azurerm_container_registry - Deprecated trust_policy_enabled

[magodo]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR deprecates the trust_policy_enabled for azurerm_container_registry. At least on new create request, if a user specified the trustPolicy=enabled, API raises the following error:

╷
│ Error: creating Registry (Subscription: "cb563ee9-7df0-468e-81d5-166968d1f89a"
│ Resource Group Name: "acctestRG-acrfoo"
│ Registry Name: "abcdefghij012321"): performing Create: unexpected status 400 (400 Bad Request) with error: ContentTrustUnsupported: The value 'enabled' for property 'status' in 'trustPolicy' is not supported. Content Trust is being deprecated and will be completely removed on March 31, 2028. Refer to https://aka.ms/acr/dctdeprecation for details and transition guidance.
│
│   with azurerm_container_registry.test,
│   on main.tf line 26, in resource "azurerm_container_registry" "test":
│   26: resource "azurerm_container_registry" "test" {
│

The change was made to avoid a (untested) case that any existing ACR can still update this trust_policy_enabled without an error. Therefore, we still keep the possibility to update it, while block it for new resource.

PR Checklist

• I have followed the guidelines in our Contributing Documentation.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
• I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
• I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
  For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevant documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

terraform-provider-azurerm acr_deprecate_trust_policy_enabled*​ ≡
❯ TF_ACC=1 go test -v -timeout=20h -run=TestAccContainerRegistry_ ./internal/ser
vices/containers
=== RUN   TestAccContainerRegistry_basic
=== PAUSE TestAccContainerRegistry_basic
=== RUN   TestAccContainerRegistry_requiresImport
=== PAUSE TestAccContainerRegistry_requiresImport
=== RUN   TestAccContainerRegistry_basicManagedStandard
=== PAUSE TestAccContainerRegistry_basicManagedStandard
=== RUN   TestAccContainerRegistry_basicManagedPremium
=== PAUSE TestAccContainerRegistry_basicManagedPremium
=== RUN   TestAccContainerRegistry_basic2Premium2basic
=== PAUSE TestAccContainerRegistry_basic2Premium2basic
=== RUN   TestAccContainerRegistry_complete
=== PAUSE TestAccContainerRegistry_complete
=== RUN   TestAccContainerRegistry_update
=== PAUSE TestAccContainerRegistry_update
=== RUN   TestAccContainerRegistry_geoReplicationLocation
=== PAUSE TestAccContainerRegistry_geoReplicationLocation
=== RUN   TestAccContainerRegistry_networkAccessProfileIp
=== PAUSE TestAccContainerRegistry_networkAccessProfileIp
=== RUN   TestAccContainerRegistry_networkAccessProfileUpdate
=== PAUSE TestAccContainerRegistry_networkAccessProfileUpdate
=== RUN   TestAccContainerRegistry_zoneRedundancy
=== PAUSE TestAccContainerRegistry_zoneRedundancy
=== RUN   TestAccContainerRegistry_geoReplicationZoneRedundancy
=== PAUSE TestAccContainerRegistry_geoReplicationZoneRedundancy
=== RUN   TestAccContainerRegistry_geoReplicationRegionEndpoint
=== PAUSE TestAccContainerRegistry_geoReplicationRegionEndpoint
=== RUN   TestAccContainerRegistry_anonymousPull
=== PAUSE TestAccContainerRegistry_anonymousPull
=== RUN   TestAccContainerRegistry_dataEndpoint
=== PAUSE TestAccContainerRegistry_dataEndpoint
=== RUN   TestAccContainerRegistry_networkRuleBypassOption
=== PAUSE TestAccContainerRegistry_networkRuleBypassOption
=== RUN   TestAccContainerRegistry_encryption
=== PAUSE TestAccContainerRegistry_encryption
=== CONT  TestAccContainerRegistry_basic
=== CONT  TestAccContainerRegistry_networkAccessProfileUpdate
=== CONT  TestAccContainerRegistry_complete
=== CONT  TestAccContainerRegistry_networkAccessProfileIp
=== CONT  TestAccContainerRegistry_basic2Premium2basic
=== CONT  TestAccContainerRegistry_basicManagedPremium
=== CONT  TestAccContainerRegistry_geoReplicationLocation
=== CONT  TestAccContainerRegistry_update
=== CONT  TestAccContainerRegistry_encryption
=== CONT  TestAccContainerRegistry_basicManagedStandard
=== CONT  TestAccContainerRegistry_requiresImport
=== CONT  TestAccContainerRegistry_anonymousPull
--- PASS: TestAccContainerRegistry_requiresImport (87.69s)
=== CONT  TestAccContainerRegistry_networkRuleBypassOption
--- PASS: TestAccContainerRegistry_basicManagedPremium (103.31s)
=== CONT  TestAccContainerRegistry_dataEndpoint
--- PASS: TestAccContainerRegistry_complete (105.14s)
=== CONT  TestAccContainerRegistry_geoReplicationZoneRedundancy
--- PASS: TestAccContainerRegistry_basic (108.64s)
=== CONT  TestAccContainerRegistry_geoReplicationRegionEndpoint
--- PASS: TestAccContainerRegistry_basicManagedStandard (108.65s)
=== CONT  TestAccContainerRegistry_zoneRedundancy
--- PASS: TestAccContainerRegistry_networkAccessProfileIp (131.81s)
--- PASS: TestAccContainerRegistry_networkAccessProfileUpdate (134.43s)
--- PASS: TestAccContainerRegistry_anonymousPull (153.72s)
--- PASS: TestAccContainerRegistry_basic2Premium2basic (167.04s)
--- PASS: TestAccContainerRegistry_update (186.95s)
--- PASS: TestAccContainerRegistry_zoneRedundancy (95.09s)
--- PASS: TestAccContainerRegistry_networkRuleBypassOption (140.35s)
--- PASS: TestAccContainerRegistry_dataEndpoint (139.58s)
--- PASS: TestAccContainerRegistry_geoReplicationZoneRedundancy (178.72s)
--- PASS: TestAccContainerRegistry_geoReplicationRegionEndpoint (176.28s)
--- PASS: TestAccContainerRegistry_encryption (290.64s)
--- PASS: TestAccContainerRegistry_geoReplicationLocation (486.73s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/containers	486.758s


❯ ARM_FIVEPOINTZERO_BETA=true TF_ACC=1 go test -v -timeout=20h -run=TestAccContainerRegistry_ ./internal/services/containers
=== RUN   TestAccContainerRegistry_basic
=== PAUSE TestAccContainerRegistry_basic
=== RUN   TestAccContainerRegistry_requiresImport
=== PAUSE TestAccContainerRegistry_requiresImport
=== RUN   TestAccContainerRegistry_basicManagedStandard
=== PAUSE TestAccContainerRegistry_basicManagedStandard
=== RUN   TestAccContainerRegistry_basicManagedPremium
=== PAUSE TestAccContainerRegistry_basicManagedPremium
=== RUN   TestAccContainerRegistry_basic2Premium2basic
=== PAUSE TestAccContainerRegistry_basic2Premium2basic
=== RUN   TestAccContainerRegistry_complete
=== PAUSE TestAccContainerRegistry_complete
=== RUN   TestAccContainerRegistry_update
=== PAUSE TestAccContainerRegistry_update
=== RUN   TestAccContainerRegistry_geoReplicationLocation
=== PAUSE TestAccContainerRegistry_geoReplicationLocation
=== RUN   TestAccContainerRegistry_networkAccessProfileIp
=== PAUSE TestAccContainerRegistry_networkAccessProfileIp
=== RUN   TestAccContainerRegistry_networkAccessProfileUpdate
=== PAUSE TestAccContainerRegistry_networkAccessProfileUpdate
=== RUN   TestAccContainerRegistry_zoneRedundancy
=== PAUSE TestAccContainerRegistry_zoneRedundancy
=== RUN   TestAccContainerRegistry_geoReplicationZoneRedundancy
=== PAUSE TestAccContainerRegistry_geoReplicationZoneRedundancy
=== RUN   TestAccContainerRegistry_geoReplicationRegionEndpoint
=== PAUSE TestAccContainerRegistry_geoReplicationRegionEndpoint
=== RUN   TestAccContainerRegistry_anonymousPull
=== PAUSE TestAccContainerRegistry_anonymousPull
=== RUN   TestAccContainerRegistry_dataEndpoint
=== PAUSE TestAccContainerRegistry_dataEndpoint
=== RUN   TestAccContainerRegistry_networkRuleBypassOption
=== PAUSE TestAccContainerRegistry_networkRuleBypassOption
=== RUN   TestAccContainerRegistry_encryption
=== PAUSE TestAccContainerRegistry_encryption
=== CONT  TestAccContainerRegistry_basic
=== CONT  TestAccContainerRegistry_networkAccessProfileUpdate
=== CONT  TestAccContainerRegistry_complete
=== CONT  TestAccContainerRegistry_basic2Premium2basic
=== CONT  TestAccContainerRegistry_basicManagedPremium
=== CONT  TestAccContainerRegistry_encryption
=== CONT  TestAccContainerRegistry_geoReplicationLocation
=== CONT  TestAccContainerRegistry_basicManagedStandard
=== CONT  TestAccContainerRegistry_requiresImport
=== CONT  TestAccContainerRegistry_anonymousPull
=== CONT  TestAccContainerRegistry_networkAccessProfileIp
=== CONT  TestAccContainerRegistry_networkRuleBypassOption
--- PASS: TestAccContainerRegistry_requiresImport (78.81s)
=== CONT  TestAccContainerRegistry_dataEndpoint
--- PASS: TestAccContainerRegistry_basic (95.96s)
=== CONT  TestAccContainerRegistry_update
--- PASS: TestAccContainerRegistry_basicManagedStandard (96.52s)
=== CONT  TestAccContainerRegistry_geoReplicationZoneRedundancy
--- PASS: TestAccContainerRegistry_basicManagedPremium (98.03s)
=== CONT  TestAccContainerRegistry_geoReplicationRegionEndpoint
--- PASS: TestAccContainerRegistry_complete (98.12s)
=== CONT  TestAccContainerRegistry_zoneRedundancy
--- PASS: TestAccContainerRegistry_networkAccessProfileUpdate (119.94s)
--- PASS: TestAccContainerRegistry_networkRuleBypassOption (139.88s)
--- PASS: TestAccContainerRegistry_anonymousPull (142.77s)
--- PASS: TestAccContainerRegistry_basic2Premium2basic (155.58s)
--- PASS: TestAccContainerRegistry_networkAccessProfileIp (171.11s)
--- PASS: TestAccContainerRegistry_zoneRedundancy (90.31s)
--- PASS: TestAccContainerRegistry_dataEndpoint (138.95s)
--- PASS: TestAccContainerRegistry_update (161.18s)
--- PASS: TestAccContainerRegistry_geoReplicationZoneRedundancy (164.87s)
--- PASS: TestAccContainerRegistry_geoReplicationRegionEndpoint (166.11s)
--- PASS: TestAccContainerRegistry_encryption (286.19s)
--- PASS: TestAccContainerRegistry_geoReplicationLocation (421.68s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/containers	421.701s

(Note the 5.0 test was run without the change added in #32260 as it introduced provider schema validation issue)

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• azurerm_resource - support for the thing1 property [GH-00000]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #0000

AI Assistance Disclosure

• AI Assisted - This contribution was made by, or with the assistance of, AI/LLMs

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.