Add --force flag to rad resource delete and rad app delete

Add a --force option to both 'rad resource delete' and 'rad app delete'
commands that allows users to delete resources stuck in non-terminal
provisioning states (e.g., Updating, Accepted).

Server-side: DefaultAsyncDelete reads a 'force' query parameter and
skips the provisioning state conflict check when force=true, while
still validating ETags and running delete filters.

Client-side: A forceDeletePolicy pipeline policy injects force=true
as a query parameter when the force option is set.

CLI: Both commands accept --force, display a warning about potential
orphaned external resources, and pass the flag through to the API.

Author: willdavsmith

pkg/armrpc/frontend/defaultoperation/defaultasyncdelete.go

@@ -42,6 +42,8 @@ func NewDefaultAsyncDelete[P interface {
 }
 
 // Run executes asynchronous delete operation by validating the request, executing custom delete filters, and starting async job, and returns an async response.
+// When the "force" query parameter is set to "true", the provisioning state check is skipped,
+// allowing deletion of resources stuck in non-terminal states (e.g., "Updating").
 func (e *DefaultAsyncDelete[P, T]) Run(ctx context.Context, w http.ResponseWriter, req *http.Request) (rest.Response, error) {
 	serviceCtx := v1.ARMRequestContextFromContext(ctx)
 	old, etag, err := e.GetResource(ctx, serviceCtx.ResourceID)
@@ -53,8 +55,16 @@ func (e *DefaultAsyncDelete[P, T]) Run(ctx context.Context, w http.ResponseWrite
 		return rest.NewNoContentResponse(), nil
 	}
 
-	if r, err := e.PrepareResource(ctx, req, nil, old, etag); r != nil || err != nil {
-		return r, err
+	force := req.URL.Query().Get("force") == "true"
+	if force {
+		// When force-deleting, skip the provisioning state check but still validate the ETag.
+		if err := ctrl.ValidateETag(*serviceCtx, etag); err != nil {
+			return rest.NewPreconditionFailedResponse(serviceCtx.ResourceID.String(), err.Error()), nil
+		}
+	} else {
+		if r, err := e.PrepareResource(ctx, req, nil, old, etag); r != nil || err != nil {
+			return r, err
+		}
 	}
 
 	for _, filter := range e.DeleteFilters() {

pkg/armrpc/frontend/defaultoperation/defaultasyncdelete_test.go

@@ -44,12 +44,16 @@ func TestDefaultAsyncDelete(t *testing.T) {
 		qErr             error
 		saveErr          error
 		rejectedByFilter bool
+		force            bool
 		code             int
 	}{
-		{"async-delete-non-existing-resource-no-etag", "", v1.ProvisioningStateNone, &database.ErrNotFound{}, nil, nil, false, http.StatusNoContent},
-		{"async-delete-existing-resource-blocked-by-filter", "", v1.ProvisioningStateSucceeded, nil, nil, nil, true, http.StatusConflict},
-		{"async-delete-existing-resource-not-in-terminal-state", "", v1.ProvisioningStateUpdating, nil, nil, nil, false, http.StatusConflict},
-		{"async-delete-existing-resource-success", "", v1.ProvisioningStateSucceeded, nil, nil, nil, false, http.StatusAccepted},
+		{"async-delete-non-existing-resource-no-etag", "", v1.ProvisioningStateNone, &database.ErrNotFound{}, nil, nil, false, false, http.StatusNoContent},
+		{"async-delete-existing-resource-blocked-by-filter", "", v1.ProvisioningStateSucceeded, nil, nil, nil, true, false, http.StatusConflict},
+		{"async-delete-existing-resource-not-in-terminal-state", "", v1.ProvisioningStateUpdating, nil, nil, nil, false, false, http.StatusConflict},
+		{"async-delete-existing-resource-success", "", v1.ProvisioningStateSucceeded, nil, nil, nil, false, false, http.StatusAccepted},
+		{"async-force-delete-existing-resource-in-updating-state", "", v1.ProvisioningStateUpdating, nil, nil, nil, false, true, http.StatusAccepted},
+		{"async-force-delete-existing-resource-in-accepted-state", "", v1.ProvisioningStateAccepted, nil, nil, nil, false, true, http.StatusAccepted},
+		{"async-force-delete-existing-resource-blocked-by-filter", "", v1.ProvisioningStateUpdating, nil, nil, nil, true, true, http.StatusConflict},
 	}
 
 	for _, tt := range deleteCases {
@@ -63,6 +67,12 @@ func TestDefaultAsyncDelete(t *testing.T) {
 			require.NoError(t, err)
 			req.Header.Set("If-Match", tt.etag)
 
+			if tt.force {
+				q := req.URL.Query()
+				q.Set("force", "true")
+				req.URL.RawQuery = q.Encode()
+			}
+
 			ctx := rpctest.NewARMRequestContext(req)
 			_, appDataModel, _ := loadTestResurce()
 
@@ -81,7 +91,7 @@ func TestDefaultAsyncDelete(t *testing.T) {
 				}, tt.getErr).
 				Times(1)
 
-			if tt.getErr == nil && !tt.rejectedByFilter && appDataModel.InternalMetadata.AsyncProvisioningState.IsTerminal() {
+			if tt.getErr == nil && !tt.rejectedByFilter && (appDataModel.InternalMetadata.AsyncProvisioningState.IsTerminal() || tt.force) {
 				expectedOptions := statusmanager.QueueOperationOptions{
 					OperationTimeout: asyncOperationTimeout,
 					RetryAfter:       asyncOperationRetryAfter,

pkg/cli/clients/clients.go

@@ -70,6 +70,8 @@ type DeleteOptions struct {
 	ProgressText string
 	// ProgressChan is a channel used to signal progress of the deletion operation.
 	ProgressChan chan<- ResourceProgress
+	// Force indicates whether to force delete resources that are in a non-terminal provisioning state.
+	Force bool
 }
 
 type ResourceStatus string
@@ -177,7 +179,8 @@ type ApplicationsManagementClient interface {
 	CreateOrUpdateResource(ctx context.Context, resourceType string, resourceNameOrID string, resource *generated.GenericResource) (generated.GenericResource, error)
 
 	// DeleteResource deletes a resource by its type and name (or id).
-	DeleteResource(ctx context.Context, resourceType string, resourceNameOrID string) (bool, error)
+	// When force is true, the delete will proceed even if the resource is in a non-terminal provisioning state.
+	DeleteResource(ctx context.Context, resourceType string, resourceNameOrID string, force bool) (bool, error)
 
 	// ListApplications lists all applications in the configured scope.
 	ListApplications(ctx context.Context) ([]corerp.ApplicationResource, error)
@@ -195,7 +198,8 @@ type ApplicationsManagementClient interface {
 	CreateApplicationIfNotFound(ctx context.Context, applicationNameOrID string, resource *corerp.ApplicationResource) error
 
 	// DeleteApplication deletes an application and all of its resources by its name (or id).
-	DeleteApplication(ctx context.Context, applicationNameOrID string) (bool, error)
+	// When force is true, resources in non-terminal provisioning states will be force-deleted.
+	DeleteApplication(ctx context.Context, applicationNameOrID string, force bool) (bool, error)
 
 	// ListEnvironments lists all environments in the configured scope (assumes configured scope is a resource group).
 	ListEnvironments(ctx context.Context) ([]corerp.EnvironmentResource, error)

pkg/cli/clients/management.go

@@ -178,7 +178,7 @@ func (amc *UCPApplicationsManagementClient) CreateOrUpdateResource(ctx context.C
 }
 
 // DeleteResource deletes a resource by its type and name (or id).
-func (amc *UCPApplicationsManagementClient) DeleteResource(ctx context.Context, resourceType string, resourceNameOrID string) (bool, error) {
+func (amc *UCPApplicationsManagementClient) DeleteResource(ctx context.Context, resourceType string, resourceNameOrID string, force bool) (bool, error) {
 	apiVersions, err := amc.getApiVersionsForResourceType(ctx, resourceType)
 	if err != nil {
 		return false, err
@@ -189,7 +189,12 @@ func (amc *UCPApplicationsManagementClient) DeleteResource(ctx context.Context,
 		return false, err
 	}
 
-	client, err := amc.getGenericClient(scope, resourceType, apiVersions)
+	var client genericResourceClient
+	if force {
+		client, err = amc.getGenericClientWithForce(scope, resourceType, apiVersions)
+	} else {
+		client, err = amc.getGenericClient(scope, resourceType, apiVersions)
+	}
 	if err != nil {
 		return false, err
 	}
@@ -357,7 +362,7 @@ func (amc *UCPApplicationsManagementClient) CreateApplicationIfNotFound(ctx cont
 }
 
 // DeleteApplication deletes an application and all of its resources by its name (or id).
-func (amc *UCPApplicationsManagementClient) DeleteApplication(ctx context.Context, applicationNameOrID string) (bool, error) {
+func (amc *UCPApplicationsManagementClient) DeleteApplication(ctx context.Context, applicationNameOrID string, force bool) (bool, error) {
 	scope, name, err := amc.extractScopeAndName(applicationNameOrID)
 	if err != nil {
 		return false, err
@@ -373,7 +378,7 @@ func (amc *UCPApplicationsManagementClient) DeleteApplication(ctx context.Contex
 	g, groupCtx := errgroup.WithContext(ctx)
 	for _, resource := range resources {
 		g.Go(func() error {
-			_, err := amc.DeleteResource(groupCtx, *resource.Type, *resource.ID)
+			_, err := amc.DeleteResource(groupCtx, *resource.Type, *resource.ID, force)
 			if err != nil && !clientv2.Is404Error(err) {
 				return err
 			}
@@ -641,7 +646,7 @@ func (amc *UCPApplicationsManagementClient) DeleteEnvironment(ctx context.Contex
 	}
 
 	for _, application := range applications {
-		_, err := amc.DeleteApplication(ctx, *application.ID)
+		_, err := amc.DeleteApplication(ctx, *application.ID, false)
 		if err != nil {
 			return false, err
 		}
@@ -748,7 +753,7 @@ func (amc *UCPApplicationsManagementClient) DeleteResourceGroup(ctx context.Cont
 		for _, resource := range resources {
 			g.Go(func() error {
 				// Delete each resource using its full ID to ensure correct scope
-				_, err := amc.DeleteResource(groupCtx, *resource.Type, *resource.ID)
+				_, err := amc.DeleteResource(groupCtx, *resource.Type, *resource.ID, false)
 				if err != nil && !clientv2.Is404Error(err) {
 					return err
 				}
@@ -1397,3 +1402,39 @@ func (amc *UCPApplicationsManagementClient) getGenericClient(scope, resourceType
 
 	return client, err
 }
+
+// getGenericClientWithForce creates a generic client with a per-call policy that appends
+// the force=true query parameter to the request URL. This is used for force-deleting
+// resources that are in a non-terminal provisioning state.
+func (amc *UCPApplicationsManagementClient) getGenericClientWithForce(scope, resourceType string, apiVersions []string) (client genericResourceClient, err error) {
+	if amc.genericResourceClientFactory != nil {
+		return amc.genericResourceClientFactory(scope, resourceType)
+	}
+
+	clientOptions := *amc.ClientOptions
+	clientOptions.PerCallPolicies = append(
+		append([]policy.Policy{}, clientOptions.PerCallPolicies...),
+		&forceDeletePolicy{},
+	)
+
+	if strings.HasPrefix(resourceType, "Radius.Core") {
+		apiVersions = []string{"2025-08-01-preview"}
+	}
+
+	if len(apiVersions) != 0 {
+		clientOptions.APIVersion = apiVersions[0]
+	}
+
+	return generated.NewGenericResourcesClient(resourceType, strings.TrimPrefix(scope, resources.SegmentSeparator), &aztoken.AnonymousCredential{}, &clientOptions)
+}
+
+// forceDeletePolicy is a per-call pipeline policy that appends force=true to the request URL query string.
+type forceDeletePolicy struct{}
+
+func (p *forceDeletePolicy) Do(req *policy.Request) (*http.Response, error) {
+	rawReq := req.Raw()
+	q := rawReq.URL.Query()
+	q.Set("force", "true")
+	rawReq.URL.RawQuery = q.Encode()
+	return req.Next()
+}

pkg/cli/clients/management_test.go

@@ -662,7 +662,7 @@ func Test_Resource(t *testing.T) {
 			BeginDelete(gomock.Any(), testResourceName, gomock.Any()).
 			Return(poller(&generated.GenericResourcesClientDeleteResponse{}), nil)
 
-		deleted, err := client.DeleteResource(context.Background(), testResourceType, testResourceID)
+		deleted, err := client.DeleteResource(context.Background(), testResourceType, testResourceID, false)
 		require.NoError(t, err)
 		require.True(t, deleted)
 	})
@@ -968,7 +968,7 @@ func Test_Application(t *testing.T) {
 				return corerp.ApplicationsClientDeleteResponse{}, nil
 			})
 
-		deleted, err := client.DeleteApplication(context.Background(), testResourceID)
+		deleted, err := client.DeleteApplication(context.Background(), testResourceID, false)
 		require.NoError(t, err)
 		require.True(t, deleted)
 	})
@@ -1048,7 +1048,7 @@ func Test_Application(t *testing.T) {
 				return corerp.ApplicationsClientDeleteResponse{}, nil
 			})
 
-		deleted, err := client.DeleteApplication(context.Background(), testResourceID)
+		deleted, err := client.DeleteApplication(context.Background(), testResourceID, false)
 		require.NoError(t, err)
 		require.True(t, deleted)
 	})
@@ -1087,7 +1087,7 @@ func Test_Application(t *testing.T) {
 		// Delete should NOT be called when ListResourcesInApplication fails with non-404 error
 		// No expectation set for mock.Delete()
 
-		deleted, err := client.DeleteApplication(context.Background(), testResourceID)
+		deleted, err := client.DeleteApplication(context.Background(), testResourceID, false)
 		require.Error(t, err)
 		require.False(t, deleted)
 		// Verify the error is propagated correctly

pkg/cli/clients/mock_applicationsclient.go

@@ -65,6 +65,9 @@ rad app delete my-app
 
 # Delete specified application in a specified resource group
 rad app delete my-app --group my-group
+
+# Force delete an application with resources stuck in a non-terminal state
+rad app delete my-app --force
 `,
 		Args: cobra.MaximumNArgs(1),
 		RunE: framework.RunCommand(runner),
@@ -74,6 +77,7 @@ rad app delete my-app --group my-group
 	commonflags.AddResourceGroupFlag(cmd)
 	commonflags.AddApplicationNameFlag(cmd)
 	commonflags.AddConfirmationFlag(cmd)
+	commonflags.AddForceFlag(cmd)
 
 	return cmd, runner
 }
@@ -90,6 +94,7 @@ type Runner struct {
 	EnvironmentName string
 	Scope           string
 	Confirm         bool
+	Force           bool
 	Workspace       *workspaces.Workspace
 }
 
@@ -148,6 +153,11 @@ func (r *Runner) Validate(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	r.Force, err = cmd.Flags().GetBool("force")
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -191,9 +201,14 @@ func (r *Runner) Run(ctx context.Context) error {
 
 	progressText := fmt.Sprintf("Deleting application '%s' from environment '%s'...", r.ApplicationName, r.EnvironmentName)
 
+	if r.Force {
+		r.Output.LogInfo("WARNING: Force deleting an application. Resources in non-terminal states may leave orphaned external resources that require manual cleanup.")
+	}
+
 	deleted, err := r.Delete.DeleteApplicationWithProgress(ctx, client, clients.DeleteOptions{
 		ApplicationNameOrID: r.ApplicationName,
 		ProgressText:        progressText,
+		Force:               r.Force,
 	})
 	if err != nil {
 		if strings.Contains(err.Error(), "not found") {

pkg/cli/cmd/app/delete/delete.go

@@ -70,6 +70,11 @@ func AddConfirmationFlag(cmd *cobra.Command) {
 	cmd.Flags().BoolP("yes", "y", false, "The confirmation flag")
 }
 
+// AddForceFlag adds a flag to the given command that allows the user to force an operation even when the resource is in a non-terminal state.
+func AddForceFlag(cmd *cobra.Command) {
+	cmd.Flags().Bool("force", false, "Force the operation even if the resource is in a non-terminal provisioning state")
+}
+
 // AddEnvironmentNameFlag adds a flag to the given command that allows the user to specify an environment name.
 func AddEnvironmentNameFlag(cmd *cobra.Command) {
 	cmd.Flags().StringP("environment", "e", "", "The environment name")