feat: add l8k clean command

[almaslennikov]

Summary

• add l8k clean with kubeconfig, user-config, operator namespace, and --keep-helm-chart support
• resolve the destructive target only from an explicit flag, trusted local config, or the standard namespace default; in-cluster objects never select it
• dynamically delete every namespaced custom resource in the target namespace, remove the five known cluster-scoped Network Operator resource kinds, sweep resources recreated during teardown, and uninstall Helm last
• preserve the namespace, CRDs, unrelated Secrets, local deployment files, and namespaced custom resources elsewhere
• expose structured cleanup results and document the command for operators, automation, and the bundled AI skills

Safety and idempotency

The command resolves the full initial CR deletion set before mutating the cluster, waits for finalizers while controllers are still installed, and treats missing CRDs, resources, and Helm releases as successful no-ops. Text mode requires confirmation; JSON mode follows the existing subcommand convention and auto-confirms. --keep-helm-chart skips Helm uninstall without narrowing CR cleanup.

Custom installation namespaces must be passed explicitly or recorded in trusted local config. Cleanup does not trust user-creatable Helm release Secrets to choose its target.

Validation

• go test ./... -count=1 -skip TestGetPresetsDir_(NotFound|SkipsFiles)
• go test -race ./pkg/networkoperatorplugin ./pkg/cmd ./pkg/ui
• go vet ./...
• golangci-lint v2 run ./... (0 issues)
• mkdocs build --strict --clean
• cleanup skill quick validation
• l8k clean --help and l8k schema smoke checks

No live cluster cleanup was run as part of development.

[greptile-apps]

Greptile Summary

The PR adds the destructive l8k clean workflow for removing Network Operator custom resources before optionally uninstalling its Helm release.

• Resolves the target namespace from explicit or local configuration, with a standard fallback.
• Deletes namespaced and known cluster-scoped custom resources while controllers remain installed to process finalizers.
• Adds structured cleanup output, command schema, tests, operator documentation, and AI-agent guidance.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported attacker-controlled Helm Secret namespace-selection path has been removed.

Important Files Changed

Filename	Overview
pkg/cmd/clean.go	Adds command orchestration, trusted namespace resolution, confirmation, structured errors, and JSON result finalization.
pkg/networkoperatorplugin/clean.go	Implements ordered discovery, deletion, finalizer waiting, repeated cleanup sweeps, and optional Helm uninstall.
pkg/networkoperatorplugin/helm.go	Extends Helm integration with idempotent release uninstallation and resource-removal waiting.
pkg/ui/json_output.go	Adds the structured cleanup result to the existing JSON command contract.
docs/user/cleanup.md	Documents namespace precedence, deletion boundaries, retained resources, Helm preservation, and automation behavior.
skills/k8s-launch-kit-clean/SKILL.md	Adds agent guidance and safety checks for the destructive cleanup command.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[l8k clean] --> B[Resolve kubeconfig]
  B --> C[Resolve namespace from flag or local config]
  C --> D[Confirm destructive cleanup]
  D --> E[List namespaced custom resources]
  E --> F[List known cluster-scoped resources]
  F --> G[Delete resources and wait for finalizers]
  G --> H[Re-scan and delete recreated resources]
  H --> I{keep-helm-chart?}
  I -->|Yes| J[Keep Helm release]
  I -->|No| K[Uninstall Helm release]
  J --> L[Emit cleanup result]
  K --> L

Loading

_{Reviews (2): Last reviewed commit: "fix: require a trusted cleanup namespace" | Re-trigger Greptile}