anyone have a link to an example of creating a kubernetes secret containing a google service account key also created via pulumi?

docker --tlsverify=false Is there a way to prevent TLS Verification in the pulumi api that builds docker containers? I have a VPN and no-VPN use cases, so I bind my docker-daemon to a virtual box network forwarded port so that I can execute the docker daemon commands while on VPN or not. In other words, my virtual box NAT network passes docker daemon port through from 127.0.0.1 to the docker machine IP. I protect the port with a fire wall at the host level, only allowing local traffic. The certs generated are only good for the IP address of the docker virtual machine. I can set DOCKER_* variables and an alias to execute

docker

as

docker -tlsverify=false

and it works, but doesn't work when a pulumi script is running. Any suggestions welcome, not limited to turning off TLS verification in the pulumi API calls to docker.

when configuring a Fargate service in pulumi where can you configure container port if it is not 80 ?

const alb = new awsx.elasticloadbalancingv2.ApplicationLoadBalancer(
    "net-lb",
    {
      external: true,
      securityGroups: cluster.securityGroups
    }
  );

  const web = alb.createListener("web", { port: 80, external: true });
  
  // Step 4: Create a Fargate service task that can scale out.
  const appService = new awsx.ecs.FargateService("scolasticus_api", {
    cluster,
    taskDefinitionArgs: {
      container: {
        image: "scolasticus_api",
        cpu: 256 /*10% of 1024*/,
        memory: 256 /*MB*/,
        portMappings: [web]
      }
    },
    desiredCount: 1
  });

Reminder, we have a Crosswalk community call in an hour at 11am PT, joined by our AWS and Tableau partners. Apologies for the tech difficulties earlier in the week, it will happen this time! Hope to see you there.

Hi all! I'm hoping someone could give me a quick sanity check before I file a bug report on something. I've noticed that attributes of resources that contain a secret value are not encrypted in the stack when the parent resource is exported. However, individual references to that attribute as export are encrypted. In both examples, the output is correctly masked. My expectation is that the secret never shows up in plaintext in the stack export in either case. Am I missing something?

import * as pulumi from "@pulumi/pulumi";
import * as docker from "@pulumi/docker";

const config = new pulumi.Config("secrets-demo");
const containerImage = config.requireSecret("containerImage");

// This exposes the secret in the stack export.
export const remoteImage = new docker.RemoteImage("myImage", {
  name: containerImage
});

const container = new docker.Container(
  "myContainer",
  {
    image: containerImage
  },
  {
    dependsOn: remoteImage
  }
);

// This correctly encrypts the secret.
export const imageName = remoteImage.name;

question: is the terraform

lifecycle

block actually supported? how would it be passed? a lot of docu references it, but I also realize that docu is generated from the tf docs. https://pulumi.io/reference/pkg/nodejs/pulumi/aws/ecs/

You can utilize the generic Terraform resource lifecycle configuration block with ignore_changes to create an ECS service with an initial count of running instances, then ignore any changes to that count caused externally

...the example in the tf docs for this section shows the lifecycle block, but the example in the pulumi version lacks it, making me thing it's being excluded in the autogen somewhere.......

Is there an easy way to use the interfaces from the Pulumi TS Packages? We’re building internal API’s that abstract K8S Deployments and it would be great to have the interfaces used by Pulumi as inputs for some of our ComponentResources, for ex: https://github.com/pulumi/pulumi-kubernetes/blob/master/sdk/nodejs/types/input.ts#L12609-L12656

Is there a way to remove a resource before

pulumi up

?

I'm trying to get the organization name programmatically in order to use cross stack references without hardcoding. Is there an elegant way to approach this? Perhaps something similar to

pulumi.getStack()

?

Hm ran into this error when doing a pulumi update - Cognito gave me an error: https://github.com/terraform-providers/terraform-provider-aws/issues/8827

Hmm, I think i'm having a circular dependency problem. I'm trying to create a CognitoUserPool with a CognitoDomain and CognitoClient resource. CognitoDomain relies on CognitoUserPool Id, CognitoClient also relies on CognitoUserPool Id. However, there in the inviteEmailTemplate email string on the CognitoUserPool resource, the link relies on CognitoDomain and CognitoClient to construct the url so im using Pulumi.all.apply to construct it.

Here's a snippet that are in 3 seperate files

The error i'm getting is

Error: Missing required property 'userPoolId'

on the UserPoolDomain file

Is it because of a circular dependency?

I tried putting

a dependsOn: userPool

in the userPoolDomain file but still no go

Just saw Pulumi.interpolate! Awesome!

Could you give a class for Pulumi on Udemy? There are some classes about cloudformation on Udemy ( https://www.udemy.com/topic/aws-cloudformation/ ). It's easier for beginner to learn new techniques on that kind platform.

hi, is it possible to get the stack state for a previous update/refresh? Or a previous point in time? Would be useful when something went wrong during an update or reset a refresh

Hello @bitter-oil-46081 , in the blog article “Managing Secrets with Pulumi”, could you add bullets to the different ways to create secrets in section “Output and Secrets”?

Hello folks, thanks for creating this framework. We are exploring using it for managing kubernetes (eks) clusters and deployments. I added a PR for some small enhancements : https://github.com/pulumi/pulumi-eks/pull/159 - could someone please review and provide feedback? Thank you.

is that somehow possible to use separate AWS credentials for Pulumi S3 state file access and for 'pulumi up' command? I've thought that 'pulumi login s3://...' actually logins to AWS account but it doesn't seem to be the case

has anyone ran into this

UNKNOWN: failed to compute archive hash

? Figured this out btw.

Hi there, is there a plan for a nomad provider ? https://www.terraform.io/docs/providers/nomad/index.html

I need help with adapting awsx vpc example (https://pulumi.io/reference/crosswalk/aws/vpc/#getting-the-default-vpc) to work across multiple aws profiles

Great new flow for getting started! My minor remarks below.

Hi there, I think I noticed a bug, or maybe I’m doing something wrong. I’d like your advice before opening an issue. When I update a

Deployment

configuration, I noticed it creates a new replicaset and does not delete the old one (or maybe it should update it, I don’t know). So it actually kills all the old pods in the old replicaset and creates the new one as expected, but now I have a stale useless replicasets. Is this something I misconfigured somewhere or is this a bug ?

replicaset.apps/context-clusters-pvmtest-mqtt-5979fbcdbc                       2         2         2       2m13s
replicaset.apps/context-clusters-pvmtest-mqtt-client-68fd4d4445                0         0         0       23m
replicaset.apps/context-clusters-pvmtest-mqtt-client-6b8bdfc4b7                2         2         2       2m13s
replicaset.apps/context-clusters-pvmtest-mqtt-f5bd9548f                        0         0         0       25m
replicaset.apps/context-clusters-pvmtest-portal-567948dccd                     2         2         2       2m13s
replicaset.apps/context-clusters-pvmtest-portal-6c5968cfcd                     0         0         0       26m

hey all. i’m excited about pulumi and giving it a spin. the link for “pulumi community edition” on the pricing page seems to take me to the home page. is this intended? i was hoping to see what was included with the community edition.

Does anyone have a working example of using an external user_data script w/ variables defined in

index.ts

for aws & typescript?