[Bug]: MonitorActivityLogAlert MR not being deleted when the claim is removed

[vinish86]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

insights.azure.upbound.io/v1beta1 - MonitorActivityLogAlert

Resource MRs required to reproduce the bug

Definition

---
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xservicehealths.test.example.io
spec:
  group: test.example.io
  defaultCompositeDeletePolicy: Foreground
  names:
    kind: XServiceHealth
    plural: xservicehealths
    singular: xservicehealth
  claimNames:
    kind: ServiceHealth
    plural: servicehealths
    singular: servicehealth
  versions:
    - name: v1alpha1
      served: true
      referenceable: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              required:
                - accountID
                - subscriptionName
                - customerEnvironmentShorthand
              properties:
                accountID:
                  description: 'accountID: Subscription Id .'
                  type: string
                subscriptionName:
                  description: 'subscriptionName: Subscription Name .'
                  type: string
                customerEnvironmentShorthand:
                  description: 'customerEnvironmentShorthand: The customer environment
                    name. Possible values:   "d" - Development   "p" - Production.'
                  type: string
            status:
              type: object
              properties:
                resourceGroupId:
                  type: string
                resourceGroupName:
                  type: string
                actionGroupId:
                  type: string
                actionGroupName:
                  type: string
                activityLogAlertId:
                  type: string

Composition

---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  labels:
    scc.cloud.allianz/composition-version: native
  name: xservicehealths.test.example.io
spec:
  writeConnectionSecretsToNamespace: crossplane-system
  compositeTypeRef:
    apiVersion: test.example.io/v1alpha1
    kind: XServiceHealth
  mode: Pipeline
  pipeline:
    - step: patch-and-transform
      functionRef:
        name: function-patch-and-transform
      input:
        apiVersion: pt.fn.crossplane.io/v1beta1
        kind: Resources
        patchSets:
          - name: provider-config
            patches:
              - fromFieldPath: spec.accountID
                toFieldPath: spec.providerConfigRef.name
                transforms:
                  - string:
                      fmt: scc-%s
                      type: Format
                    type: string
        resources:
          - name: action-group-resourcegroup
            base:
              apiVersion: azure.upbound.io/v1beta1
              kind: ResourceGroup
              metadata:
                labels:
                  scc.cloud.allianz/resource-group-selector:  # patched
                  scc.cloud.allianz/usage: service-alert
                name:  # patched
              spec:
                forProvider:
                  location: West Europe
                providerConfigRef:
                  name:  # patched
            patches:
              - patchSetName: provider-config
                type: PatchSet
              - fromFieldPath: spec.customerEnvironmentShorthand
                toFieldPath: metadata.annotations[crossplane.io/external-name]
                transforms:
                  - string:
                      fmt: rg-%s-we1-servicehealth
                      type: Format
                    type: string
              - fromFieldPath: spec.customerEnvironmentShorthand
                toFieldPath: metadata.labels[scc.cloud.allianz/resource-group-selector]
                transforms:
                  - string:
                      fmt: rg-%s-we1-servicehealth
                      type: Format
                    type: string
              - fromFieldPath: status.atProvider.id
                toFieldPath: status.resourceGroupId
                type: ToCompositeFieldPath
              - fromFieldPath: status.atProvider.id
                toFieldPath: status.resourceGroupName
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: \/resourceGroups\/([^\/]+)$
                      type: Regexp
                    type: string
                type: ToCompositeFieldPath
          - name: action-group
            base:
              apiVersion: insights.azure.upbound.io/v1beta1
              kind: MonitorActionGroup
              metadata:
                labels:
                  scc.cloud.allianz/action-group-selector:  # patched
                name:  # patched
              spec:
                forProvider:
                  resourceGroupNameSelector:
                    matchLabels:
                      scc.cloud.allianz/resource-group-selector:  # patched
                  shortName: # "p0action"
                  armRoleReceiver:
                    - name: Monitoring Reader
                      roleId: 43d0d8ad-25c7-4714-9337-8ba259a9fe05
                      useCommonAlertSchema: false
                providerConfigRef:
                  name:  # patched
            patches:
              - patchSetName: provider-config
                type: PatchSet
              - fromFieldPath: spec.subscriptionName
                toFieldPath: metadata.annotations[crossplane.io/external-name]
                transforms:
                  - string:
                      fmt: actiongroup-%s
                      type: Format
                    type: string
              - fromFieldPath: spec.subscriptionName
                toFieldPath: spec.forProvider.shortName
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: ([^-]+)
                      type: Regexp
                    type: string
              - fromFieldPath: spec.subscriptionName
                toFieldPath: metadata.labels[scc.cloud.allianz/action-group-selector]
                transforms:
                  - string:
                      fmt: actiongroup-%s
                      type: Format
                    type: string
              - fromFieldPath: status.resourceGroupId
                policy:
                  fromFieldPath: Required
                toFieldPath: spec.forProvider.resourceGroupNameSelector.matchLabels[scc.cloud.allianz/resource-group-selector]
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: \/resourceGroups\/([^\/]+)$
                      type: Regexp
                    type: string
                type: FromCompositeFieldPath
              - fromFieldPath: status.atProvider.id
                toFieldPath: status.actionGroupId
                type: ToCompositeFieldPath
              - fromFieldPath: status.atProvider.id
                toFieldPath: status.actionGroupName
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: \/actionGroups\/([^\/]+)$
                      type: Regexp
                    type: string
                type: ToCompositeFieldPath
          - name: activity-log-alert
            base:
              apiVersion: insights.azure.upbound.io/v1beta1
              kind: MonitorActivityLogAlert
              metadata:
                name:  # patched
              spec:
                forProvider:
                  action:
                  - actionGroupIdSelector:
                      matchLabels:
                        scc.cloud.allianz/action-group-selector: # patched
                    webhookProperties:
                      from: terraform
                  criteria:
                  - category: ServiceHealth
                    serviceHealth:
                      - events:
                          - "Incident"
                          - "Maintenance"
                  description: This service alert will monitor updates for all Azure resources and provide insights into their status during incidents and scheduled maintenance.
                  name: # patched
                  resourceGroupNameSelector:
                    matchLabels:
                      scc.cloud.allianz/resource-group-selector: # patched
                  scopes:
                  - # patched
                providerConfigRef:
                  name: # patched
            patches:
              - patchSetName: provider-config
                type: PatchSet
              - combine:
                  strategy: string
                  string:
                    fmt:  /subscriptions/%s/resourceGroups/%s/providers/Microsoft.Insights/activityLogAlerts/servicealert-%s
                  variables:
                    - fromFieldPath: spec.accountID
                    - fromFieldPath: status.resourceGroupName
                    - fromFieldPath: spec.subscriptionName
                policy:
                  fromFieldPath: Required
                toFieldPath: metadata.annotations[crossplane.io/external-name]
                type: CombineFromComposite
              - fromFieldPath: spec.accountID
                toFieldPath: spec.forProvider.scopes[0]
                transforms:
                  - string:
                      fmt: /subscriptions/%s
                      type: Format
                    type: string
              - fromFieldPath: spec.subscriptionName
                toFieldPath: spec.forProvider.name
                transforms:
                  - string:
                      fmt: servicealert-%s
                      type: Format
                    type: string
              - fromFieldPath: status.actionGroupId
                policy:
                  fromFieldPath: Required
                toFieldPath: spec.forProvider.action[0].actionGroupIdSelector.matchLabels[scc.cloud.allianz/action-group-selector]
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: \/actionGroups\/([^\/]+)$
                      type: Regexp
                    type: string
                type: FromCompositeFieldPath
              - fromFieldPath: status.resourceGroupId
                policy:
                  fromFieldPath: Required
                toFieldPath: spec.forProvider.resourceGroupNameSelector.matchLabels[scc.cloud.allianz/resource-group-selector]
                transforms:
                  - string:
                      regexp:
                        group: 1
                        match: \/resourceGroups\/([^\/]+)$
                      type: Regexp
                    type: string
                type: FromCompositeFieldPath
              - fromFieldPath: status.atProvider.id
                toFieldPath: status.activityLogAlertId
                type: ToCompositeFieldPath
    - step: automatically-detect-ready-composed-resources
      functionRef:
        name: function-auto-ready

Claim

---
apiVersion: test.example.io/v1alpha1
kind: ServiceHealth
metadata:
  name: sameple-01
spec:
  accountID: xxxxx-yyyyyy-zzzz-aaaaa-bbbbbbb
  subscriptionName: test-subscription-name
  customerEnvironmentShorthand: d

Steps to Reproduce

Submit the definition, composition, and claim. Once all resources are deployed, try to delete the claim. The claim will remain temporarily, as it's waiting in the background for the Managed Resources (MRs) to be deleted. Eventually, all MRs will be deleted except for one – the MonitorActivityLogAlert – even though it will have been successfully removed from Azure. As a result, the claim cannot be deleted immediately because it continues running in the foreground, waiting for the last MR to be removed.

After deletion of claim

description of MR

azure-provider.log

attaching screenshot and the provider log for reference.

What happened?

Ideally MR should get deleted once we deletes the claim.

Relevant Error Output Snippet

No response

Crossplane Version

1.15.2

Provider Version

1.5.0

Kubernetes Version

1.28.2

Kubernetes Distribution

No response

Additional Info

No response