Hey all.. I've run into a problem when upgrading to Pulumi 2.0...

const clientConfig = azure.core.getClientConfig();
export const subscriptionId = clientConfig.subscriptionId;

This used to work. Now, it doesn't.

I feel like I'm missing something basic.

But this exact .ts code worked when the using this packages.json dependency list

"dependencies": {
        "@pulumi/azure": "^2.0.0",
        "@pulumi/azuread": "^1.8.0",
        "@pulumi/kubernetes": "^1.6.0",
        "@pulumi/pulumi": "^1.0.0"
    }

To close this off, Pulumi 2.0 handles async invocations different. I had to change this

azure.core.getClientConfig();

to this

pulumi.output(azure.core.getClientConfig();)

Thanks @broad-dog-22463

Not sure which channel to post it on as its across most languages, the pulumi-terraform-bridge has an issue with with azure static websites, trying to convert pulumi error404Document to error_404_document, is there someone that can help? the error seems to be how the https://github.com/pulumi/pulumi-terraform-bridge/blob/master/pkg/tfbridge/names.go#L29 handles numbers, found another implementation that seems to have overcome this limitation, but it breaks pulumi downstream. not to familiar with go. there is multiple open issue but they seems to have stalled.

Hello.. I'm trying to create a new stack with an Azure KeyVault Secrets Provider, but the

pulumi stack init dev --secret-provider="azurekeyvault://<url here>"

is blowing up with this message:

error: secrets (code=Unknown): azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://<snipped>.<http://vault.azure.net/keys/pulumi//encrypt?api-version=7.0|vault.azure.net/keys/pulumi//encrypt?api-version=7.0>: StatusCode=0 -- Original Error: adal: Failed to execute the refresh request. Error = 'Get <http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net>: dial tcp 169.254.169.254:80: connectex: A socket operation was attempted to an unreachable network.'

Any thoughts?

Is this something that should be an issue?

We responded in the thread, I don't think it's pulumi specific, it seems there's an issue hitting the Azure metadata service for the underlying Azure SDK, i'd be interested to know hwo you're authenticated and where this is running from? that IP is a private address inside azure, so if you're running from outside it wouldn't be reachable

To assign a role to a group or user (let's say the contributor role to a resource group deployed via pulumi), what permissions / rights does the Service Principal used by Pulumi need ? @tall-librarian-49374 I know you already answered some questions about Assignements in the dotnet channel but I did not find anything concernig necessary rights.

Isn't Owner required in this case?

I was looking in app permissions like graph instead of roles... 😌 I don't think I will ever have a chance of convincing my manager to give my service principal the owner role on a subscription but I found this role : User Access Administrator. It works with that. Thanks for you answer !

Ah, great you solved it!

I suspect we need to add this kind of things to docs or a blog

Is there any way to get the connection string to a SQL cosmos DB account? I find it a bit strange that this doesn't seem to be possible based on the docs. https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/azure/cosmosdb/#Account-connectionStrings It's absolutely available in the portal.

Hi Folks, I've a question, how can we add Azure AAD B2C as resource and add as a Authentication provider for Azure Function App?

When triggering an Azure Function from the EventGrid, is anyone else getting

The language expression property 'eventgrid_extension' doesn't exist

when trying to generate the function key needed (via a .net TemplateDeployment with`[listKeys(resourceId('Microsoft.Web/sites/host/', parameters('functionAppName'), 'default'),'2016-08-01').systemkeys.eventgrid_extension]`)? This seems to have just recently stopped working.

I have a general question concerning how to code an Azure Infrastructure. I was wondering how you were doing to find out how to convert an infrasture you set up in the Azure portal to Pulumi code. For common resources and set up it's not really hard to guess what to use from documentation and pulumi-samples, however for specific things it becomes hard to know what to use. Just for something relatively usual like exposing an API on an Application Registration, I don't really know how what to use. I have tried to configure it through the portal, looked at the generated manifest and try to map the json with properties of Pulumi classes but that's not convenient and I can't find all the properties I need.

Anyone ever tried to set the Owners property of an Application (App Registration) ? By default, when not specified, the owner is set to the SP deploying the resources and it works fine. However if I try to set the Owners property with an InputList containing a user and my SP name, I have the following error when the code try to add my user as an owner :

Error while adding owners to Azure AD applications with ID "****-****-****-***-****": Error adding owner "****-****-****-****-****" to Azure AD applications with ID "****-****-****-***-****": graphrbac.ApplicationsClient#AddOwner: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-05-13T10:54:33","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}]

Is there anyone who can provide a bit of guidance on this: https://github.com/pulumi/pulumi/issues/4606 Preview seems to be picking up a diff when there’s no actual change.

Hello! What would be the best way to update an StorageAccount from V1 to V2? It was deployed some months ago when the default attribute was "Storage", not if I update the resource to

accountKind: "StorageV2"

, it's saying that is going to replace the storage and all the tables. Is it possible to update the version without losing data?

Hey friendly folks, Has anyone experienced constant prompts to sign in with a device token when deploying resources to an AKS cluster?

To sign in, use a web browser to open the page <https://microsoft.com/devicelogin> and enter the code HUUTYL7CP to authenticate.

I've deployed the crosswalk stacks to AKS but when I go to deploy resources to the cluster, I get 3 prompts per deployment The only way to successfully deploy resources is to do an unattended deploy and output the logs to a file and watch the file for the devicelogin prompts

pulumi up --yes  > debug.log

Frustrating 🙂

Using Pulumi, does anyone know if it's possible to provision an Azure Storage account with keys managed by Key Vault per: https://docs.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys ? I'm coming up empty searching Pulumi and Terraform docs. Considering trying to accomplish this with a dynamic resource provider, but wanted to check if I'm missing something

Hi All, I'm getting unexpected behavior when trying to access properties of an existing Data Factory instance. Am I missing something, or are others seeing the same weirdness? Here is the code to access three existing resources:

let keyVault = vznaz.azure.keyvault.getKeyVault({ name: "kv-dp-test",
resourceGroupName: resourcegroupName
 })
  
let storage = vznaz.azure.storage.getAccount({ name: "storagedptest", 
resourceGroupName: resourcegroupName
})

let  dataFactory = vznaz.azure.datafactory.getFactory({name: "adf-dp-test",
 resourceGroupName: resourcegroupName
 })

 export const test = "key vault name is:" +  keyVault.vaultUri;
 export const test2 = "factory name is:" + dataFactory.id ;
 export const test3 = "storage host endpoint is" + storage.primaryBlobHost;

Outputs:
    test : "key vault name is:<https://kv-dp-test.vault.azure.net/>"
    test2: "factory name is:undefined"
    test3: "storage host endpoint <http://isstoragedptest.blob.core.windows.net|isstoragedptest.blob.core.windows.net>"

There is no output for the Data Factory id! I have triple checked the name of the resource, resource group and that it exists. Any ideas what is happening?

How do you do to set a property on an Azure resource which need to be computed from another property of the same resource which is only known once the resource. For instance, I want to set an uri in the IdentifierUris property of the Application resource (AzureAd), and this needs to contain the ApplicationId of the Application which I will know only once created.

Hi, I'm trying to follow the k8s playbook, but getting weird messages when setting servicePrincipal and rbac azureActiveDirectoryfor the cluster:

To sign in, use a web browser to open the page <https://microsoft.com/devicelogin> and enter the code XXYYZZ

Hello. Is there a way to prevent "pulumi destroy" from removing a resource group that isn't empty? For example say I have a Pulumi project that creates a resource group and some resources in it. A user then comes along and manually creates another resource in it. Is it possible to allow "pulumi destroy" to remove the resources it created but not the resource group which now contains additional things?