[Bug]: EventHubNamespace sometimes returns failed async update if using 'resourceGroupNameSelector' and no 'LateInitialize' management policy

[b-deam]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

• eventhub.azure.upbound.io/v1beta2 - EventHubNamespace

Resource MRs required to reproduce the bug

apiVersion: eventhub.azure.upbound.io/v1beta2
kind: EventHubNamespace
metadata:
  name: my-repro-queue
spec:
  managementPolicies:
    - Create
    - Update
    - Delete
    - Observe
  forProvider:
    autoInflateEnabled: "true"
    capacity: "1"
    location: eastus2
    minimumTlsVersion: "1.2"
    networkRulesets:
      defaultAction: Deny
      virtualNetworkRule:
        - subnetIdSelector:
            matchLabels:
              account-name: app-1
    resourceGroupNameSelector:
      matchLabels:
        account-name: app-1
    sku: Standard
    zoneRedundant: true

Steps to Reproduce

Create MR with example management policies and use resourceGroupNameSelector.

What happened?

The MR will sometimes (most in my testing) fail to reconcile, briefly showing an async update failure if using both resouceGroupNameSelector and managementPolicies: ["Create", "Update", "Delete", "Observe"], i.e. no LateInitialize.

If I set resourceGroupName, the update failures do not occur. Strangely this seems to also fix another unrelated bug (see comment here).

apiVersion: eventhub.azure.upbound.io/v1beta2
kind: EventHubNamespace
metadata:
  name: my-repro-queue
spec:
  managementPolicies:
    - Create
    - Update
    - Delete
    - Observe
  forProvider:
    autoInflateEnabled: "true"
    capacity: "1"
    location: eastus2
    minimumTlsVersion: "1.2"
    networkRulesets:
      defaultAction: Deny
      virtualNetworkRule:
        - subnetIdSelector:
            matchLabels:
              account-name: app-1
+   resourceGroupName: app-1
-   resourceGroupNameSelector:
-     matchLabels:
-       account-name: app-1
    sku: Standard
    zoneRedundant: true

Additionally, resourceGroupNameSelector does work if you include the LateInitialize management policy, e.g.:

managementPolicies: ["*"]

Relevant Error Output Snippet

2024-08-19T04:03:11Z	DEBUG	provider-azure	Connecting to the service provider	{"uid": "e814e2e6-d91a-441c-aaac-39779fab3f00", "name": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace"}
2024-08-19T04:03:11Z	DEBUG	provider-azure	Calling the inner handler for Update event.	{"gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace", "name": "my-repro-queue", "queueLength": 0}
2024-08-19T04:03:12Z	DEBUG	provider-azure	Observing the external resource	{"uid": "e814e2e6-d91a-441c-aaac-39779fab3f00", "name": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace"}
2024-08-19T04:03:17Z	DEBUG	provider-azure	Diff detected	{"uid": "e814e2e6-d91a-441c-aaac-39779fab3f00", "name": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace", "instanceDiff": "*terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{\"resource_group_name\":*terraform.ResourceAttrDiff{Old:\"app-1\", New:\"\", NewComputed:false, NewRemoved:true, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}}, Destroy:false, DestroyDeposed:false, DestroyTainted:false, RawConfig:cty.NilVal, RawState:cty.NilVal, RawPlan:cty.NilVal, Meta:map[string]interface {}(nil)}"}
2024-08-19T04:03:17Z	DEBUG	provider-azure	Async update starting...	{"trackerUID": "e814e2e6-d91a-441c-aaac-39779fab3f00", "resourceName": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace", "tfID": "/subscriptions/<subscription-id>/resourceGroups/app-1/providers/Microsoft.EventHub/namespaces/my-repro-queue"}
2024-08-19T04:03:17Z	DEBUG	provider-azure	Updating the external resource	{"uid": "e814e2e6-d91a-441c-aaac-39779fab3f00", "name": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace"}
2024-08-19T04:03:17Z	DEBUG	provider-azure	Async update ended.	{"trackerUID": "e814e2e6-d91a-441c-aaac-39779fab3f00", "resourceName": "my-repro-queue", "gvk": "eventhub.azure.upbound.io/v1beta1, Kind=EventHubNamespace", "error": "async update failed: refuse to update the external resource because the following update requires replacing it: cannot change the value of the argument \"resource_group_name\" from \"app-1\" to \"\"", "tfID": "/subscriptions/<subscription-id>/resourceGroups/app-1/providers/Microsoft.EventHub/namespaces/my-repro-queue"}

and from crossplane beta trace:

NAME                                                       RESOURCE                                   SYNCED   READY   STATUS

EventHubNamespace/my-repro-queue    eventhub                                   False    True    ReconcileError: update failed: async update
failed: refuse to update the external resource because the following update requires replacing it: cannot change the value of the argument "resource_group_name" fr
om "app-1" to ""

### Crossplane Version

1.14.3

### Provider Version

1.3.0

### Kubernetes Version

v1.28.0

### Kubernetes Distribution

Kind

### Additional Info

_No response_