No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Basically stuck here until I can figure it out

that's how I resolved that issue in the past on Kubernetes

Any advice on jumping through a bastion during a pulumi run?

or anything else you bootstrap after your bastion hosts that only has private ips

worst case I'm going to run CD inside the vpc but I'd rather not

Probably a collection of techniques.

• OpenSSH allows you to configure proxy hosts
• Set up port forwards
• Use OpenSSH's dynamic port forward (SOCKS) support, but I'm not sure how to configure pulumi to use a socks proxy

well pulumi is also provisioning the bastion hosts

so either I have to do something between stack runs

I'm also somewhat skeptical of using pulumi to configure individual hosts? I'm relatively new to pulumi, but it seems like that would be better done with ansible/puppet/saltstack/etc?

&gt; or anything else you bootstrap after your bastion hosts that only has private ips

I assume you mean like instances?

or ideally I can start some tunnels after pulumi provisioned the bastion instances

yeah, if your VPC is being managed as part of the stack, you might be SOL

pretty much every solution I can think of for that is messy, and I'm not sure anything deals with it well

(well, CloudFormation _might_, but that's because it's running from a Special Place)

mainly because your code stops after pulumi gathered the deployment plan

alright, I'll output the ips/instance names, start tunnels and start the next stack :slightly_smiling_face:

like, if you want every deployment of the app to have its own VPC with fully-private IPs and networking, you need to configure the VPC, configure the access point to the VPC (VPN, bastion host, etc), and configure your local machine/pulumi to use it while in the run

yeah, i would break up that stack into two parts, and build up some tooling to try to make it as automatic as possible