From 62c36d6f121373253c059a3e26ea936713612a5b Mon Sep 17 00:00:00 2001
From: Aditya Shantanu <aditya-shantanu@users.noreply.github.com>
Date: Wed, 2 Sep 2026 10:39:40 -0700
Subject: [PATCH] teardown.sh: cover everything bootstrap creates, without a
 dev-env file

- Revoke atelet's project-level bindings (roles/storage.objectAdmin and
  roles/artifactregistry.reader for the workload-identity principal),
  which grant_atelet_permissions adds but nothing removed.
- Delete the three Substrate monitoring dashboards, matched by the
  display names in tools/setup-gcp/dashboards/.
- Accept configuration from the environment when .ate-dev-env.sh is
  absent, so installers and one-liners can drive the script, and fail
  with the specific missing variable instead of a blanket message.
- Drop the kubectl cluster-admin precheck: every step talks to GCP, not
  the cluster, and the check blocked tearing down a cluster that was
  already gone or unreachable.
- Make --all run in the true reverse of bootstrap's setup order.
---
 hack/teardown.sh | 67 ++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 57 insertions(+), 10 deletions(-)

diff --git a/hack/teardown.sh b/hack/teardown.sh
index 2f0258de65..d472b7ccbb 100755
--- a/hack/teardown.sh
+++ b/hack/teardown.sh
@@ -16,29 +16,35 @@
 
 set -o errexit -o nounset -o pipefail
 
-# Source the environment variables
+# Source the environment variables. The file is optional: an installer (or a
+# user pasting a one-liner) can pass the same variables through the
+# environment instead, which also makes teardown possible on a machine that
+# never had a dev-env file.
 if [ -f .ate-dev-env.sh ]; then
   source .ate-dev-env.sh
-else
-  echo "Please create .ate-dev-env.sh from the example file in hack"
-  exit 1
 fi
-
-# Precheck for cluster-admin permissions
-kubectl auth can-i delete crd 2>/dev/null | grep -q yes || {
-    echo "teardown requires cluster-admin on the GKE cluster" >&2
+for var in PROJECT_ID PROJECT_NUMBER CLUSTER_NAME CLUSTER_LOCATION BUCKET_NAME NODE_POOL_NAME; do
+  if [ -z "${!var:-}" ]; then
+    echo "${var} is not set; export it or create .ate-dev-env.sh from the example file in hack" >&2
     exit 1
-}
+  fi
+done
+
+# No cluster-admin precheck here: every step below talks to GCP, not to the
+# cluster, and requiring a live kubectl context would block tearing down a
+# cluster that is already half-gone.
 
 # --- Helper Functions ---
 function usage() {
   echo "Usage: $0 [options]"
   echo "Options:"
   echo "  --revoke-gke-node-permissions         Revoke GKE nodes permission to pull images"
+  echo "  --revoke-atelet-permissions           Revoke atelet's project-level IAM bindings"
   echo "  --delete-iam-policy-bindings          Delete IAM policy bindings for atelet"
   echo "  --delete-snapshot-bucket              Delete snapshot bucket"
   echo "  --delete-gvisor-node-pool             Delete gVisor node pool"
   echo "  --delete-cluster                      Delete GKE cluster"
+  echo "  --delete-dashboards                   Delete the Substrate monitoring dashboards"
   echo "  --all                                 Run all teardown steps (reverse order of setup)"
   exit 1
 }
@@ -60,6 +66,43 @@ revoke_gke_node_permissions() {
     --quiet || true
 }
 
+# Revoke Atelet's project-level bindings (Reverse of grant_atelet_permissions)
+revoke_atelet_permissions() {
+  echo "Revoking atelet project-level permissions..."
+  local member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${PROJECT_ID}.svc.id.goog/subject/ns/ate-system/sa/atelet"
+  gcloud projects remove-iam-policy-binding "${PROJECT_ID}" \
+    --member="${member}" \
+    --role="roles/storage.objectAdmin" \
+    --condition=None \
+    --quiet || true
+  gcloud projects remove-iam-policy-binding "${PROJECT_ID}" \
+    --member="${member}" \
+    --role="roles/artifactregistry.reader" \
+    --condition=None \
+    --quiet || true
+}
+
+# Delete Monitoring Dashboards (Reverse of create_monitoring_dashboards)
+delete_dashboards() {
+  echo "Deleting Substrate monitoring dashboards..."
+  # Matched by display name, since setup only records names in its JSON.
+  local names=(
+    "Substrate Snapshot Size & QPS"
+    "Substrate Routing & E2E Latency"
+    "Substrate gRPC Server — latency / QPS / errors"
+  )
+  for display_name in "${names[@]}"; do
+    for dashboard in $(gcloud monitoring dashboards list \
+        --project="${PROJECT_ID}" \
+        --filter="displayName=\"${display_name}\"" \
+        --format="value(name)" 2>/dev/null); do
+      gcloud monitoring dashboards delete "${dashboard}" \
+        --project="${PROJECT_ID}" \
+        --quiet || true
+    done
+  done
+}
+
 # Delete IAM Policy Bindings for Bucket (Reverse of create_iam_policy_bindings)
 delete_iam_policy_bindings() {
   echo "Deleting IAM policy bindings for bucket..."
@@ -107,13 +150,17 @@ fi
 while [[ "$#" -gt 0 ]]; do
   case $1 in
     --revoke-gke-node-permissions) revoke_gke_node_permissions ;;
+    --revoke-atelet-permissions) revoke_atelet_permissions ;;
     --delete-iam-policy-bindings) delete_iam_policy_bindings ;;
     --delete-snapshot-bucket) delete_snapshot_bucket ;;
     --delete-gvisor-node-pool) delete_gvisor_node_pool ;;
     --delete-cluster) delete_cluster ;;
+    --delete-dashboards) delete_dashboards ;;
     --all)
-      revoke_gke_node_permissions
+      delete_dashboards
       delete_iam_policy_bindings
+      revoke_atelet_permissions
+      revoke_gke_node_permissions
       delete_snapshot_bucket
       delete_gvisor_node_pool
       delete_cluster