btw. I had an issue on azure with aks node pool tags ... I had defined tags with CamelCase keys, but pulumi read them as lowercase from state, so kept insisting on having to update ... guess it must be a bug in the azure provider ... anyway I solved it by forcing tag keys to lowecase for that resource