Deleting PPC

Steps to delete the cluster

Prerequisites

Authentication

The deletion process uses OpenTofu to destroy Azure resources, such as AKS clusters, managed identities, storage accounts, and Key Vaults. The Azure CLI must be authenticated to perform these operations.

Note: While using temporary credentials, such as service principal tokens or managed identity tokens, ensure that the credentials have not expired before proceeding.

To authenticate and set the correct subscription, run the following commands.

az login
az account set --subscription <subscription-id>

To verify that the credentials are valid and the correct Azure subscription is being used, run the following command.

az account show

Required Resource Providers

The following Azure resource providers must be registered in the subscription before deletion can proceed. If any provider is missing, the destroy operation may fail when attempting to manage the associated resources.

Microsoft.ContainerService
Microsoft.Storage
Microsoft.KeyVault
Microsoft.ManagedIdentity
Microsoft.Network
Microsoft.Compute

Required permissions

The following permissions are required to delete the PPC cluster. Create a custom role with these permissions and assign it to the managed identity used for deletion.

{
  "Name": "<ROLE-NAME>",
  "Description": "",
  "AssignableScopes": [
    "/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP>"
  ],
  "Actions": [
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.ContainerService/managedClusters/read",
    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.ContainerService/managedClusters/agentPools/read",
    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
    "Microsoft.ContainerService/managedClusters/agentPools/delete",
    "Microsoft.ContainerService/managedClusters/delete",
    "Microsoft.Storage/storageAccounts/blobServices/read",
    "Microsoft.Storage/storageAccounts/fileServices/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/write",
    "Microsoft.Authorization/roleAssignments/delete",
    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
    "Microsoft.KeyVault/vaults/delete",
    "Microsoft.KeyVault/vaults/read",
    "Microsoft.Storage/storageAccounts/delete"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": []
}

To create the custom role and assign it to the managed identity, follow the steps in AKS User-Assigned Managed Identity Permissions.

Required tools

The following tools must be installed and available on the machine before proceeding with deletion:

tofu (OpenTofu)
kubectl (configured with cluster context)
az CLI (authenticated)
helm

Cleaning up the AKS Resources

There are two ways to destroy all created resources, including the AKS cluster and related components.

Method 1: Using the bootstrap script

From the folder where bootstrap script is present, run the following command:

./bootstrap.sh --cloud azure destroy

Method 2: Using OpenTofu to delete all modules

This method displays how to delete a PPC cluster on Azure by destroying the OpenTofu modules in reverse order. Destroying modules one at a time gives full control and visibility over each stage.

Warning: This process is irreversible. All cluster resources, data, and backups stored in the backup storage will be permanently deleted.

The modules are located at:

~/iac/azure/cluster/modules/
├── 00_backup_storage
├── 01_identity
├── 02_aks_cluster
├── 03_node_pool
├── 04_aks_addons
└── 05_helm_releases

These modules must be destroyed in reverse order: 05 → 04 → 03 → 02 → 01 → 00.

To delete the modules, perform the following steps:

To delete the helm releases resource, run the following command.

# Navigate to 05_helm_releases directory
cd /iac/azure/cluster/modules/05_helm_releases

# Initialize providers
tofu init  

# Delete the helm release
tofu destroy        # type "yes" when prompted

To delete the AKS Addons resource, run the following command.

# Navigate to 04_aks_addons directory
cd /iac/azure/cluster/modules/04_aks_addons

# Initialize providers
tofu init 

# Delete the aks addons
tofu destroy        # type "yes" when prompted

To delete the Node Pool resource, run the following command.

# Navigate to 03_node_pool directory
cd /iac/azure/cluster/modules/03_node_pool

# Initialize providers
tofu init 

# Delete the node pool
tofu destroy        # type "yes" when prompted

To delete the AKS Cluster resource, run the following command.

# Navigate to 02_aks_cluster directory
cd /iac/azure/cluster/modules/02_aks_cluster

# Initialize providers
tofu init 

# Delete the aks cluster
tofu destroy        # type "yes" when prompted

To delete the Identity resource, run the following command.

# Navigate to 01_identity directory
cd /iac/azure/cluster/modules/01_identity

# Initialize providers
tofu init 

# Delete the identity
tofu destroy        # type "yes" when prompted

To delete the Backup Storage (Backup storage account + container) resource, run the following command.

# Navigate to 00_backup_storage directory
cd /iac/azure/cluster/modules/00_backup_storage

# Initialize providers
tofu init 

# Destroy all resources (Storage Account, Key Vault, container, encryption key)
tofu destroy        # type "yes" when prompted

Feedback

Was this page helpful?

Last modified : July 29, 2026