Hello, I am using successfully getClientConfig (from @pulumi/azure-native/authorization) to retrieve the subscriptionId when running Pulumi locally. Now I am configuring GitHub Actions to use OIDC for login and although everything is running fine and the login is successful, the subscriptionId is now coming empty only on the workflow, probably related to the login difference. This is breaking some Id references. Is there any other way to refer to the subscriptionId and tenantId which works for both login patterns?

Has anyone seen a tutorial on getting an AKS cluster up and running with Application Gateway ingress using azure-native? is it possible?

I have a question, I am using C# with Azure Native and I am creating a key vault and secrets. I create my key vault var vault = new Vault(vaultName, new() { VaultName = vaultName, ResourceGroupName = resourceGroup.Name, Properties = new Pulumi.AzureNative.KeyVault.Inputs.VaultPropertiesArgs { //removed }, EnableSoftDelete = false, EnabledForDeployment = true, EnabledForDiskEncryption = true, EnabledForTemplateDeployment = true, Sku = new Pulumi.AzureNative.KeyVault.Inputs.SkuArgs { Family = "A", Name = Pulumi.AzureNative.KeyVault.SkuName.Standard, }, TenantId = identity.TenantId, }, }); and secrets like var newSecret = new Secret(Name, new() { ResourceGroupName = resourceGroup.Name, VaultName = keyVault.Name, SecretName = Name, Properties = new Pulumi.AzureNative.KeyVault.Inputs.SecretPropertiesArgs { // Only provide the value during an actual deployment. // This prevents updating the secret during a pulumi preview. Value = "SECRET VALUE", }, }, new CustomResourceOptions { DependsOn = keyVault, IgnoreChanges = { "Properties" } }); Everytime I run pulumi up it overrides the values in my keyvault, even thought I have ingore changes on. Anyone know why?? My goal here is to have Pulumi create the key vault and the secrets, and then we will go in manually to the keyvault and update the secrest with the real secret values, we only want Pulumi to create the outline of the secrets and a placeholder value Anyone know what I am doing wrong?

Hi All, I am trying to fetch the role definition name using below code (it has valid subscription_id in real code)

subscription_id = 00000000-0000-0000-0000-000000000000
role_definition_id = "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
role_assignment_name = azure.authorization.get_role_definition(
                    scope=f"/subscriptions/{subscription_id}",
                    role_definition_id=role_definition_id,
                ).name

However I get error message like : In the error message it is seen that few things are getting repeated, not sure why.

RBAC name Error: invoke of azure-native:authorization:getRoleDefinition failed: invocation of azure-native:authorization:getRoleDefinition returned an error: request failed /%2Fsubscriptions%2F00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/%2Fsubscriptions%2F00000000-0000-0000-0000-000000000000%2Fproviders%2FMicrosoft.Authorization%2FroleDefinitions%2Fb24988ac-6180-42a0-ab88-20f7382dd24c: autorest/azure: Service returned an error. Status=404 <nil>

Hi everyone, I am trying to add a ManagementPolicy (in golang) to an azure storage account. Unfortunately, it always fail because when I create it, it throw an error that the HTTP resource does not exist, which is true because it is not created. What am I doing wrong here? go.mod

<http://github.com/pulumi/pulumi-azure-native-sdk/storage|github.com/pulumi/pulumi-azure-native-sdk/storage> v1.102.0

import (
	"fmt"
	"<http://github.com/pulumi/pulumi-azure-native-sdk/storage|github.com/pulumi/pulumi-azure-native-sdk/storage>"
	"<http://github.com/pulumi/pulumi/sdk/v3/go/pulumi|github.com/pulumi/pulumi/sdk/v3/go/pulumi>"
	"<http://github.com/pulumi/pulumi/sdk/v3/go/pulumi/config|github.com/pulumi/pulumi/sdk/v3/go/pulumi/config>"
	"strings"
)

_, err := storage.NewManagementPolicy(ctx,
			fmt.Sprintf("%v-management-policy",
				storageAccountNamePulumi),
			&storage.ManagementPolicyArgs{
				AccountName:          storageAccount.Name,
				ResourceGroupName:    pulumi.String(sa.ResourceGroupName),
				ManagementPolicyName: pulumi.String("delete"),
				Policy: &storage.ManagementPolicySchemaArgs{
					Rules: &storage.ManagementPolicyRuleArray{
						&storage.ManagementPolicyRuleArgs{
							Enabled: pulumi.Bool(true),
							Name:    pulumi.String("DeleteRule"),
							Type:    pulumi.String("Lifecycle"),
							Definition: &storage.ManagementPolicyDefinitionArgs{
								Actions: &storage.ManagementPolicyActionArgs{
									Version: &storage.ManagementPolicyVersionArgs{
										Delete: &storage.DateAfterCreationArgs{
											DaysAfterCreationGreaterThan: pulumi.Float64(30),
										},
									},
								},
							},
						},
					},
				},
			},
			pulumi.Parent(storageAccount),

Output:

+      └─ azure-native:storage:ManagementPolicy  infra-poc-dev-storage-account-files-management-policy  **creating failed**     1 error


Diagnostics:
  azure-native:storage:ManagementPolicy (infra-poc-dev-storage-account-files-management-policy):
    error: autorest/azure: Service returned an error. Status=404 Code="HttpResourceNotFound" Message="The request url <https://management.azure.com/subscriptions/25bdf887-1695-4563-bdeb-bb568e0246c8/resourceGroups/infra-poc-dev/providers/Microsoft.Storage/storageAccounts/infrapocdevfiles/managementPolicies/delete?api-version=2021-02-01> is not found."

Thanks :)

Hello, I'm upgrading from

@pulumi/azure

v4 to v5 and I'm running into a panic from the terraform provider:

panic: interface conversion: interface {} is nil, not []interface {}
    goroutine 88 [running]:
    <http://github.com/hashicorp/terraform-provider-azurerm/internal/services/containers/migration.KubernetesClusterV1ToV2.UpgradeFunc.func1({0x7ae1400|github.com/hashicorp/terraform-provider-azurerm/internal/services/containers/migration.KubernetesClusterV1ToV2.UpgradeFunc.func1({0x7ae1400>?, 0xc00040cf90?}, 0x669bb80?, {0xc002184990?, 0x7ae1400?})
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-provider-azurerm@v1.41.1-0.20230214191339-39b1d1d475ad/internal/services/containers/migration/kubernetes_cluster.go:1231 +0x2fe
    <http://github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk.StateUpgrades.func1({0x7adef78|github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk.StateUpgrades.func1({0x7adef78>, 0xc000138028}, 0x2?, {0x6622f40, 0xc00041dc00})
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-provider-azurerm@v1.41.1-0.20230214191339-39b1d1d475ad/internal/tf/pluginsdk/state_upgrades.go:52 +0x64
    <http://github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.UpgradeJSONState({0x7adef78|github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.UpgradeJSONState({0x7adef78>, 0xc000138028}, 0x0?, 0xc001480d80?, 0xc000efc2a0?, {0x6622f40, 0xc00041dc00})
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20220824175045-450992f2f5b9/helper/schema/grpc_provider.go:449 +0xa7

I searched the slack archive and found 2 other people mention it but no followup solutions 1. https://archive.pulumi.com/t/8205008/Hey-all-We-recently-updated-azure-classic-golang-from-v4-to- 2. https://archive.pulumi.com/t/2751297/Hi-All-Please-help-When-upgrading-pulumi-azure-from-4-to-5-I I can't find the corresponding version of the code in

<http://github.com/pulumi/terraform-provider-azurerm|github.com/pulumi/terraform-provider-azurerm>

because there's no

v1.41.1

tag and that number seems wrong (in the logs) given v5 of the

@pulumi/azure

package is using the provider at version

5.35.0

If I look at the code for

5.35.0

then it seems like there's a nil reference issue on this line of code: https://github.com/pulumi/terraform-provider-azurerm/blob/upstream-v3.35.0/internal/services/containers/migration/kubernetes_cluster.go#L1231 In my pulumi state i have the following under the state outputs for my cluster

"roleBasedAccessControl": {
                        "azureActiveDirectory": null,
                        "enabled": true
                    },

And verbose pulumi output shows that it's being passed as a terraform input to the provider

I0508 15:44:02.523773 1459043 log.go:75] eventSink::Infoerr(<{%reset%}>I0508 15:44:02.523744 1459133 schema.go:492] Created Terraform input: role_based_access_control = map[enabled:true]

I also tried removing the field from the state file and attempting to preview on that but it still fails with the same panic on the same line. Has anyone else hit this issue and know the solution?

Does anyone have experience with deploying a linked service for synapse with the azure native package?

Hey guys, a colleague was testing using a service principal locally on an azure-native project by adding the Client ID, Secret, Tenant ID etc to the config file on one of the stacks. He has since removed those config entries and now when I attempt to manage the project locally I get the following error

error: autorest/Client#Do: Preparing request failed: StatusCode=0 -- Original Error: clientCredentialsToken: received HTTP status 401 with response: {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app 'XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX'

Has anyone come across this? It seems like Pulumi is still attempting to authenticate using the service principal and not the Azure CLI account. Thanks!

Hello guys! Anyone knows how to bind a managed certified with a custom domain in an app service? Thanks!

Hey everyone! Does someone know how to avoid resource recreation in case if resource that my stack depended on was recreated? Basically, in my stack I am creating SQL server, in the stack I also rely on shared resource group with Analytics workspace. I get this resource group by using GetResourceGroup.InvokeAsync function. The group with analytical workspace was deleted, I have performed refresh on my stack with database, but it didn’t help.

Pulumi AI keep suggesting I use

azure_native.devices.listIotHubResourceKeys

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const resourceGroupName = "example-rg";
const iotHubName = "example-iothub";

const iotHubKeys = pulumi.all([resourceGroupName, iotHubName]).apply(([rgName, iotName]) =>
    azure_native.devices.listIotHubResourceKeys({
        resourceGroupName: rgName,
        resourceName: iotName,
    }),
);

iotHubKeys.apply((keys) => {
    for (const key of keys.value) {
        console.log(`KeyName: ${key.keyName}, Rights: ${key.rights}`);
    }
});

export const iotHubResourceKeys = iotHubKeys;

but I get the following exception: unrecognized data function (Invoke): azure-nativedeviceslistIotHubResourceKeys

Diagnostics:
  pulumi:pulumi:Stack (DDSConnected-dev):
    error: Error: invocation of azure-native:devices:listIotHubResourceKeys returned an error: unrecognized data function (Invoke): azure-native:devices:listIotHubResourceKeys
        at Object.callback (C:\dev\DDS\DDSConnected\Infrastructure\node_modules\@pulumi\runtime\invoke.ts:172:37)
        at Object.onReceiveStatus (C:\dev\DDS\DDSConnected\Infrastructure\node_modules\@grpc\grpc-js\src\client.ts:356:26)
        at Object.onReceiveStatus (C:\dev\DDS\DDSConnected\Infrastructure\node_modules\@grpc\grpc-js\src\client-interceptors.ts:455:34)
        at Object.onReceiveStatus (C:\dev\DDS\DDSConnected\Infrastructure\node_modules\@grpc\grpc-js\src\client-interceptors.ts:417:48)
        at C:\dev\DDS\DDSConnected\Infrastructure\node_modules\@grpc\grpc-js\src\resolving-call.ts:111:24
        at processTicksAndRejections (node:internal/process/task_queues:78:11)

The same goes for

azure-native.devices.listIotHubResourceKeysForKeyName

Hi, trying to get started using Pulumi. I have my dev resource group populated with the resources I need. I'm trying to run the import cli tool to generate example for me, My command looks like this:

pulumi import azure-native:resources:resourceGroup [RESOURCE_GROUP_NAME] /subscription/[SUBSCRIPTION_ID]

However I'm getting the following error:

error: Preview failed: autorest/azure: Service returned an error. Status=400 Code="MissingApiVersionParameter" Message="The api-version query parameter (?api-version=) is required for all requests."

Any pointers where I am going wrong would be most appreciated

Anyone with any examples of provisioning Azure Front Door with Policies, similar to using "Microsoft.Cdn/profiles/securitypolicies" and "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies"?

👋 Hello folks, Does the

azure classic provider

support

RecordSet

provisioning?

#azure does anyone have idea how to update config map value in k8s from pulumi?

Hi Guys!, I am new to Pulumi. I have created AKS cluster in Azure with Pulumi. When I made changes to cluster through console, is there way to get those changes to Pulumi stack and typescript file? Change : enable auto scaling and change node count from 2 to 1 I did refresh and import when import changes into json file, I can see the changes, but I can't use existing code and when use pulumi up, it's keep failing since it try to delete the subnet

or else, is there way to create a new project with existing stack in cloud or importing it into a json?

How can I add these settings to a Static Web App with a pulumi typescript script? The resource azure-native.web.StaticSite does not have any config properties 🤷‍♂️

📣 We've released a preview of the Pulumi Azure Native Provider v2. Please feel free to take it for a spin and provide feedback to me directly and/or by opening an issue. Here's the epic for tracking. Thanks!

I'm using the

pulumi_azure_native

Python package - latest release

v.1.102.0

and need to use the

2022-11-01

API spec version for

Microsoft.Network

but it's not present in the Python package. Not sure how the structure works within the repository for enabled API specs but this spec seems to have been added to v1-removed.json last month with this commit from @melodic-tomato-39005. Also see that the nightly-sdk-generation build has been failing for the 2 weeks but don't know if that is connected. Any tips or tricks on how I would go about this?

Hello Team, I am using Azure native servicebus topic and queue https://www.pulumi.com/registry/packages/azure-native/api-docs/servicebus/topic/. I have specified a premium sku tier for servicebus. How can I specify the message size for the queues and topics? There's a property to set the max size for the queue but doesn't see the configuration for setting the message size.

Anyone got some hints on creating my own AzureAD provider? I’ve done this before - just by setting the tenant/clientid/clientsecret values of the AzureAD.ProviderArgs(), but now when I use the same code (months later) I’m getting this: System.ArgumentNullException: [Input] Pulumi.AzureAD.ProviderArgs.MetadataHost is required but was not given a value (Parameter ‘MetadataHost’)

Hello Team, Do you have an idea how can I configure IAM for Storage account in Azure, in my case to give role reader for some container in storage account ?

Hello everyone, we are currently experiencing following error when running

pulumi up

against our existing AKS with no code changed:

Previewing update ([redacted]/dev)

View in Browser (Ctrl+O): <https://app.pulumi.com/[redacted]/azure-kubernetes/dev/previews/2ab6b03c-327c-48a6-a3a0-5280c05e66a3>

     Type                          Name                           Plan     Info
     pulumi:pulumi:Stack           azure-kubernetes-dev                    
     └─ azuread:index:Application  infra-poc-dev-aks-application           1 error


Diagnostics:
  azuread:index:Application (infra-poc-dev-aks-application):
    error: unmarshaling urn:pulumi:dev::azure-kubernetes::pulumi:pulumi:StackReference$azuread:index/application:Application::infra-poc-dev-aks-application's instance state: could not read field public_client: '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[redirect_uris:[]]'

With our Go code looking like this:

package azure

import (
	"<http://github.com/pulumi/pulumi-azuread/sdk/v4/go/azuread|github.com/pulumi/pulumi-azuread/sdk/v4/go/azuread>"
	"<http://github.com/pulumi/pulumi/sdk/v3/go/pulumi|github.com/pulumi/pulumi/sdk/v3/go/pulumi>"
)

func CreateApplication(
	ctx *pulumi.Context,
	name string,
	opts ...pulumi.ResourceOption,
) (*azuread.Application, error) {

	// * <https://www.pulumi.com/registry/packages/azuread/api-docs/application/>
	application, err := azuread.NewApplication(
		ctx,
		name,
		&azuread.ApplicationArgs{
			DisplayName: pulumi.String(name),
		},
		opts...,
	)
	if err != nil {
		return nil, err
	}

	return application, nil
}

In my current understanding this is related to the fact that both

PublicClient

and

GroupMembershipClaims

were deprecated in

azuread.ApplicationArgs

and are using a different types in newer Azure AD implementations. But I have no idea how to fix the error above because we are not configuring both explicitly. Thanks :)

Hello #azure, I have an issue with error handling. I would like to create a private link only if the key vault resource already exists. Is it possible to develop a try-catch statement to catch any error that may occur so that the pulumi execution does not fail? It should be okay if the resource does not exist, the PE should just not be created. Is this a possibility? Also, is it possible to validate this in resources from other Azure subscriptions?

Hello #azure, Trying to update our Ubuntu VM from 18.04 to 20.04 by changing the SKU parameter of the ImageReferenceArgs. It failed with the following error:

autorest/azure: Service returned an error. Status=<nil> Code="PropertyChangeNotAllowed" Message="Changing property 'imageReference' is not allowed." Target="imageReference"

Now I changed our code and added this snippet:

, new CustomResourceOptions()
                    {
                        ReplaceOnChanges = new List<string>() { "imageReference" }
                    }

So that new our code looks like this:

DnsForwarder = new VirtualMachine($"{NamePrefix}-vm-dns-forwarder",
                new VirtualMachineArgs
                {
                    HardwareProfile = new HardwareProfileArgs
                    {
                        VmSize = VirtualMachineSizeTypes.Basic_A0
                    },
                    Location = PrimaryLocation,
                    NetworkProfile = new Pulumi.AzureNative.Compute.Inputs.NetworkProfileArgs
                    {
                        NetworkInterfaces =
                        {
                            new NetworkInterfaceReferenceArgs
                            {
                                Id = networkInterface.Id,
                            },
                        },
                    },
                    OsProfile = new OSProfileArgs
                    {
                        AdminPassword = vmAdminPassword.Result,
                        AdminUsername = "hubdnsvm-admin",
                        ComputerName = vmName
                    },
                    ResourceGroupName = args.ResourceGroupName,
                    StorageProfile = new StorageProfileArgs
                    {
                        ImageReference = new ImageReferenceArgs
                        {
                            Offer = "UbuntuServer",
                            Publisher = "Canonical",
                            Sku = "20.04-LTS",
                            Version = "latest",
                        },
                        OsDisk = new OSDiskArgs
                        {
                            Caching = CachingTypes.ReadWrite,
                            CreateOption = DiskCreateOptionTypes.FromImage
                        },
                    },
                    VmName = vmName,
                    Tags = GlobalTags,
                    AvailabilitySet = new Pulumi.AzureNative.Compute.Inputs.SubResourceArgs
                    {
                        Id = availabilitySet.Id
                    },
                }, new CustomResourceOptions()
                    {
                        ReplaceOnChanges = new List<string>() { "imageReference" }
                    }
                    );

Yet, we keep getting the same error message. Any suggestions here on what we do wrong?

Hello All, I have created azure sql server and database through pulumi azure native provider. When I am trying to delete the same using the stack destroy command, the database is getting deleted. However the sql server is taking 30 mins to process the delete request and at the end I am getting error like

"Code="Failed" Message="The async operation failed."

On subsequent attempt I am getting error like

"Code="DropLogicalServerAlreadyInProgress" Message="Server is already being dropped"

Any idea on what could be the issue?

Hello Team, I am asking for some ideas how to resolve some task We are using Azure subscription for every env, DEV, QA, PROD... our DNS zone is configured for example in QA, and every A record for respected env is there PROD A www.domain.com 10.0.0.1 QA A www-qa.domain.com 10.10.0.1 DEV A www-dev.domain.com 10.50.0.1 As I want to configure CICD pipeline which will change A record for prod from real ip address of our prod k8s to static website/storage account address for cases when we upgrading our prod cluster. I don't know how to handle in pulumi resources for eg, if I start my pipeline in PROD env, but I want to change in resources in DEV env, like I said our DNS zone configuration is in DEV subscription, as per team member I need to create a new pulumi provider for this, but I am not able to find any examples or some ideas. Thank you in advance :)

Hi, I am working on Azure API Management using Pulumi.AzureNative.ApiManagement How can I get 'Product' type from below var productResult = GetProduct.InvokeAsync(new GetProductArgs { ProductId = ApimSettings.ApiManagementProductName, ResourceGroupName = ApimSettings.ApiManagementResourceGroup, ServiceName = ApimSettings.ApiManagementInstanceName }).GetAwaiter().GetResult(); productResult is of type 'GetProductResult' and we need 'Product' type out of it.