Azure Synapse Workspace - once 'WorkspaceRepositoryConfiguration' is attached, terraform updates to remove it does not get actioned

[sharccc]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.4.6

AzureRM Provider Version

3.67.0

Affected Resource(s)/Data Source(s)

azurerm_synapse_workspace

Terraform Configuration Files

resource "azurerm_storage_account" "sample" {
  name                     = var.sample_name
  resource_group_name      = azurerm_resource_group.sample.name
  location                 = azurerm_resource_group.sample.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  account_kind             = "StorageV2"
  is_hns_enabled           = "true"
}

resource "azurerm_storage_data_lake_gen2_filesystem" "sample" {
  name               = var.sample_name
  storage_account_id = azurerm_storage_account.sample.id
}

resource "azurerm_synapse_workspace" "sample" {
  name                                 = var.sample_name
  resource_group_name                  = azurerm_resource_group.sample.name
  location                             = azurerm_resource_group.sample.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.sample.id
  sql_administrator_login              = var.admin_username
  sql_administrator_login_password     = var.admin_password

  identity {
    type = "SystemAssigned"
  }

  /*
  azure_devops_repo {
    account_name    = var.azdo_account_name
    project_name    = var.azdo_project_name
    repository_name = var.azdo_repo_name
    branch_name     = var.azdo_branch_name
    root_folder     = "/"
    tenant_id       = var.tenant_id
  }
  */

  tags = {
    Env = "reproduction"
  }
}

Debug Output/Panic Output

from terraform plan -->
     azurerm_synapse_workspace.sample
      - azure_devops_repo {
          - account_name    = "<redacted>" -> null
          - branch_name     = "main" -> null
          - last_commit_id  = "<redacted>" -> null
          - project_name    = "<redacted>" -> null
          - repository_name = "<redacted>" -> null
          - root_folder     = "/" -> null
          - tenant_id       = "<redacted>" -> null
        }

Expected Behaviour

removing the azure_devops_repo block from the azurerm_synapse_workspace terraform configuration, should 'disconnect' the repo from the workspace on Azure.

Actual Behaviour

removing the azure_devops_repo block from the azurerm_synapse_workspace terraform configuration, does not 'disconnect' the repo from the workspace on Azure.

azure_devops_repo maps to workspaceRepositoryConfiguration in the API call.

a ticket raised with Microsoft suggested an empty map is required to delete these attributes. { "properties": { "workspaceRepositoryConfiguration": {} } }

it looks like terraform currently sends a nil for that object if it’s not present

Steps to Reproduce

first - create azure_synapse_workspace with optional azure_devops_repo included

1. terraform apply
2. check azure
   • can see devops repo attached to synapse workspace

next - remove azure_devops_repo block from azure_synapse_workspace configuration

1. terrafrom plan shows attributes will be removed
2. terrafrom apply
3. check azure
   • can devops repo still attached to synapse workspace

cross-check - 'disconnect' the git configuration from the workspace using the portal - is removed

Checked Azure using API: GET https://learn.microsoft.com/en-us/rest/api/synapse/workspaces/get?tabs=HTTP#code-try-0 or from Azure portal --> synapse studio > management > source control -> git configuration

Important Factoids

No response

References

provider v3.67.0 calls version 2021-06-01 Azure API specs - version 2021-06-01, the attribute workspaceRepositoryConfiguration is optional, as opposed to required with an empty map

[sharccc]

HashiCorp internal reference IPL-4707 (Terraform Support)

[harsh-vm]

I'm seeing this issue as well.

Additionally, following behaviour was observed:

1. Disconnected the git config manually from UI.
2. Ran terraform plan again against the synapse workspace resource (that doesn't have azure_devops_repo block). The plan still shows it needs to remove the git config as the block is retained in the tfstate file!

[danielkwok72]

Hi there

Is there an update on this issue? Is Hashicorp looking into this bugfix in the upcoming releases? The issue has been raised for 6 months and I hope code fix is in progress and there will be a release soon.

Thank you