azurerm_container_registry georeplications will be recreated when resource tags are updated

[sahangunathilaka]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.7

AzureRM Provider Version

3.6.9.0

Affected Resource(s)/Data Source(s)

azurerm_container_registry

Terraform Configuration Files

resource "azurerm_container_registry" "acr" {
  name                = "myacr"
  resource_group_name = "shared-rg"
  location            = "westeurope"
  tags                = { "project" = "project-js" }
  sku                 = "Premium"
  admin_enabled       = true

  dynamic "georeplications" {
    for_each = var.ENABLE_ACR_REPLICATION ? [1] : []
    content {
      location = "northeurope"
      tags     = { "project" = "project-js" }
    }
  }
}

variable "ENABLE_ACR_REPLICATION" {
  type    = bool
  default = true
}

Debug Output/Panic Output

╷
│ Error: applying geo replications for Registry (Subscription: "xxxxxxxxxxxxxxxxxxxxxxxx"
│ Resource Group Name: "shared-rg"
│ Registry Name: "myacr"): deleting Replication (Subscription: "xxxxxxxxxxxxxxxxxxxxxxxx"
│ Resource Group Name: "shared-rg"
│ Registry Name: "myacr"
│ Replication Name: "northeurope"): performing Delete: unexpected status 409 with error: ScopeLocked: The scope '/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/shared-rg/providers/Microsoft.ContainerRegistry/registries/myacr/replications/northeurope' cannot perform delete operation because following scope(s) are locked: '/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/shared-rg'. Please remove the lock and try again.
│ 
│   with azurerm_container_registry.acr,
│   on acr.tf line 1, in resource "azurerm_container_registry" "acr":
│    1: resource "azurerm_container_registry" "acr" {
│ 
╵

Expected Behaviour

It should just update tags in-place in the resources as shown in the Terraform plan. Plan does not say anything about recreating the geo-replication.

Actual Behaviour

Luckily, my geo-replication was not recreated due to the resource lock at the resource group level. As appeared in the error message, it tries to recreate the geo-replication.

Steps to Reproduce

1. Deploy ACR with geo-replications as per the shared resource declaration above.
2. Try to update the resource tag list in both primary and geo-replications. e.g. use the following tag list. tags = { "project" = "project-js" "owner" = "team-js" }
3. Deploy changes.

Important Factoids

No response

References

No response

[magodo]

@sahanruwanga Thank you for submitting this! In your step 3, could you please run terraform plan and send the plan output here? That shall indicate the reason why the ACR is to be recreated.

[sahangunathilaka]

@magodo, please see the plan output below. It doesn't tell me that it will recreate the geo-replication.

  # azurerm_container_registry.acr will be updated in-place
  ~ resource "azurerm_container_registry" "acr" {
        id                            = "/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/shared-rg/providers/Microsoft.ContainerRegistry/registries/myacr"
        name                          = "myacr"
      ~ tags                          = {
            "project" = "project-js"
          + "owner" = "team-js"
        }

      ~ georeplications {
          ~ tags                      = {
                "project" = "project-js"
              + "owner" = "team-js"
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.