Flex unbrick

Unbrick an Azure Flex Consumption function app after a tenant security-policy sweep silently re-disables storage public network access (app 403/503s, PNA=Disabled). Runs the proven 2026-07-09 runbook — PNA check, SecurityControl=Ignore tag, re-enable PNA, full stop/start, bounded health poll.From its SKILL.md

Install

npx -y skills add kody-w/rapp-skills --skill flex-unbrick

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

10.7 KB, ~6.1k tokens by cl100k_base, as published. Nobody here has run it

flex-unbrick — the storage-PNA outage runbook as one verb

Root cause: a management-group policy silently flips the function app's storage account to publicNetworkAccess: Disabled, which kills Flex Consumption apps. The fix sequence was re-derived by hand once (169 az calls, 573-minute session) — this skill replays it.

1 — Diagnose (read-only, always first)

bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh check <app> <rg> <storage>

Prints subscription, storage PNA state, app state, live HTTPS probe, and a verdict line: HEALTHY / DEGRADED (classic PNA outage — fix applies) / DOWN-OTHER-CAUSE (probe failed but PNA already Enabled — fix will NOT help). The live probe is the truth: PNA=Disabled with a healthy probe is the private-endpoint deployment shape, NOT an outage. If HEALTHY, stop — do not fix.

2 — Fix (mutating; only on a DEGRADED verdict)

bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh fix <app> <rg> <storage>

Order matters and is encoded in the script:

SecurityControl=Ignore tag on the storage account (merge, keeps other tags) — without it the policy re-disables PNA again within hours.
--public-network-access Enabled on the storage account.
FULL az functionapp stop then start — restart does NOT re-bind Flex storage.
Bounded health poll (20 × 15 s). HTTP 401/404 counts as recovered — an auth layer may 404 without its client-id env var; the metal being up is what we're testing.

3 — Aftercare

If you have alert rules wired on the app (health check, app-down, storage-config-change), check them: a storage-config-change alert firing timestamps the policy sweep.
If the app is still down after the poll: the problem is NOT this policy — go read Function App logs instead of re-running fix.

Don'ts

Don't run fix without a check first, and never on a HEALTHY verdict.
Don't substitute az functionapp restart for stop/start.
Don't remove the SecurityControl=Ignore tag "to clean up" — it is the thing keeping the app alive.

Parameters

The typed contract this capability answers to (JSON Schema — the deterministic layer):

{
  "properties": {
    "app": {
      "description": "Derived from `<app>` used in the documented command at line 11.",
      "type": "string"
    },
    "rg": {
      "description": "Derived from `<rg>` used in the documented command at line 11.",
      "type": "string"
    },
    "storage": {
      "description": "Derived from `<storage>` used in the documented command at line 11.",
      "type": "string"
    }
  },
  "required": [],
  "type": "object"
}

Deterministic steps

Lifted verbatim from the procedure above by toaster.py toast. Run them in order, substituting the typed parameters; do not paraphrase:

az functionapp stop
az functionapp restart
bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh check <app> <rg> <storage>
bash ~/.claude/skills/flex-unbrick/scripts/unbrick.sh fix <app> <rg> <storage>

What ships with it: 2 files

17.5 KB alongside SKILL.md, 2 of them executable

scripts/

unbrick.shruns2.9 KB

flex_unbrick_agent.pyruns14.6 KB