Is there any way to support resources that can only be replaced and not updated in place?

[empath-nirvana]

I'm trying to create a github organization secret with a custom github provider i made with upjet.

Currently, the terraform provider for github marks all fields for a github organization secret as "forceNew", so we can't update the secret.

There seems to be no way to allow prevent_destroy on any resource? Is there any way to make this work without deleting the crossplane resource and recreating it?

[bradkwadsworth-mw]

+1
I've run into this issue when trying to re-create IAM members in GCP if a role or member needs to be modified.

[jeanduplessis]

Would this proposal that introduces more granular management policies help here?

[ulucinar]

Please also see the "Note" here:
https://docs.crossplane.io/latest/concepts/managed-resources/#immutable-fields

By convention, Crossplane providers never delete resources based on a spec.forProvider change. I think what's suggested here deserves a discussion in the upstream Crossplane community.