pulumi-community #azure

little-orange-65618

08/27/2021, 12:16 AM

How does one specify the API version for a resource? I'm attempting to create a ManagementPolicy for a Storage account and getting a HttpResourceNotFound error, which I'm assuming is because it's using 20210201 instead of 20210401

handsome-state-59775

08/27/2021, 8:14 AM

[Python, azure-native] How do I best express the following via

k8s.storage.v1.StorageClass

Copy code

kind: StorageClass
apiVersion: <http://storage.k8s.io/v1|storage.k8s.io/v1>
metadata:
  name: managed-premium-retain
provisioner: <http://kubernetes.io/azure-disk|kubernetes.io/azure-disk>
reclaimPolicy: Retain
parameters:
  storageaccounttype: Premium_LRS
  kind: Managed

I'd rather use enums and kwargs wherever possible instead of strings.

numerous-action-56322

08/27/2021, 9:44 AM

Hi everyone, I already posted that question earlier on #dotnet which might explain why I'm not getting any feedback but I still can't find a way to create an empty Disk (a Datadisk ) and then attach it to a VirtualMarchine using Azure Native Provider. Typically I can't find the azure native equivalent to DataDiskAttachment . Am I missing something obvious ?

kind-van-98489

08/28/2021, 5:19 PM

Hi all! Does anyone know if there's a way in Azure Native to search for resources via tags? Essentially I'm after an equivalent of the Azure Classic GetResources function which takes a RequiredTags parameter.

kind-mechanic-53546

08/30/2021, 3:40 AM

Has anyone regenerated their cosmos DB passwords due to ChaosDB?

crooked-planet-47987

08/30/2021, 9:30 AM

Hi everyone. Is there a way to track the REST API calls which Pulumi sends to Azure? pulumi up -v=9 contains a lot of details, but not the API calls as far as I can see. Same applies when using --tracing.

limited-carpenter-34991

08/30/2021, 10:41 AM

Hi everyone, where do i find the feature about automatic tls in azure native which we find here: https://www.pulumi.com/blog/hosting-a-static-website-on-azure-with-pulumi/

Copy code

// This will enable HTTPS through Azure's one-click automated certificate deployment.
    // The certificate is fully managed by Azure from provisioning to automatic renewal
    // at no additional cost to you.
    httpsEnabled: true,

In azure nativce the customdomain objects has no httpsEnabled property.

icy-jordan-58549

08/30/2021, 1:25 PM

Hi team, any ideas how I can setup function app with proxy using pulumi-native? I can’t find and API for that

numerous-action-56322

08/31/2021, 7:03 PM

Hi Team, I'm running into the following error when trying to update the image reference of a VM: error: autorest/azure: Service returned an error. Status=<nil> Code="PropertyChangeNotAllowed" Message="Changing property 'imageReference.id' is not allowed." Target="imageReference.id". Anyone facing similar issue ?

enough-butcher-66045

09/02/2021, 6:06 AM

Hey peeps, my scenario is: • I have a core stack in which I want to create an app gateway • In a different stack I want to reference that app gateway and append another backend pool Is this possible? Or is the only solution to modify the core stack to add the backend pools in there? Thanks.

flaky-planet-42808

09/02/2021, 2:50 PM

Hey team - how do I get the identity of the ingress application gateway add-on of AKS cluster? My scenario is as below, I'm creating a new AKS cluster using

ManagedCluster

API with

ingressApplicationGateway

as one of the add-on profiles. After the creation, I’m trying to get the identity of this add-on in-order to assign the required permissions to manage the application gateway. But I’m having trouble getting this identity using

UserAssignedIdentity.Get

. Pulumi preview fails because it expects the identity to be already available but it wouldn’t be until the cluster is created. Thanks!

handsome-state-59775

09/03/2021, 9:25 AM

I'm unable to use the latest API version azure-natives network.PublicIPAddress like so:

pulumi_azure_native.network.PublicIPAddress

Copy code

error: cannot check existence of resource '/subscriptions/.../providers/Microsoft.Network/publicIPAddresses/...': status code 400, {"error":{"code":"InvalidApiVersionParameter","message":"The api-version '2020-11-01' is invalid. The supported versions are '2021-04-01,2021-01-01,2020-10-01,2020-09-01,2020-08-01,2020-07-01,2020-06-01,2020-05-01,2020-01-01,2019-11-01,2019-10-01,2019-09-01,2019-08-01,2019-07-01,2019-06-01,2019-05-10,2019-05-01,2019-03-01,2018-11-01,2018-09-01,2018-08-01,2018-07-01,2018-06-01,2018-05-01,2018-02-01,2018-01-01,2017-12-01,2017-08-01,2017-06-01,2017-05-10,2017-05-01,2017-03-01,2016-09-01,2016-07-01,2016-06-01,2016-02-01,2015-11-01,2015-01-01,2014-04-01-preview,2014-04-01,2014-01-01,2013-03-01,2014-02-26,2014-04'."}}

arm2pulumi suggests

v20200801

. Is it not possible to do this without specifying the API version explicitly?

enough-butcher-66045

09/06/2021, 9:11 AM

Hi there, sorry to bother again. Am I restricted to creating the backend pools in the same project? Or can I create the app gateway first and add a backend pool later?

enough-butcher-66045

09/06/2021, 9:12 AM

Here's what I'm trying to emulate -- there's an "add" button in the backend pools of an app gateway... I can't find a way of doing something like "new ApplicationGatewayBackendPool()"

enough-butcher-66045

09/06/2021, 9:14 AM

I also want to create app gateway rules per pulumi project, i.e. the core stack defines "here's an app gateway" and then other projects via stack reference say "cool, give me the app gateway name/id/whatever and now I want to create my own rule, backend pool, etc."

enough-butcher-66045

09/06/2021, 9:14 AM

if this is not possible then the workaround is that we'll need to set everything up in the core stack, which is not ideal

enough-butcher-66045

09/06/2021, 9:15 AM

I know that with the key vaults there is a similar issue (create keyvault in one project, add secrets in another) and the recommendation is to use azure classic for this particular case -- I'm wondering if there's a similar approach here?

strong-park-55853

09/06/2021, 4:18 PM

Hi, I’m working on a slightly older pulumi stack that is using an older provider version than I have installed locally. I received an error for the missing provider plugin & this error from the install command:

Copy code

pulumi plugin install resource azure v3.42.0
[resource plugin azure-3.42.0] installing
error: [resource plugin azure-3.42.0] downloading from : 403 HTTP error fetching plugin from <https://get.pulumi.com/releases/plugins/pulumi-resource-azure-v3.42.0-darwin-arm64.tar.gz>

I checked the url for the current provider version and it seems to be available. Any help getting access to this version would make my life easier 🙂

proud-dusk-33872

09/07/2021, 6:45 AM

If a blob is deleted as part of a previous failed

pulumi up

, it's missing in the next attempt and the "delete" fails. Is there a way to consider a "delete" operation on a missing blob successful?

wooden-lifeguard-41446

09/07/2021, 12:52 PM

Hi, please help me. I'm using Pulumi up to create management group and then pulumi destroy to delete management group. But it said I don't have delete permission, although I can delete management group manually in the portal. Thank you.

Copy code

does not have authorization to perform action 'Microsoft.Management/managementGroups/delete'

purple-train-14007

09/08/2021, 7:32 PM

Does anyone by chance have an example of using environment secrets to log into an AZ blob backend? Im stuck and not sure what Im doing wrong. Here is my workflow file. Its very simple as Im beta testing actions.

purple-train-14007

09/08/2021, 7:32 PM

Copy code

name: CI

# Controls when the action will run.
on:
  # Triggers the workflow on push or pull request events but only for the master branch
  push:
    branches: [master]
  pull_request:
    branches: [master]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:

  Deploy_Dev:
    runs-on: [WinRunner]
    name: Deploy to Karma Lab Domain
    environment: KarmaLab
    steps:
      - uses: actions/checkout@v2

      - name: Integration Testing
        run: |
          ls

  Deploy_Corp:
    needs: [Deploy_Dev]
    runs-on: [WinRunner]
    name: Deploy to SEA Domain
    environment: SEA

    steps:
      - uses: actions/checkout@v2

      - name: Integration Testing
        env:
          STORAGE_ACCOUNT: ${{secrets.SEA_STORAGE_ACCNT}}
          STORAGE_TOKEN: ${{secrets.SEA_STORAGE_ACCN_PWD}}
        run: |
          $env:AZURE_STORAGE_ACCOUNT = $env.STORAGE_ACCOUNT
          $env:AZURE_STORAGE_SAS_TOKEN = $env.STORAGE_TOKEN
          pulumi login --cloud-url <azblob://pulumi>
        shell: PowerShell

victorious-exabyte-70545

09/08/2021, 10:03 PM

I setup a service connection to the subscription in project settings.

victorious-exabyte-70545

09/08/2021, 10:03 PM

For accessing blob store.

victorious-exabyte-70545

09/08/2021, 10:05 PM

Not sure if that will work in this case.

important-holiday-25047

09/09/2021, 4:44 PM

Hi there, I have a problem regarding the creation of a sas for azure storage: I am using the function 'listStorageAccountServiceSAS' from 'pulumi/azure-native/storage' to generate a SAS Token but it is never accepted when I try it The code looks like this:

Copy code

const blobSAS = storage.listStorageAccountServiceSAS({
        accountName: storageAccountName,
        protocols: storage.HttpProtocol.Https,
        sharedAccessStartTime: "2021-08-08",//new Date(nowDate.getTime() - 60 * 60000).toISOString(),
        sharedAccessExpiryTime: "2021-10-10",//new Date(nowDate.getTime() + 600 * 60000).toISOString(),
        resource: storage.SignedResource.C,
        resourceGroupName: resourceGroupName,
        permissions: storage.Permissions.R + storage.Permissions.W + storage.Permissions.D + storage.Permissions.L + storage.Permissions.A + storage.Permissions.C + storage.Permissions.U,
        canonicalizedResource: "/blob/" + storageAccountName + "/" + storageContainerName,
    });
    return pulumi.interpolate `https://${storageAccountName}.<http://blob.core.windows.net/${storageContainerName}/?${blobSAS.then(x|blob.core.windows.net/${storageContainerName}/?${blobSAS.then(x> => x.serviceSasToken)}`;

I assume it's a problem with the canonicalizedResource, though I am not sure what value could be correct there, as it only allows a value starting with /blob/ When I compare a SAS Token created via azure storage directly and the one i get here I see that the Api Versions are very different: Azure Version: 2020-08-04 Pulumi Version: 2015-04-05 Also the used keywords seem to differ in these version so much that I can't compare them properly Thank in advance

miniature-leather-70472

09/10/2021, 8:48 AM

Is anyone aware of a way to purge a Key Vault once you delete it with Pulumi destroy? At the moment when I'm testing stuff and want to delete and recreate regularly I have to manually go in and purge the vault after running destroy.

wooden-receptionist-75654

09/10/2021, 12:28 PM

Hi Guys, I’m quiet new to

pulumi

and

typescript

and tryin’ to understand how can I get

subnet id

ouf of network.VirtualNetwork

Copy code

import * as network from "@pulumi/azure-native/network";

const virtualNetwork = new network.VirtualNetwork("virtualNetwork", {
  addressSpace: "10.0.0.0/23",
  location: "eastus",
  resourceGroupName: resourceGroup.name,
  virtualNetworkName: managedClusterName,
  subnets: [
    {
      addressPrefix: "10.0.0.0/24",
      name: "subnet-a",
    },
    {
      addressPrefix: "10.0.1.0/24",
      name: "subnet-b",
    },
  ]
});

I can see that virtualNetwork has a subnets list. Didn’t het how to fetch id. Thanks

miniature-leather-70472

09/10/2021, 2:00 PM

The implementation of listStorageAccountSAS seems.... not great. Things like resource group and storage account name are strings rather than Input<string> and if you use the Enum types for permissions etc. you can only specify 1, because again their strings. Is this going to be improved?

millions-journalist-34868

09/13/2021, 10:55 PM

Maybe it's me, but I find it difficult to find lot of examples of using Pulumi with Azure (especially in C#). Some sample from the classic provider have not been upgraded to Native provider so I have trouble to understand how do to do some basic things. For instance assigning a Storage Blob Data Reader role to an Azure Function (through its managed identity) seems complicated. It seems to me that RoleAssignment is what I am looking for but I am not sure how to use it, especially because I think I have to use the guid from this role. Anyone has already done that ?