Sub-sequent calls to terraform plan or terraform apply against an already provisioned cluster recreates the ACR pull role assignment for the Managed Identity.
The added query section is merely there to create an implicit dependency between the cluster resource and the msi_object_id resource which will move the read from the apply-phase to the plan phase where it will evaluate to a non-changed value.
Sub-sequent calls to
terraform plan
orterraform apply
against an already provisioned cluster recreates the ACR pull role assignment for the Managed Identity.As per the discussion over at https://github.com/hashicorp/terraform/issues/22005 this fix will mitigate that behaviour.
The added
query
section is merely there to create an implicit dependency between the cluster resource and the msi_object_id resource which will move the read from the apply-phase to the plan phase where it will evaluate to a non-changed value.