Add container_registry_zone_redundancy_enabled variable to decouple ACR zone redundancy from private networking

Fixes the issue where zone_redundancy_enabled for the container registry was
tied to use_private_networking, causing failures in regions that don't support
zone redundancy (e.g., Jio India West). Re-uses the existing
agent_container_zone_support / runner_container_zone_support variables to
control both container instance zones and container registry zone redundancy.

Co-authored-by: jtracey93 <41163455+jtracey93@users.noreply.github.com>

Author: Copilot

alz/azuredevops/main.tf

@@ -49,6 +49,7 @@ module "azure" {
   virtual_network_subnet_address_prefix_container_instances = var.virtual_network_subnet_address_prefix_container_instances
   virtual_network_subnet_address_prefix_private_endpoints   = var.virtual_network_subnet_address_prefix_private_endpoints
   storage_account_replication_type                          = var.storage_account_replication_type
+  container_registry_zone_redundancy_enabled                = var.agent_container_zone_support
   public_ip_name                                            = local.resource_names.public_ip
   nat_gateway_name                                          = local.resource_names.nat_gateway
   use_self_hosted_agents                                    = var.use_self_hosted_agents

alz/azuredevops/variables.tf

@@ -391,9 +391,11 @@ variable "agent_container_memory_max" {
 
 variable "agent_container_zone_support" {
   description = <<-EOT
-    **(Optional, default: `true`)** Enable availability zone support for Azure DevOps agent container instances.
+    **(Optional, default: `true`)** Enable availability zone support for Azure DevOps agent container instances and container registry.
 
-    When enabled, containers are distributed across availability zones for higher availability and resilience.
+    When enabled, containers are distributed across availability zones for higher availability and resilience,
+    and the container registry is configured with zone redundancy.
+    Some regions do not support availability zones, in which case this should be set to false.
   EOT
   type        = bool
   default     = true

alz/github/main.tf

@@ -50,6 +50,7 @@ module "azure" {
   virtual_network_subnet_address_prefix_container_instances = var.virtual_network_subnet_address_prefix_container_instances
   virtual_network_subnet_address_prefix_private_endpoints   = var.virtual_network_subnet_address_prefix_private_endpoints
   storage_account_replication_type                          = var.storage_account_replication_type
+  container_registry_zone_redundancy_enabled                = var.runner_container_zone_support
   public_ip_name                                            = local.resource_names.public_ip
   nat_gateway_name                                          = local.resource_names.nat_gateway
   use_self_hosted_agents                                    = var.use_self_hosted_runners

alz/github/variables.tf

@@ -496,9 +496,11 @@ variable "runner_container_memory_max" {
 
 variable "runner_container_zone_support" {
   description = <<-EOT
-    **(Optional, default: `true`)** Enable availability zone support for GitHub runner container instances.
+    **(Optional, default: `true`)** Enable availability zone support for GitHub runner container instances and container registry.
 
-    When enabled, containers are distributed across availability zones for higher availability and resilience.
+    When enabled, containers are distributed across availability zones for higher availability and resilience,
+    and the container registry is configured with zone redundancy.
+    Some regions do not support availability zones, in which case this should be set to false.
   EOT
   type        = bool
   default     = true

modules/azure/container_registry.tf

@@ -5,7 +5,7 @@ resource "azurerm_container_registry" "alz" {
   location                      = var.azure_location
   sku                           = var.use_private_networking ? "Premium" : "Basic"
   public_network_access_enabled = !var.use_private_networking
-  zone_redundancy_enabled       = var.use_private_networking
+  zone_redundancy_enabled       = var.use_private_networking && var.container_registry_zone_redundancy_enabled
   network_rule_bypass_option    = var.use_private_networking ? "AzureServices" : "None"
 }
 

modules/azure/variables.tf

@@ -528,6 +528,18 @@ variable "container_registry_image_name" {
   default     = ""
 }
 
+variable "container_registry_zone_redundancy_enabled" {
+  description = <<-EOT
+    **(Optional, default: `true`)** Enable zone redundancy for the Azure Container Registry.
+
+    When enabled, the container registry is replicated across availability zones for higher availability.
+    Some regions do not support zone redundancy, in which case this should be set to false.
+    Zone redundancy requires Premium SKU, which is only used when private networking is enabled.
+  EOT
+  type        = bool
+  default     = true
+}
+
 variable "container_registry_image_tag" {
   description = <<-EOT
     **(Optional, default: `"{{.Run.ID}}"`)** Tag pattern for the container image.