Support Project Migration to New Organization

[bmertens-datum]

There’s currently no way to move a Project and its related resources (e.g. domain, proxy, gateway, connection, etc) from one Organization to another. As users adopt Datum or grow and wish to organize resources cleanly, there may be a need to transfer a Project and its resources to a new Organization. An example of this would be a from a personal org to a team/corporate org.

• When transferring a Project to a new Organization, the associated liability changes from one Organization (and its billing account) to another
• As such, the legacy Org Admin / Owner of the Project must initiate the request and the receiving Org Admin must approve and accept the request
• It is assumed, given the Datum data model, that resources exist within a Project and do not have dependencies outside of the Project. However, this must be validated for User permissions, IP addresses, inter-project services, etc

What should be movable?

Initial candidates:

• Complete Projects and all resources they hold

Proposed workflow

1. Org Admin select a Project → Transfer to New Organization
2. Org Admin enter the destination Organization UUID (which requires them to have obtained this outside of this flow). The system validates the UUID and displays the receiving Org name, email (maked) and asks the Org Admin to agree to the terms of the transfer.
3. The system then validates:
   • Quotas in the target project
   • Required features enabled
   • Dependency and relationship checks
4. Admin / Owner of receiving Organization receives an email and is taken to accept the Project transfer and its billing
5. Project is moved after acceptance.

Failure handling

• If validation fails, block the move with actionable errors.
• If the move fails mid-process, roll back to the original project.

Open questions

• Can Personal Projects be transferred?
• Which Projects cannot be moved due to dependencies, identity bindings, system-level constraints, or other limitations, if any?
• Should we support bulk moves?
• Should the UI provide a preview of what will change before moving?

Feedback welcome

Looking for input on scope, risks, and any resource types that need special handling.

[zsmithnyc]

It's worth looking at GCP's support for this here. They support migrating Resources within a project only through Service-specific migration tools, e.g. migrating a database or a virtual machine. I think this makes a ton of sense given the high about of logic that would need to be managed for each type of Resource.

[ecv]

I'm in the position of needing resources migrated to a different project in a different organization.

(Specifically, I've onboarded a couple domains to Datum, and they're in my work identity's personal organization. I'd like to be able to just transfer the Runtime/DNS record set, as well as (separately) the Assets/Domains. Currently working through how best to migrate them.)

I think resource migration (instead of project migration) makes great sense for the reasons Zac has said. I don't see a Discussion about an enhancement for resource migration. Should we create one, or should perhaps adjust the focus of Brett's enhancement here to treat a per-resource migration facility?

[scotwells]

A separate discussion for migrating DNS zones would make sense.