Azure Application Gateway certificate unwanted changed

[wi5nia]

I've noticed that every week there is some internal update going for Application Gateway which was deployed using official Langfuse TF templates and it changes my certificate which I uploaded to the standard one which is unsigned and is not valid.

Why is that and how can it be stopped?

[Steffen911]

@wi5nia Do you see any diffs if you run another terraform plan? I.e. does terraform detect the drift?

[wi5nia]

So the changes are initiated by the Enterprise Application registration done by TF but I have no clue why this may be happening :/

[Steffen911]

Hm but my understanding from the Terraform Plan is that it wouldn't update any certificates on the gateway? So this seems fully azure internal?

[wi5nia]

But an Enterprise Application created by the Langfuse modules regularly do the update... is there some update mechanism in Langfuse which would be doing that maybe?

[wi5nia]

Ok, so I have figured it out. Basically it's your TF modules "fault" because you create the AGIC and it tries to reconcile to any changes added to them as such when done in the portal. So as there is no way of providing it a different certificate then the self-signed one you generate for the deployed solution this is an ongoing procedure which will happen :/

[Steffen911]

@wi5nia Do you have an idea on what the module would need to do differently to avoid this?