Skip to content

feat: Decouple container registry zone redundancy from private networking and make flexible #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jtracey93 merged 5 commits into from
Feb 10, 2026
Merged

feat: Decouple container registry zone redundancy from private networking and make flexible #133

jtracey93 merged 5 commits into from
Feb 10, 2026

Conversation

Copy link
Contributor

Copilot AI commented Feb 10, 2026 •
edited by jtracey93
Loading

zone_redundancy_enabled was hardcoded to var.use_private_networking, making it impossible to use private networking (Premium SKU) in regions without availability zone support (e.g., Jio India West). Setting agent_container_zone_support: false only affected container instance placement, not the registry.

Changes

  • modules/azure/container_registry.tf — Zone redundancy is now independently controllable when using Premium SKU:

    # Before
zone_redundancy_enabled = var.use_private_networking
# After
zone_redundancy_enabled = var.use_private_networking && var.container_registry_zone_redundancy_enabled

  • modules/azure/variables.tf — New container_registry_zone_redundancy_enabled variable (default true, backward compatible)

  • alz/azuredevops/ and alz/github/ — Expose container_registry_zone_redundancy_enabled (default null) as an independent override. Falls back to agent/runner zone support via coalesce():

    container_registry_zone_redundancy_enabled = coalesce(var.container_registry_zone_redundancy_enabled, var.agent_container_zone_support)

Usage

# Disable all zone support (container instances + registry)
agent_container_zone_support: false

# Or: keep container instance AZ support, disable only registry zone redundancy
agent_container_zone_support: true
container_registry_zone_redundancy_enabled: false
Original prompt

This section details on the original issue you should resolve

<issue_title>[Feature Request]: Separate variable for the zone redundancy parameter is needed to disable Container Registry Zone Redundancy</issue_title>
<issue_description>### Which product(s) are you raising for?

ALZ Terraform (AVM)

What is the feature request?

Zone redundancy (ZRS) is not supported in Jio Region, which caused bootstrap execution failures for storage accounts and container registries. For storage accounts, we resolved this by setting storage_account_replication_type: "LRS" in the Input.yaml file.

In the container registry module (modules/azure/container_registry.tf), zone_redundancy_enabled is set to var.use_private_networking, but a separate variable for the zone redundancy parameter is needed, since we are looking for agent resources (container instances and storage account to be created with private networking and container registry with zone redundancy disabled.

We proceeded by setting use_private_networking to false. (Container Instances and Storage account got created with public access)

Potential implementation/configuration


```</issue_description>

<agent_instructions>lets fix this by introducing either another variable for both ADO and GitHub as we have done already today - or re-use the existing variable to set resources that can utilize Availability Zones (Zones) to be able to not use them as an override</agent_instructions>

## Comments on the Issue (you are @copilot in this section)

<comments>
<comment_new><author>@jtracey93</author><body>
@mabhavsar23  Please use the `agent_container_zone_support: false` in the `inputs.yaml` file to achieve this outcome as per https://azure.github.io/Azure-Landing-Zones/accelerator/troubleshooting/#error-creating-container-group

</body></comment_new>
<comment_new><author>@jtracey93</author><body>
Report from customer when `agent_container_zone_support: false` in the `inputs.yaml` the below error still occurs @jaredfholgate

Error: creating Registry (Subscription: "9fe35ee1-67c4-4c3b-a2db-96f5ef602a76"

│ Resource Group Name: "rg-slz-mgmt-agents-jioindiawest-001"

│ Registry Name: "acrslzmgmtjio001uhab"): performing Create: unexpected status 400 (400 Bad Request) with error: ZoneRedundancyNotSupported: Zone redundancy is not supported for the selected location jioindiawest.. For more information on availability zone, please visit https://aka.ms/acr/az.

│

│ with module.azure.azurerm_container_registry.alz[0],

│ on ....\modules\azure\container_registry.tf line 1, in resource "azurerm_container_registry" "alz":

│ 1: resource "azurerm_container_registry" "alz" {

</comments>

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@jtracey93
Add container_registry_zone_redundancy_enabled variable to decouple A…
cfd9c2f 
…CR zone redundancy from private networking

Fixes the issue where zone_redundancy_enabled for the container registry was
tied to use_private_networking, causing failures in regions that don't support
zone redundancy (e.g., Jio India West). Re-uses the existing
agent_container_zone_support / runner_container_zone_support variables to
control both container instance zones and container registry zone redundancy.

Co-authored-by: jtracey93 <41163455+jtracey93@users.noreply.github.com>
Copilot AI changed the title [WIP] Add separate variable for zone redundancy in container registry Decouple container registry zone redundancy from private networking Feb 10, 2026
Copilot AI requested a review from jtracey93 February 10, 2026 13:02
@jtracey93
Expose container_registry_zone_redundancy_enabled as separate top-lev…
4b39231 
…el variable in ADO and GitHub ALZ modules

By default, the container registry zone redundancy follows the agent/runner
container zone support setting. Users can now independently override it by
setting container_registry_zone_redundancy_enabled, enabling scenarios like
AZ support for runners but not the registry.

Co-authored-by: jtracey93 <41163455+jtracey93@users.noreply.github.com>
Copilot AI changed the title Decouple container registry zone redundancy from private networking Decouple container registry zone redundancy from container instance zone support Feb 10, 2026
Copilot AI changed the title Decouple container registry zone redundancy from container instance zone support Decouple container registry zone redundancy from private networking flag Feb 10, 2026
@jtracey93 jtracey93 marked this pull request as ready for review February 10, 2026 13:13
@jtracey93 jtracey93 changed the title Decouple container registry zone redundancy from private networking flag feat: Decouple container registry zone redundancy from private networking flag for agents and runners and make it flexible Feb 10, 2026
Copilot AI changed the title feat: Decouple container registry zone redundancy from private networking flag for agents and runners and make it flexible Decouple container registry zone redundancy from private networking flag Feb 10, 2026
@jtracey93 jtracey93 changed the title Decouple container registry zone redundancy from private networking flag feat: Decouple container registry zone redundancy from private networking flag and make flexible Feb 10, 2026
jaredfholgate
jaredfholgate previously approved these changes Feb 10, 2026
View reviewed changes
Copy link
Member

@jaredfholgate jaredfholgate left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, linting failure appears unrelated to this PR and must have been introduced in an ealier commit.

@jtracey93
Fix zone_redundancy_enabled to use ternary for independent control wi…
605c7de 
…th private networking

When private networking is enabled (Premium SKU), zone_redundancy_enabled is
now independently controlled by container_registry_zone_redundancy_enabled.
When private networking is disabled (Basic SKU), zone_redundancy_enabled is
false as required by the Terraform provider. The ternary pattern is consistent
with the other attributes in the resource block.

Co-authored-by: jtracey93 <41163455+jtracey93@users.noreply.github.com>
Copilot AI changed the title feat: Decouple container registry zone redundancy from private networking flag and make flexible Decouple container registry zone redundancy from private networking Feb 10, 2026
@jtracey93 jtracey93 changed the title Decouple container registry zone redundancy from private networking feat: Decouple container registry zone redundancy from private networking and make flexible Feb 10, 2026
jaredfholgate
jaredfholgate approved these changes Feb 10, 2026
View reviewed changes
Copy link
Member

@jaredfholgate jaredfholgate left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jtracey93 jtracey93 merged commit a64d524 into main Feb 10, 2026
9 of 11 checks passed
@jtracey93 jtracey93 deleted the copilot/add-separate-zone-redundancy-variable branch February 10, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jaredfholgate jaredfholgate jaredfholgate approved these changes

+1 more reviewer

@jtracey93 jtracey93 jtracey93 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@jtracey93 jtracey93

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature Request]: Separate variable for the zone redundancy parameter is needed to disable Container Registry Zone Redundancy

3 participants

@jaredfholgate @jtracey93