pulumi-community #general

cold-coat-35200

11/29/2019, 1:46 PM

Hi, is that normal that the

aws.iam.GroupPolicyAttachment

requires a

pulumi.Input<Group>

and not a

pulumi.Input<string | Group>

like the RolePolicyAttachment? Currently, I want to add a policy attachment to a group, but the group managed outside pulumi, which means I don't have a

Group

resource and I can't get one, because

aws.iam.getGroup

returns a

GetGroupResult

, not a

Group

stocky-island-3676

11/29/2019, 2:16 PM

@colossal-beach-47527 Any reason why you don’t use your Pulumi Docker image inside your CircleCI orbs?

chilly-photographer-60932

11/30/2019, 12:12 AM

Copy code

pulumi:pulumi:Stack (aws-arcus-kitchensink-naveen-srinivasan):
    error: an unhandled error occurred: Program exited with non-zero exit code: 1
 
    The Pulumi runtime detected that 255 promises were still active
    at the time that the process exited. There are a few ways that this can occur:
      * Not using `await` or `.then` on a Promise returned from a Pulumi API
      * Introducing a cyclic dependency between two Pulumi Resources
      * A bug in the Pulumi Runtime
    Leaving promises active is probably not what you want. If you are unsure about
    why you are seeing this message, re-run your program with the `PULUMI_DEBUG_PROMISE_LEAKS`
    environment variable. The Pulumi runtime will then print out additional
    debug information about the leaked promises.
 
Permalink: <https://app.pulumi.com/MINDBODY-Platform/aws-arcus-kitchensink/naveen-srinivasan/previews/2daf38a1-f35b-4223-ba19-ca871a9f5ebd>

fresh-summer-65887

12/01/2019, 5:43 PM

Some feedback from when I demonstrate pulumi .net support to .net people - "why can't I just run my program?". The initial impressions are that requiring pulumi CLI to run the IaC instead of the standard

dotnet run

is "non-standard" and "against the grain". The expectation is that the .net program should be spawning the pulumi "engine" and not the other way around. And to be honest, I can see their point. There was also a couple of other comments • "I want to do other things in my program as part of deployment such as a db migration." • "I want to use this to define resources of my own services" This got me thinking a bit that it inverts things and turns pulumi into more of a platform and a bit more into orchestration which is bit of a fundamental architectural shift, afaik. Anyway, just thought it would be interesting to share.

thankful-optician-22583

12/01/2019, 5:53 PM

Guys, will a representative be at Reinvent 2019?, if so where exactly. Would like to visit.

millions-energy-69153

12/02/2019, 3:41 AM

I’m using

pulumi-awsx

to create an AWS stack for our app as shown here. It consists of three ECS tasks: one for the server (api), one for the client, and one for our worker. I’d like to get

/api*

requests going to the server and the rest going to the client. I’m using an ALB with target groups and a listener rule to try and achieve this. With everything aligned with port 4000, this works great. If I want to have the ALB serve on 80 and the container ports staying on 4000, I get 503 responses. I’ve tried a number of things to do the port mapping, but nothing seems to work. I found this issue: https://github.com/pulumi/examples/issues/267#issuecomment-524598748 which says, “If you’re running on Fargate you have to use the same port as what your container is listening on.” I hope this isn’t the case. Thanks in advance for any guidance you can offer. Pulumi is an amazing tool!

Pulumi_js.js

most-lighter-1731

12/02/2019, 10:48 AM

Hello, I'm trying to run a Fargate task whenever I deploy with

pulumi up

. I'm currently getting a runtime error because it seems pulumi is trying to execute the task during preview inspite of the fact that the call to

TaskDefinition.run()

is inside a pulumi

apply

call. How can I make sure this code is executed during deployment and not before ? The relevant error is

Copy code

error: Running program '/home/luis/Code/outmind/outmind-app/aws-architecture/src/index.ts' failed with an unhandled exception:
    Error: Cannot call '.get' during update or preview.
    To manipulate the value of this Output, use '.apply' instead.

and the origin of this is on

node_modules/@pulumi/ecs/taskDefinition.ts:226:39

where the code is getting the cluster id.

better-actor-92669

12/02/2019, 11:25 AM

Hi Pulumi Community! Is it possible to restore a Google CloudSQL Postgres database from a dump file? Dumps were made via

gcloud sql export

. Can't find it in documentation and source code. I use pulumi_gcp (python). https://github.com/pulumi/pulumi-gcp/blob/master/sdk/python/pulumi_gcp/sql/

cuddly-leather-18640

12/02/2019, 1:24 PM

I’d like to try using pulumi at my organization. We use self-hosted gitlab and gsuite and I can’t figure out how to sign up for pulumi using either of those options. The gitlab SSO redirects to the managed version of gitlab and using other SSO requires my organization already exist in the pulumi ecosystem. Am I going about this the wrong way?

colossal-plastic-46140

12/02/2019, 2:52 PM

Hi Folks, it looks like we are seeing a regression after versions 1.5.1 https://github.com/pulumi/pulumi/issues/3596

cuddly-leather-18640

12/02/2019, 3:10 PM

The docs (https://www.pulumi.com/docs/intro/concepts/project/) for pulumi say that: “In Python, there should either be a main.py file or a file setup.py that defines the entry point”. What are the consequences of not having either of those? We use django and have a manage.py

little-energy-64187

12/02/2019, 3:46 PM

is there a way to require secret outputs from another stack?

better-rainbow-14549

12/02/2019, 3:49 PM

i'm still getting this when running a stack the second time for an AKS cluster

Copy code

error: decrypting secret value: failed to decrypt: incorrect passphrase, please set PULUMI_CONFIG_PASSPHRASE to the correct passphrase

it's almost as if the azure AKS resource doesn't respect the setting when it initially writes its state to the state file, then the next time round it's trying to decrypt it. i don't know how to test this hypothesis though

bitter-island-28909

12/02/2019, 5:36 PM

I am afraid I am using

additionalSecretOutputs

incorrectly, although I could have sworn this used to work:

Copy code

let pw = new random.RandomString("test-password", {
    length: 8,
    special: false,
    additionalSecretOutputs: ["result", "id"]
});

let param = new aws.ssm.Parameter("test-password", {
    length: 8,
    value: pw.result,
    type: "SecureString"
});

Expectation: The value of the RandomString and SSM parameter are not visible in plaintext in the stack state and web console. Actual: The plaintext is visible in the stack state and web console.

little-energy-64187

12/02/2019, 7:10 PM

I found it a bit inconsistent that for some resources I need to remove the

import

option for already imported resources (and perhaps add

aliases

) otherwise pulumi will try to replace them, but it can stay for k8s resources and no replacement would happen. What can be the reason for that?

ambitious-ram-5811

12/02/2019, 9:50 PM

Has anyone tried to create an Azure

HttpEventSubscription

and gotten back the message "Requested feature is not available in resource group [MY GROUP]. Please try using a different resource group or create a new one."

ambitious-ram-5811

12/02/2019, 9:50 PM

Is this a Billing thing or a Location thing? I feel like it's pretty unlikely that West US 2 doesn't support Azure Functions but maybe?

ambitious-ram-5811

12/02/2019, 9:51 PM

I'm basically following https://www.pulumi.com/blog/serverless-as-simple-callbacks-with-pulumi-and-azure-functions

ambitious-ram-5811

12/03/2019, 1:21 AM

Ok one last annoying question, how can I reference other resources in an

HttpFunction

ambitious-ram-5811

12/03/2019, 1:22 AM

Copy code

const get = new azure.appservice.HttpFunction("Read", {
  route: "items",
  methods: ["GET"],
  callback: async (context, request) => {
    return { status: 200, body: { url: anotherResource.urn } };
  },
});

ambitious-ram-5811

12/03/2019, 1:23 AM

The

inputs

property of HttpFunction seems to be the ticket, but it's zero documented and I haven't found any examples that use it

agreeable-australia-82656

12/03/2019, 5:42 PM

hi I'm interested if there is a way either cli or api or to get an access token rather than via the web front end?

elegant-dress-88912

12/03/2019, 6:29 PM

hello, I can't configure secrets provider Google KMS, it keeps saying

Copy code

Sorry, could not create stack 'dev': secrets (code=PermissionDenied): rpc error: code = PermissionDenied desc = Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource 'projects/<proj>/locations/us-central1/keyRings/<keyring>/cryptoKeys/<key>' (or it may not exist).

I verified that access is OK, I can encrypt/decrypt with gcloud cli

elegant-dress-88912

12/03/2019, 6:43 PM

mb it does not work with symmetric key?

elegant-dress-88912

12/03/2019, 6:48 PM

@bitter-oil-46081 can you help with my question above? Have you tested gcpkms secrets provider? Thanks in advance

glamorous-printer-66548

12/03/2019, 6:48 PM

Hi, I'm trying to adopt a bunch of existing resources into pulumi. To do so I'm using this syntax:

Copy code

new datadog.Dashboard('foo',
  { description: 'foo', layoutType: 'ordered', widgets: [], title: 'foo' },
  {
    import: '3abc-qix-gn5',
  }
);`

Note that in this example the widgets part is under-specified - the to-be-imported resource has already many items under

widgets

. Therefore when I do a preview, I get

inputs to import do not match the existing resource; importing this resource will fail

which is kinda fine. When I do the preview with diff I can actually see what parts in my config are missing. Ideally I'd like to copy the widgets section from the diff and simply copy & paste it into my pulumi (typescript) code, so that I don't have to create all the inputs code from scratch. However while the diff looks javascript-ish, it's missing commas and has all the

and

[arrayindex]

characters. Now my question is: Is there a way I can get a more javascript-ish diff without all those extra characters so that I can simply use the diff as my starting point for the config? Or is there any other way to semi-manually generate pulumi code for existing resources to ease adoption? Note I already tried

pulumi preview --diff --json

but unfortunately the detailed diff is missing when I do so (unlike when running

pulumi preview --diff

which shows the full diff but with all those extraneous diff characters.)

quaint-garden-96746

12/03/2019, 8:34 PM

Hi, now i stack with a problem, when the simple pulumi stack command take a lot of time

Copy code

time pulumi --logtostderr -v=9 stack
I1203 22:28:22.700826   89424 backend.go:408] found username for access token
I1203 22:29:03.110095   89424 backend.go:408] found username for access token
Current stack is stage:
    Owner: project_iac
    Last updated: 7 hours ago (2019-12-03 15:03:51.875385 +0200 EET)
    Pulumi version: v1.6.1
Current stack resources (123):
...
Current stack outputs (7):
...
real	0m40.506s
user	0m0.289s
sys	0m0.093s

the others commands like pulumi up slow as well how can i debug what is the reason of the huge slow down ?

steep-printer-55468

12/03/2019, 9:18 PM

Hello again, I have a question about cross-acount resources. I've got a zone in Route 53 managed in one account (call it A). I'm delegating a subdomain to a zone I'm managing with Pulumi in another account (B). I have a role and policy configured in A to permit B to make the necessary changes to Route 53. Is there any way in my config applying to account B that I can assume the role in A to create the record set in A's Route 53?

worried-engineer-33884

12/03/2019, 11:33 PM

I ran

pulumi refresh

and then on the next

pulumi up

I am getting this error:

Copy code

Error: Cannot find module './servicequotas/index'

I don't have any servicequotas resources in my program. Where is this coming from?

mammoth-psychiatrist-53448

12/03/2019, 11:57 PM

Quick question, is there a way to generate the terraform template?