v2.7.0

The v2.7.0 release introduces the Terraform provider upgrade, new resources, bug fixes, enhancements, and dependency updates.

• Upgrade of the underlying Terraform Azure provider from v4.54.0 to v4.80.0 — full field-level changes in the sections below, including breaking API changes for 4 resources
  • Fixed: [Bug]: Redis managed instance SKU cannot be updated without destroy #1220
  • Fixed: [Bug]: MongoDB Role Definition Type Field Unmarshaling Error #1207
  • Fixed: [Bug]: ApplicationGateway.network — multi-item frontendIpConfiguration list causes atProvider to never populate and READY condition stuck at False #1164
  • [Feature] ApplicationGateway support for TCP listener and backend #1246
  • [Feature] Add nodeProvisioningProfile support for AKS KubernetesCluster (NAP) #1149
  • CustomDomain.containerapp certificate changes are now applied in place instead of recreating the resource (#1249)
  • Subscription.azure deletion now cancels the subscription before deleting the alias (#1272)
• Fixed: [Bug]: Failover Group recreation loop on the MSSQLManagedInstanceFailoverGroup MR #1250
• Fixed: incorrect external-name identifier for HybridConnectionAuthorizationRule.relay #1247
• Fixed: CRD conversion webhooks are now registered on all provider replicas instead of only the elected leader #1270
• [Feature] Expose features.postgresql_flexible_server.restart_server_on_configuration_value_change on the ProviderConfig CRD #1219
• [Feature] Creation source database reference support (creationSourceDatabaseIdRef/creationSourceDatabaseIdSelector) for MSSQLDatabase.sql #1243
• [Feature] New upjet_resource_external_api_calls_total metric #1244
• Dependency updates (crossplane-runtime v2.3.3, crossplane v2.3.4, Go 1.26.5, Alpine 3.24.1)

Bugfixes with Breaking API change

Caution

Resource	Field	New CRD field
LinkedServiceDataLakeStorageGen2.datafactory	service_principal_key	servicePrincipalKeySecretRef
LinkedServiceDataLakeStorageGen2.datafactory	storage_account_key	storageAccountKeySecretRef
ComputeCluster.machinelearningservices	ssh.admin_password	ssh.adminPasswordSecretRef
VirtualNetworkGateway.network	vpn_client_configuration.radius_server_secret	vpnClientConfiguration.radiusServerSecretSecretRef

Consequences for users:

• Manifests setting the value inline must move it into a Secret.
• Anything reading the value back from status.atProvider breaks.

Support for New Resources

• Center.devcenter
• Project.devcenter
• GroupUser.apimanagement
• AppServiceCertificateBinding.web
• AppServiceCustomHostNameBinding.web
• AppServiceManagedCertificate.web
• ManagedRedisAccessPolicyAssignment.cache
• ManagedDevopsPool.devopsinfrastructure

Terraform provider upgrade: v4.54.0 → v4.80.0

All changes apply to both API scopes — cluster (<group>.azure.upbound.io) and namespaced (<group>.azure.m.upbound.io).
Cluster resources that expose a v1beta2 hub had their new/changed fields backported to the frozen v1beta1 spoke.

Non-breaking schema changes

Existing fields relaxed (previously-required fields are now optional); no field removed.

ApplicationGateway.network (v1beta2 hub + v1beta1 spoke):

• probe.path — required→optional
• Following become optional (conditionally required) due to mutually exclusive alternatives introduced:
  • spec.forProvider.backendHttpSettings
  • spec.forProvider.httpListener
  • spec.forProvider.requestRoutingRule

Backend.apimanagement (v1beta2 hub + v1beta1 spoke):

• proxy.username — required→optional

EnvironmentCertificate.containerapp (v1beta1):

• certificatePasswordSecretRef — required→optional, value→pointer
• spec.forProvider.certificateBlobBase64 became optional since certificatePasswordSecretRef also became optional, but they still must be specified together

OrchestratedVirtualMachineScaleSet.compute (v1beta2 hub + v1beta1 spoke):

• skuProfile.vmSizes — required→optional

Newly deprecated fields

⚠️ Following fields are deprecated and will be removed in the next major version. Please plan migrations to the replacement fields.

Resource	Field(s)
azurerm_ai_services	customer_managed_key.managed_hsm_key_id
azurerm_application_gateway	enable_http2, ssl_profile.verify_client_cert_issuer_dn
azurerm_application_insights	daily_data_cap_notifications_disabled, disable_ip_masking, local_authentication_disabled
azurerm_cosmosdb_account	local_authentication_disabled, managed_hsm_key_id
azurerm_data_factory_linked_service_azure_databricks	msi_work_space_resource_id
azurerm_disk_encryption_set	managed_hsm_key_id
azurerm_express_route_connection	enable_internet_security
azurerm_federated_identity_credential	parent_id, resource_group_name
azurerm_kubernetes_cluster	default_node_pool.kubelet_config.container_log_max_line
azurerm_kubernetes_cluster_node_pool	kubelet_config.container_log_max_line
azurerm_linux_web_app	site_config.application_stack.ruby_version
azurerm_linux_web_app_slot	site_config.application_stack.ruby_version
azurerm_mssql_managed_database	long_term_retention_policy.immutable_backups_enabled
azurerm_mssql_server_transparent_data_encryption	managed_hsm_key_id
azurerm_mysql_flexible_server	customer_managed_key.managed_hsm_key_id
azurerm_orchestrated_virtual_machine_scale_set	sku_profile.vm_sizes
azurerm_private_link_service	enable_proxy_protocol
azurerm_recovery_services_vault	soft_delete_enabled
azurerm_storage_account	customer_managed_key.managed_hsm_key_id
azurerm_storage_blob	storage_account_name, storage_container_name
azurerm_storage_table	storage_account_name
azurerm_virtual_network_gateway	enable_bgp
azurerm_virtual_network_gateway_connection	enable_bgp

What's Changed

• Support for features.postgresql_flexible_server.restart_server_on_configuration_value_change provider flag by @jakubramut in #1223
• feat: Add Resources DevCenter and Projects by @ttothea in #1239
• Add ApiManagement.GroupUser by @jakubramut in #1241
• Add creation source database reference support to MSSQLDatabase by @nicolamacoir in #1243
• Add AppServiceCertificateBinding, AppServiceCustomHostNameBinding, AppServiceManagedCertificate by @jakubramut in #1245
• Implement upjet_resource_external_api_calls_total metric by @jonasz-lasut in #1244
• Update underlying terraform fork to support ContainerAppCustomDomain in place update by @jonasz-lasut in #1249
• Update underlying terraform provider fork to 4.80.0 by @jonasz-lasut in #1251
• Generate generated.lst as multiline json for better visibility by @jonasz-lasut in #1252
• renovate: fix and refactor configuration by @erhancagirici in #1254
• fix(relay): correct external-name identifier for HybridConnectionAuthorizationRule by @nicolamacoir in #1247
• Add ManagedRedisAccessPolicyAssignment.cache by @jonasz-lasut in #1257
• Fix MSSQLManagedInstanceFailoverGroup external name configuration by @jonasz-lasut in #1260
• feat: add azurerm_managed_devops_pool resource by @ttothea in #1262
• Update actions/stale digest to 1e223db by @renovate[bot] in #1256
• Update go module directive to v1.26.5 by @renovate[bot] in #1259
• Decouple conversion webhook registration from leader election by @ulucinar in #1270
• Update crossplane-runtime to v2.3.3 by @jonasz-lasut in #1269
• Update underlying terraform provider by @jonasz-lasut in #1272
• Update alpine Docker tag to v3.24.1 by @renovate[bot] in #1233
• Update dependency crossplane/crossplane to v2.3.4 by @renovate[bot] in #1258
• Update actions/cache digest to caa2961 by @renovate[bot] in #1255
• Update actions/setup-go action to v7 by @renovate[bot] in #1267
• Update actions/checkout action to v7 by @renovate[bot] in #1266
• Update module github.com/crossplane/crossplane/apis/v2 to v2.3.4 by @renovate[bot] in #1273
• Update actions/cache action to v6 by @renovate[bot] in #1265
• Update all non-major github action by @renovate[bot] in #1275
• Update dependency kubernetes-sigs/kind to v0.32.0 by @renovate[bot] in #1277
• Update actions/stale action to v11 by @renovate[bot] in #1278
• Update dependency golangci/golangci-lint to v2.12.2 by @renovate[bot] in #1276

New Contributors

• @ttothea made their first contribution in #1239

Full Changelog: v2.6.0...v2.7.0