With source code and IaaC within the same project and residing in pulumi, if security is concerned just have IaaC inside pulumi and source code in Gitlab? But then separately into different repos defects the purpose of having source and IaaC nicely together as one...?

S3 backend issue: so for reasons I...do not particularly love, we're using multiple AWS accounts that access the same shared S3 bucket for stacks. When I run

pulumi stack ls

as the bucket owner, not every stack created by other accounts in that bucket show up. (Some do. Not all.) When I do

aws s3 ls

, however, the JSON files do appear in the list. I can't read them as the bucket owner, however, and get a 403 on HeadObject/GetObject. My initial expectation was an ACL problem, but I've since run

aws s3 cp

across the entire bucket setting everything to bucket-owner-full-control and while that has in the past worked occasionally (for reasons I am not fully sure of), it's not working now. 1. How can I unjam myself? 2. My intuition is that this is a problem with the S3 client used by Pulumi. What steps can I take to prevent it from happening again?

can pulumi make or use LVM block devices? And, if the AMI being used already has volumes attached to it, would pulumi respect those volumes?

https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/aws/codedeploy/ I'm looking for information on the "TrafficRoutingConfig" block for AWS code deploy. Every reference to it says "is documented below", but there is nothing below there or elsewhere in the #docs

I've been trying pulumi (C#) to deploy to Azure, really easy to get going and it's been a pleasure so far. Microsofts recently released Azure functions premium plan (4:th of november), to my surprise I was able to create the resource in pulumi right away(!), but i'm missing one important property in the PlanArgs, MaximumElasticWorkerCount, i'm guessing it should go in the properties section? This is really "icing on the cake" considering that it's been newly released and all, but would appreciate an indication on when it can be available.

Kind = "Elastic",
				Sku = new PlanSkuArgs
				{
					Tier = "ElasticPremium",
					Size = "EP1",
					Capacity = 1
				}
				//properties for "maximumElasticWorkerCount": 2 doesn't exist yet

I have somehow gotten into a situation where Pulumi thinks it needs to delete a launch configuration but can't.

error: Plan apply failed: deleting urn:pulumi:dev::vm-scaler::eks:index:Cluster$eks:index:NodeGroup$aws:ec2/launchConfiguration:LaunchConfiguration::k8s-dev-ng-nodeLaunchConfiguration: error deleting Autoscaling Launch Configuration (k8s-dev-ng-nodeLaunchConfiguration-b5215a6): ResourceInUse: Cannot delete launch configuration k8s-dev-ng-nodeLaunchConfiguration-b5215a6 because it is attached to AutoScalingGroup k8s-dev-ng-e37cdc2e-NodeGroup-6186KPAWLIPL
    	status code: 400, request id: 1a10ee34-0cc1-11ea-afde-8d216d809694

This occurred after a

pulumi up

failed with this error:

error: Plan apply failed: 1 error occurred:
    	* updating urn:pulumi:dev::vm-scaler::eks:index:Cluster$eks:index:NodeGroup$aws:cloudformation/stack:Stack::k8s-dev-ng-nodes: UPDATE_ROLLBACK_COMPLETE: ["MinInstancesInService must be less than the autoscaling group's MaxSize"]

Is there a way to get myself unstuck from this? Every

pulumi up

now fails with the former error.

I usually get out of these situations by trying

pulumi refresh

or if that doesn't work, manually deleting the thing it Doesn't Like, then running

pulumi refresh

Can you create EKS Managed Node Groups (https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html)? Or does

eks.NodeGroup

already do that?

@ambitious-ram-5811 No dice 😞

When trying to delete the problem resource, Pulumi thinks it doesn't exist:

pulumi state delete urn:pulumi:dev::vm-scaler::eks:index:Cluster$eks:index:NodeGroup$aws:ec2/launchConfiguration:LaunchConfiguration::k8s-dev-ng-nodeLaunchConfiguration
 warning: This command will edit your stack's state directly. Confirm? Yes
error: No such resource "urn:pulumi:dev::vm-scaler::eks:index:Cluster:index:NodeGroup:ec2/launchConfiguration:LaunchConfiguration::k8s-dev-ng-nodeLaunchConfiguration" exists in the current state

@full-dress-10026 If you run

pulumi stack export

do you see that launch configuration listed?

https://azurecharts.com/ for those interested

When importing an app service plan resource on azure, I get the following warning:

=   └─ azure:appservice:Plan  dev                             import     [diff: +location,reserved,sku~kind,name]; 1 warn
Diagnostics:
  azure:appservice:Plan (dev):
    warning: inputs to import do not match the existing resource; importing this resource will fail

Is there a way to diff the current and preview state of apps? The details section gives me some info but it doesn’t present a diff (I’m guessing it might be due to casing Linux vs linux causing pulumi to think that the details do not match.) I have tried running with

-v=3

but did not help that much.

Just a general question. Scenario: I cannot run a successful

pulumi destroy

if the deployed stack contains a bucket with existing objects. I can easily delete such buckets with the AWS CLI (e.g.

aws s3 rb --force

<s3://my-bucket-with-objects>

). (I know this is an AWS restriction that we override with the

--force

flag). Question: Is there a way to tell pulumi to destroy bucket resources even if they have objects inside (and let it handle doing a forceful destroy of these buckets?). This is my ideal scenario instead of running special pre-destroy operations by hand.

is anyone here using pulumi in conjunction with spinnaker? Any thoughts on this combo?

Anyone using Pulumi for Azure data pipelines? Data factory based? API Gateways? Micro-stacks for deploying different parts of a pipeline?

Hey is this feature in the new update on 1.6.0

pulumi watch

How can I run a bunch of stacks with the same name? So I have a

log_setup

which setup's logging for AWS. They are all in there own named stack with the stack name of

log_setup

, if that makes sense! I want to be able to run them all at once. If possible.

https://aws.amazon.com/blogs/aws/new-application-load-balancer-simplifies-deployment-with-weighted-target-groups/ Is there an ETA for this being supported in Pulumi? I've been following a Terraform issue for many moons about other ALB routing rules that aren't supported yet https://github.com/terraform-providers/terraform-provider-aws/issues/8126 If that isn't available soon, are there any suggested approaches to scripting a workaround for being able to set these routing rules?

I’d like to try out the

pulumi up --target

option, however I am seeing that the preview is not limited to the targeted URN I provide. Is that expected? Will the targeting only affect the actual

up

once I approve it.

Technically Firestore is supported right? I see the Terraform provider, and the generated doc page...I have not seen a single example of anyone using this...anyone know?

Ahh interesting read on the Terraform GitHub page says I should probably be managing all my Firestore stuff from functions...yes that makes sense as I am doing 99% of that currently using Pulumi with GCP Functions...Well then, that's easy enough!

Anyone already deployed linkerd with pulumi? I guess, currently, the only way is to use the helm charts - from github issue (https://github.com/pulumi/pulumi/issues/99) I understand, there is no possibility yet to run (shell) commands within pulumi. Using the helm chart also involves some command line work, since you need to setup the certificates used by linkerd by yourself (https://linkerd.io/2/tasks/install-helm/). What's the suggested way to do this right now? Write a shell script that runs the commands and pulumi - this is the only thing that comes to my mind right now. Any advice is greatly appreciated.

Does pulumi support storageClass with

WaitForFirstConsumer

? When I make a PVC with Pulumi, pulumi hangs waiting for it to no longer be pending, which won’t happen unless the pulumi controller creates the pods that depend on that PVC.

When running the code below,

pulumi up

had to be run twice in order to create the resources. First time it creates the table and the second time it creates it the item inside the table.

import json
import pulumi
from pulumi_aws import dynamodb

table_default_name = dynamodb.Table(
    'pulumi-poc-test-table',
    hash_key='id',
    attributes=[
        {'name': 'id', 'type': 'S'}
    ],
    write_capacity=1,
    read_capacity=1
)

debug_object_1 = \
table_default_name.name.apply(lambda table_name: \
    dynamodb.TableItem(
        'test_item',
        hash_key='id',
        item=json.dumps({'id': {'S': 'yes'}}),
        table_name=table_name
    )
)

Yesterday, I noticed that the permalink for the s3 backend creates an expiring link to the state file, is possible to either toggle off the display of the permalink or set the permalink to not use an expiring link?

Hi, is it possible to get hold of the "host key" of an Azure Function App using pulumi dotnet? Have been looking around a bit and it seems that it's possible in ARM-templates at least, but recently added. browsing the nodejs-sdk led me to believe that there is a method called getHostKeys() there (https://github.com/pulumi/pulumi-azure/blob/814aeefbe707f94356a8f21fc35e192ce8633607/sdk/nodejs/appservice/zMixins.ts#L832), but cannot find in dotnet?

I'm having an issue that seems to happen only on the latest Pulumi version

1.6.0

. I have a stack reference and retrieve an output using

getOutputSync()

but the output becomes undefined. The same code works with version

1.5.2

. Still in version

1.6.0

, if I execute the following snippet I can see the whole output as expected

namespacesStack.outputs.apply(o => console.log(o));

. Anyone having the same issue?

Hi everyone, I am excited about the prospect of using Pulumi for my IaC. One question I have is have there been any thoughts about incorporating Pulumi into GitOps flows/operators? I am talking about something like Flux CD that will automatically apply and update your K8s clusters to stay consistent with what is in git, even automatically push changes when new images are detected, etc. Flux CD currently expects K8s yaml manifests or HelmRelease CRs, supported kustomize, etc.