pulumi-community #azure

bumpy-byte-21437

10/16/2020, 1:28 PM

Copy code

for x in conf.require('sa_name')
sa_account = azure.storage.Account(
  x,
  resource_group_name=resource_group.name,
  location=resource_group.location,
  allow_blob_public_access=False,
  is_hns_enabled=True,
  account_kind="StorageV2",
  account_tier="Standard",
  min_tls_version="TLS1_2",
  enable_https_traffic_only=True,
  account_replication_type="GRS",
  tags={
    "environment": "dev",
  }
)

wet-noon-14291

10/17/2020, 11:01 PM

Maybe this question belongs here: https://pulumi-community.slack.com/archives/C84L4E3N1/p1602974985053400

icy-jordan-58549

10/20/2020, 3:05 PM

hey, team. Is it possible to add rules / frontends to FrontDoor from another stack? I can imagine we can get the resource by https://www.pulumi.com/docs/reference/pkg/azure-nextgen/network/getfrontdoor/, but can edit it?

red-lighter-44012

10/21/2020, 9:46 AM

Im trying to integrate a new cluster (pulumi-managed) with an existing ACR (created via ARM).

Registry.Get

requires a resource ID, but I need to look up the ACR via its name or something that is known upfront. Im having trouble googling the solution. :<

red-lighter-44012

10/21/2020, 10:23 AM

Got it 🙂

GetResources.InvokeAsync(new GetResourcesArgs{ Name = ".." })

seems to do exactly that. Just to clarify: I want to reference, not import the ACR.

worried-stone-50514

10/22/2020, 3:00 AM

Hi Team, I am currently trying out the Azure Next Gen with python atm and currently running into a weird issue. I am doing my development within a dev container in VSCode and after some time i run into this unhandled error with not much other description. I have also inspect the logs when increasing the verbosity and it does not provide anything useful. However the fix for me is to restart my dev container environment and it works again. Wondering if anyone has experienced anything similar before?

colossal-school-15171

10/23/2020, 11:51 PM

hey all! new to pulumi, but loving it so far. Stuck on a thing and hoping someone here might have insight. I've got an ingress controller all set up and configured in Azure. I want to administer it via pulumi, so I export the template.json from azure, run it through @white-balloon-205’s fancy ARM2Pulumi service, and get an index.ts out of that. Now I'm getting errors that I can't get my head around, and can't find anything online that references them.

Copy code

pulumi up
Previewing update (ingress-test)

View Live: <https://app.pulumi.com/dangersorus/ingress-test/ingress-test/previews/7248690b-10f2-40f1-8883-43175065d385>

     Type                                                     Name                       Plan
     pulumi:pulumi:Stack                                      ingress-test-ingress-test
 +   ├─ azure-nextgen:containerservice/latest:AgentPool       agentPoolResource          create
 +   └─ azure-nextgen:containerservice/latest:ManagedCluster  managedClusterResource     create

Resources:
    + 2 to create
    1 unchanged

Do you want to perform this update? yes
Updating (ingress-test)

View Live: <https://app.pulumi.com/dangersorus/ingress-test/ingress-test/updates/4>

     Type                                                     Name                       Status                  Info
     pulumi:pulumi:Stack                                      ingress-test-ingress-test  **failed**              1 error
 +   ├─ azure-nextgen:containerservice/latest:AgentPool       agentPoolResource          **creating failed**     1 error
 +   └─ azure-nextgen:containerservice/latest:ManagedCluster  managedClusterResource     **creating failed**     1 error

Diagnostics:
  azure-nextgen:containerservice/latest:AgentPool (agentPoolResource):
    error: cannot check existence of resource /subscriptions/a8671a8f-0345-4bc3-890d-90085c807fd3/resourceGroups/test-group/providers/Microsoft.ContainerService/managedClusters/ingress-test/agentPools/test-cluster%2Fnodepool1: autorest/azure: error response cannot be parsed: "404: Page Not Found" error: json: cannot unmarshal number into Go value of type azure.RequestError: autorest/azure: error response cannot be parsed: "404: Page Not Found" error: json: cannot unmarshal number into Go value of type azure.RequestError

  azure-nextgen:containerservice/latest:ManagedCluster (managedClusterResource):
    error: Code="InvalidParameter" Message="The value of parameter windowsProfile.adminPassword is invalid. Please see <https://aka.ms/aks-naming-rules> for more details." Target="windowsProfile.adminPassword"

  pulumi:pulumi:Stack (ingress-test-ingress-test):
    error: update failed

rapid-oil-61997

10/25/2020, 9:58 AM

Hi all, I have a question on the state file when using azure storage account as backend. When provisioning a resource, the properties of a resource like, primary key, connection string is present in raw text in the state file. Do we have any way to either not to store this secrets or encrypt the state file too using the secret provided for the stack?

rapid-oil-61997

10/26/2020, 2:24 PM

Hi, I have created a new issue in github regarding extended auditing policies in sql server level. If somebody here has any suggestions, please let let me know. https://github.com/pulumi/pulumi-azure/issues/746

orange-dog-73995

10/27/2020, 12:11 PM

Hi, is there an example of a complex infrastructure for NextGen like this one for the Old Provider ?

red-lighter-44012

10/29/2020, 3:08 PM

I have a slight infrastructure drift, AKS. Im creating two ingress controllers in my pulumi stack. When do some unrelated updates (added output, minor changes) and pulumi up, I get

updates

on both ingress controlers: metadata and spec. What's the best way to diff the current state and the pulumi stack? Is refreshing gonna help here or how should I proceed 🙂

red-lighter-44012

10/29/2020, 4:01 PM

And one more question since I already invested over half an hour of googling 😄 AKS, I want to create a separate namespace (e.g.

team-foobar

) and have a kubeconfig that only includes permissions for that namespace. How should that be done, any docs on this? So far I've tried the following: - create new namespace - create new SP - create a new assignment, set Scope to

namespace.Id

and RoleDefinitionName to

Azure Kubernetes Service RBAC Writer

Is this correct and if yes - how do I get the kubeconfig?

witty-market-32785

10/29/2020, 4:03 PM

Someone have an example of creating a WebApp linked with a VNet using Azure Next Gen?

some-flower-64874

10/29/2020, 5:34 PM

So... given that there's a next gen Azure provider is it possible we might get a next gen AzureAD provider - currently have ~~problems~~ needs that exceed the scope of the current provider 😞 (And, for what its worth, the scope of the azure cli...)

orange-airplane-70350

10/30/2020, 3:32 AM

hey! I'm trying to integrate

azure-nextgen

to my existing program which already has

azure

provider. And I get the following error:

Copy code

pulumi:providers:azure-nextgen (default_3_12_1):
    error: no resource plugin 'azure-nextgen-v3.12.1' found in the workspace or on your $PATH, install the plugin using `pulumi plugin install resource azure-nextgen v3.12.1`

I wonder if somebody faced it already and knows some workaround.

icy-jordan-58549

11/04/2020, 4:34 PM

Error: invocation of azure-nextgenauthorization/latestgetRoleDefinition returned an error: unknown Invoke type “azure-nextgenauthorization/latestgetRoleDefinition”

icy-jordan-58549

11/04/2020, 5:57 PM

Hey team, is this https://www.pulumi.com/docs/reference/pkg/azure-nextgen/authorization/roleassignment/#roleassignmentproperties and this https://www.pulumi.com/docs/reference/pkg/azure/authorization/assignment/ are the same?

icy-jordan-58549

11/06/2020, 5:27 PM

Trying to do role assignment for subnet (Network Contributor) and getting this issue:

Copy code

Diagnostics:
  azure-nextgen:authorization/latest:RoleAssignment (network-contributor):
    error: Code="RoleAssignmentUpdateNotPermitted" Message="Tenant ID, application ID, principal ID, and scope are not allowed to be updated."

wet-noon-14291

11/08/2020, 12:19 AM

I got some weird error when updating azure-nextgen. Anyone seen this?

Copy code

error: failed to discover plugin requirements: illegal semver returned by language host: azurenextgen@vazure-nextgen
0.2.5: Invalid character(s) found in major number "azure-nextgen\n0"

The plugin version is 0.2.5 and the plugin version should also be 0.2.5.

tall-librarian-49374

11/08/2020, 8:54 PM

Related to the error above: if you are using Azure NextGen with .NET, please upgrade your Pulumi CLI to 2.13.0+

prehistoric-nail-50687

11/09/2020, 3:00 PM

I’m migrating from terraform to pulumi using

pulumi/azure-nextgen

now I need to add a custom domain (and a managed certificate) to a

web.WebApp

but I can’t find any hint on how to do so. Anyone knows more?

icy-jordan-58549

11/11/2020, 8:00 AM

Has anyone ever created AzureNextgen Budget resource, getting this error:

Copy code

azure-nextgen:consumption/latest:Budget (budget):
    error: pollingTrackerBase#pollForStatus: failed to send HTTP request: StatusCode=0 -- Original Error: Get "<https://costmanagement.trafficmanager.net/subscriptions/393dab78-686f-41be-b9d5-f244fb11eba7/resourcegroups/hub-rg/providers/Microsoft.Consumption/budgets/hub?api-version=2019-10-01>": local error: tls: no renegotiation

clever-byte-21551

11/11/2020, 10:42 AM

I’m starting write some new stacks for Azure and I was wondering if I should go ahead and use the azure-nextgen ? Is it relatively stable any known issues?

mysterious-australia-14256

11/11/2020, 11:49 AM

Hi, is it possible to remove a SystemAssigned Identity on a Storage Account created with AzureNextGen? I have tried the following 1. setting StorageAccountArgs Identity to null. This causes "pulumi preview" to report that the identity needs to be removed and running "pulumi up" reports that the object was updated but doesn't actually seem to change anything (i.e. "export template" in the Azure portal still shows the identity). Subsequent "Pulumi up" runs (with or without -r) report no change required. 2. setting the IdentityArgs type to "None" but this errors saying that Type must be one of ['SystemAssigned']

prehistoric-nail-50687

11/11/2020, 4:04 PM

Looking at the example of an ApplicationGateway at https://www.pulumi.com/docs/reference/pkg/azure-nextgen/network/applicationgateway/ specially at this bit:

Copy code

frontendIPConfiguration: {
                id: "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/frontendIPConfigurations/appgwfip",
            },
            frontendPort: {
                id: "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationGateways/appgw/frontendPorts/appgwfp",
            },

I was wondering if there is some way to do something like a self-reference (e.g.

this

self

) Because the objects referenced in these example are aztually referencing an other object within the same resource. So this would become something like:

Copy code

frontendIPConfiguration: {
                id: "${self.id}/frontendIPConfigurations/appgwfip",
            },
            frontendPort: {
                id: "${self.id}/frontendPorts/appgwfp",
            },

It feels very wrong to create the whole path/reference by hand, specially as I would also need access to the

subid

(SubscriptionID) which I think one should not deal with, it is implicit given by the connected user/principal.

colossal-school-15171

11/11/2020, 8:00 PM

Trying to get an azure function app running and I keep getting this error:

Copy code

Error: Invoke of 'azure:storage/getAccountBlobContainerSAS:getAccountBlobContainerSAS' failed: "container_name": required field is not set ()
        at deserializeResponse (/home/kyle/workspace/ops/mapped_infrastructure/node_modules/@pulumi/pulumi/runtime/invoke.js:194:15)
        at /home/kyle/workspace/ops/mapped_infrastructure/node_modules/@pulumi/pulumi/runtime/invoke.js:145:20
        at Generator.next (<anonymous>)
        at fulfilled (/home/kyle/workspace/ops/mapped_infrastructure/node_modules/@pulumi/pulumi/runtime/invoke.js:18:58)
        at processTicksAndRejections (node:internal/process/task_queues:93:5)

but those resources seem to be validly defined in my index.ts file:

Copy code

// The container to put our files into
const container = new azure.storage.Container("files", {
    
    storageAccountName: storageAccount.name,
    containerAccessType: "private",
});

// <http://ASP.NET|ASP.NET> deployment package
const blob = new azure.storage.Blob("zip", {
    storageAccountName: storageAccount.name,
    storageContainerName: container.name,
    type: "Block",
    source: new pulumi.asset.FileArchive("<https://github.com/mapped/connector-functions/suites/1471048737/artifacts/25311357>"),
});

anyone have any ideas what's going on?

clever-byte-21551

11/15/2020, 1:54 PM

Has anybody used

pulumi/azure-nextgen

to create AKS clusters with user assigned identities?

dry-solstice-28057

11/16/2020, 3:35 PM

Hey all 🙂 Fairly new to Pulumi, and loving it so far. Looking for some support if anyone can help? I've set up a database (using Azure.Sql.Database) but can't see how I can configure a long term retention policy. I can see it is available on the Azure.MSSql.Database custom resource, but not Azure.Sql.Database.

icy-jordan-58549

11/17/2020, 4:02 PM

Hi everyone, just curious why there are separate components in the old azure provider for Firewall

Copy code

azure.network.FirewallNatRuleCollection
azure.network.FirewallApplicationRuleCollection
azure.network.FirewallNetworkRuleCollection

but not inside

nextgen

? Is it due to the structure of ARM templates? Is it possible to decouple those components outside from the large https://www.pulumi.com/docs/reference/pkg/azure-nextgen/network/azurefirewall/ ?

colossal-school-15171

11/19/2020, 5:23 AM

hey all, I’m having a hard time getting my pulumi program to authenticate into an existing Azure Container Registry to grab the image it needs to build and deploy to an AKS cluster.

Copy code

let coreLabels = { app: "core" };
let coreDeployment = new k8s.apps.v1.Deployment("core", {
    spec: {
        selector: { matchLabels: coreLabels },
        replicas:  1,
        template: {
            metadata: { labels: coreLabels },
            spec: {
                containers: [{
                    name: "core",
                    image:"<http://mappeddev.azurecr.io.blob.core.windows.net|mappeddev.azurecr.io.blob.core.windows.net>",
                    ports: [{ containerPort: 80 }]
                }],
            },
        },
    },
});

which gives this error diagnostic:

Copy code

Type                                                          Name                       Status                  Info
     pulumi:pulumi:Stack                                           mapped_infrastructure-aks  **failed**              1 error
 ~   ├─ kubernetes:apps/v1:Deployment                              core                       **updating failed**     1 error
 ~   ├─ azure-nextgen:containerregistry/v20190501preview:ScopeMap  acrScopeMap                **updating failed**     [diff: ~actions]; 1 error
 ~   └─ azure:containerservice:KubernetesCluster                   aksCluster                 updated                 [diff: ~addonProfile]
 
Diagnostics:
  kubernetes:apps/v1:Deployment (core):
    error: 5 errors occurred:
        * the Kubernetes API server reported that "core-1je2id4a" failed to fully initialize or become live: 'core-1je2id4a' timed out waiting to be Ready
        * [MinimumReplicasUnavailable] Deployment does not have minimum availability.
        * [ProgressDeadlineExceeded] ReplicaSet "core-1je2id4a-cd7d9599d" has timed out progressing.
        * Minimum number of live Pods was not attained
        * [Pod core-1je2id4a-cd7d9599d-k4n9v]: containers with unready status: [core] -- [ImagePullBackOff] Back-off pulling image "<http://mappeddev.azurecr.io.blob.core.windows.net|mappeddev.azurecr.io.blob.core.windows.net>"

I’ve tried creating a token using the example code here: https://www.pulumi.com/docs/reference/pkg/azure-nextgen/containerregistry/token/ it gives me this error

Copy code

azure-nextgen:containerregistry/v20190501preview:Token (token):
    error: Code="CertificateAuthNotSupported" Message="Certificate authentication is not yet supported. For more information on repository permissions, please visit <https://aka.ms/acr/repo-permissions>."