Skip to content

Redeploy Azure App

Delete and recreate one Azure IRE dev app — the Kuiper or System Pulse VM together with its Azure SQL database — fresh and empty, via the Terraform apply workflow.

Invoke by asking Claude (e.g. "rebuild the Kuiper machine on Azure") or with /redeploy-azure-app. This is destructive — Claude confirms which app before running.

Destructive and dev-only

This deletes a VM, its disks, and a SQL database in the Azure IRE dev environment. It is not for production and not for AWS. The recreated VM is not domain-joined and the database is empty — by design.

When to use

When you need a clean-slate Kuiper or System Pulse instance in Azure IRE dev — wiping accumulated state to reproduce a greenfield deployment, or recovering from a broken instance. It deliberately stops once the new VM answers WinRM: no domain join, no SQL user, no application install. Those follow-up steps are a separate procedure (see the reference below).

What it does

The skill runs .claude/skills/redeploy-azure-app/redeploy.sh <app> (kuiper → azcusikpr001 + Kuiper DB; systempulse → azcusisp001 + SystemPulse DB). End-to-end ~10 minutes, in order:

  1. Remove the AADDS computer object (from a different host than the one being deleted).
  2. Delete the VM + OS/data disks. The NIC is kept so Terraform reuses it and the private IP is stable.
  3. Delete the database's diagnostic settings, then the database (the diagnostic settings orphan and would block recreation otherwise).
  4. Trigger the terraform-apply-dev-6am.yml workflow and wait for it to conclude.
  5. Poll win_ping until the new VM answers WinRM.

Steps 1–3 are idempotent — re-running after a partial failure skips what's already gone.

Prerequisites

  • The Azure venv (source ~/venv/azure/bin/activate), run from the repo root — the driver forces ANSIBLE_CONFIG=./ansible-azure.cfg itself.
  • An Azure session with delete rights on the ire-* resource groups. In the Coder workspace the container's managed identity normally holds the IRE Contributor role, so no interactive login is needed; the fallback is az login --use-device-code.
  • GH_TOKEN with workflow-dispatch rights on the Terraform repo — the driver fetches a short-lived one automatically in the Coder workspace.

Known pitfalls (the skill handles these; good to recognize)

  • Diagnostic-settings orphan — Azure keeps a database's diagnostic settings after deletion; they re-attach to the recreated DB and fail the apply. Step 3 deletes them first.
  • AuthorizationFailed on VM delete — the nightly destroy removes the RG-scoped role assignments until the next apply recreates them; re-run the apply or log in as yourself.
  • Coder GitHub tokens expire mid-run — minting a new token invalidates the old, so the driver re-fetches before every gh call.
  • The first Terraform pass routinely fails on greenfield AADDS races; the workflow has a built-in second pass.

Reference

Follow-up steps to actually deploy the app (domain join, SQL user, install): the Delete and Redeploy Instances (Azure IRE) section of Tips and Tricks. Driver and full details: .claude/skills/redeploy-azure-app/.