Morning

Quick question, apologies if this has been covered else where. Is there any idea when C# might be bought into support?

Hi, how do ensure a resource is created after a Helm chart is deployed? If I use the variable the Helm chart is assigned to and add it to dependsOn for the following resource, the Helm chart still isn't deployed first.

So I have nginx

export const nginx = new k8s.helm.v2.Chart("nginx-ingress", {
    repo: "stable",
    version: "0.24.1",
    chart: "nginx-ingress",
    transformations: [addNamespace],
    namespace: "nginx",
    values: {
        rbac: {create: true},
        controller: {
            publishService: {enabled: true},
            stats: {enabled: true},
            service: {
                type: "LoadBalancer",
                externalTrafficPolicy: "Local",
                loadBalancerIP: lbIp
            },
            image: {tag: "0.24.1"}
        }
    }
}, { dependsOn: [nsnginx], provider: clusterProvider });

then this resource

const certmanagerResources = new ConfigFile("cmResources", {
    file: "<https://github.com/jetstack/cert-manager/releases/download/v0.8.1/cert-manager.yaml>", 
},{ dependsOn: [nginx, primaryPool], provider: clusterProvider });

But the ConfigFile always gets generated before the nginx-ingress Helm chart

Many thanks for the support of propagating secrets and encrypting them in the state. I have a follow-on question: how do I do this with a generated secret value? The recommendation seems to be to use the

random

module. However, using the following code, the

result

value of the

RandomString

resource is still present in plaintext in the state (even though it’s correctly hidden as an attribute of the SSM Parameter.)

let password = pulumi.secret(new random.RandomString("my-password", {
        length: 32
    }).result);

    let param = new aws.ssm.Parameter("my-password", {
        name: "/my/password",
        type: "SecureString",
        value: password
    });

I'm having trouble logging in to app.pulumi.com

I logged in to local

pulumi login --local

and now I want to login to the cloud service, but

pulumi login

keeps re-logging in to my local machine

is there any guidance on pulumi and kustomize?

Can I pass the S3 backend flags like

--acl bucket-owner-full-control

? Using Pulumi in a multi-account setup is otherwise kind of prohibitive.

Are pulumi stacks backed up?

Hi Guys, May I have a question about Pulumi / TypeScript - AWS EIP?

I'd like to set an ALB Listener rule with an

http-header

condition, but it looks like Terraform only supports

path-pattern

and

http_host

. https://www.terraform.io/docs/providers/aws/r/lb_listener_rule.html#values It looks like there are many more rules in the console for this:

In cases where Terraform is missing part of the API, what is the standard way to proceed? FYI in this case we can add that rule manually after deployment, NBD.

@swift-painter-31084 I just looked at the code in Terraform, the documentation isn't correct

It actually has no validation

so you can add any of these:

// The field in the HTTP request. The following are the possible values:
	//
	//    * http-header
	//
	//    * http-request-method
	//
	//    * host-header
	//
	//    * path-pattern
	//
	//    * query-string
	//
	//    * source-ip

but it's still way behind!

I will open an issue upstream in the morning about this

I'm trying to pass this in, perhaps the httpHeaderName is just being caught as an invalid key by TF. That is the name I pulled from a network request in the aws console.

{
            field: 'http-header',
            httpHeaderName: 'Origin',
            values: [ '*<http://snopes.com|snopes.com>*', '*snopes.local*' ],
        },

yeah they don't support that 😞

Field can only be those 2 values because of how the API needs different struct values populated

I got another error as well relating to the 'values' key name upon update

Is it possible to set the runtime of my

.onObjectCreated()

lambda (in typescript) to

nodejs10.x

or am I looking at completely recreating the

BucketEventSubscription

class? I’ve looked at the options that are passed through to the handler but it’s just

{ parent: this }

Hmm

CustomResource

-objects are broken for me with the current release (I'm using

v0.17.22

). I always get the following error:

TypeError: opts.parent.__aliases is not iterable
        at new Resource ([...]/node_modules/@pulumi/pulumi/resource.js:117:51)
        at new CustomResource ([...]/node_modules/@pulumi/pulumi/resource.js:270:9)
        at new Resource ([...]/node_modules/@pulumi/pulumi/dynamic/index.js:40:9)
        at new DatabaseUser ([...]/src/database/database-user.ts:7:9)
        at [...]/src/database/gcp/gcp-database-cluster.ts:64:13

The instance of

GCPDatabaseCluster

(which has no aliases) is the parent of a

DatabaseUser

(again without aliases). Maybe this has something to do with the new feature of renaming resources (https://github.com/pulumi/pulumi/pull/2774)? Has anyone seen a similar behavior? The code still worked last week ago 🤔

Im getting the following error when attempting to create a gcs bucket acl:

gcp:storage:BucketACL (bucket-acl):
  error: Plan apply failed: all SubConns are in TransientFailure, latest connection error: connection error: desc = "transport: Error while dialing dial tcp 127.0.0.1:52527: connect: connection refused"

I am getting a protobuf assertion error from Pulumi. I assume it means I'm passing bad data to a gRPC call but the data from

--debug

is not particularly helpful. Is there a way to get more information, like "what resource is wrong"?

Just out of curiosity, is this the best way to create an ECR and build/upload an image?

const ecr = new aws.ecr.Repository("ecr", {
        name: "stream-app/corrective-action-producer"
    });

    const ecrCreds = ecr.registryId.apply(async (registryId) => {
        const credentials = await aws.ecr.getCredentials({
            registryId: registryId,
        });
        const decodedCredentials = Buffer.from(credentials.authorizationToken, "base64").toString();
        const [username, password] = decodedCredentials.split(":");
        return { server: credentials.proxyEndpoint, username, password };
    });

    return new docker.Image("correctiveActionProducer", {
        imageName: ecr.repositoryUrl,
        build: "./",
        registry: ecrCreds
    });

@brief-school-94535 FYI, cutting the release of the GCP provider now to fix your bug...