasser1561]

Hi @robertodauria
I have drafted a PR for review whenever you have time.
Would love to hear you feedback.