pulumi-community #general

brave-salesmen-42327

01/15/2020, 7:51 PM

Creating a azure.compute.VirtualMachine() If I change the

Copy code

osProfile: {
  customData: `#!/bin/bash\n
    echo "${someConfigValue}"`
}

It does not change the resource according to pulumi cli. Reports All Resources Unchanged, no update or destroy re-create happens. Changing something like

Copy code

vmSize: "SomeOtherSize"

works fine, registers as a change and updates the vm resource.

gifted-beach-2614

01/15/2020, 9:01 PM

hey all, has anyone else had issues with high CPU usage by the python language executor while waiting for EKS clusters to be created? i’m able to reproduce it pretty easily and opened https://github.com/pulumi/pulumi-aws/issues/846 for it but am also curious if anyone else has seen this, offhand

busy-dusk-74339

01/16/2020, 12:50 AM

is anyone else having authentication issues via github?

busy-dusk-74339

01/16/2020, 12:51 AM

when i try to log in i get redirected to app.pulumi.com/github-callback/?code=… which then throws an Internal Server Error

careful-market-30508

01/16/2020, 3:22 AM

Any idea why there is no golang sdk for pulumi-kubernetes ?

late-printer-99022

01/16/2020, 4:16 AM

Hi Community, We have adopted Pulumi with lots of hope to have 100% fully Infra as code. I am pushing my company to adopt Pulumi but facing small problems here or here. Even after posting on slack, I am not getting solution. Please suggest me what to do. Example - https://github.com/pulumi/pulumi-aws/issues/848 Kindly let me know How to fix this error !!

late-printer-99022

01/16/2020, 12:01 PM

My Node.js micrservices POC is going great. finally after so much struggle, I have achieved following things. I am going to make a detailed blog once I am done with all task. 1. [done] create eks cluster 2. [done] create ECR , create services, deployments 3. [done] create Ingress for exposing services and get one ALB url per namespace. 4. [done] created A records for ALB load-balancers. http://api.syn-platform.com/ndvi/ 5. [TODO] instead of http, url must work with "https" 6. [TODO] create multiple urls on project/namespace basic Ex- https://agroproject-dev-api.syn-platform.com/userauth/ etc. 7. [TODO] http to https redirect. 8. [TODO] logging, monitoring, alerts. 9. [TODO] access to developer logging, monitoring, alerts. if anyone can review my code, it will be great. also need suggestions what else can be added in tasks list.

👍 2

late-printer-99022

01/16/2020, 7:03 PM

Target group rule is not updated. I made small change in the path of url in Ingress.

pulumi up

showed me following update.

Copy code

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:prod::syngenta-platform::pulumi:pulumi:Stack::syngenta-platform-prod]
    ~ kubernetes:<http://networking.k8s.io/v1beta1:Ingress|networking.k8s.io/v1beta1:Ingress>: (update)
        [id=syngenta-platform/syngenta-platform]
        [urn=urn:pulumi:prod::syngenta-platform::kubernetes:<http://networking.k8s.io/v1beta1:Ingress::syngenta-platform|networking.k8s.io/v1beta1:Ingress::syngenta-platform>]
        [provider=urn:pulumi:prod::syngenta-platform::eks:index:Cluster$pulumi:providers:kubernetes::syngenta-platform-provider::bb6ecf4e-2c78-4f12-8c8f-0f1b8d4ce3a7]
      ~ spec: {
          ~ rules: [
              ~ [0]: {
                      ~ http: {
                          ~ paths: [
                              ~ [1]: {
                                      ~ path: "/ngnix/*" => "/nginx/*"
                                    }
                            ]
                        }
                    }
            ]
        }

Copy code

Resources:
    ~ 1 updated
    63 unchanged

Duration: 1m3s

But when I went to aws console, the path is not updated in Target Group. did I missed something?

powerful-football-81694

01/16/2020, 8:40 PM

Is there a convenient way in a CI/CD context to automate the creation of a stack if it does not already exist without throwing an error if it does already exist?

➕ 1

powerful-football-81694

01/16/2020, 8:59 PM

On a separate note: I think the task extension for Azure Pipelines has an issue with the commands it suggests in its configuration assistant UI. There is an

init

command in the dropdown, but executing the pipeline yields:

Copy code

Error: unknown command "init" for "pulumi"

Did you mean this?
	new

Run 'pulumi --help' for usage.

worried-engineer-33884

01/16/2020, 9:40 PM

I'm having trouble building the pulumi nodejs sdk. Following the instructions in the README.md it seems i just need to run

make

, but it seems that you need to

npm install

first, but that doesn't work because version in package.json is set to

${VERSION}

. I don't want to hack around too much with this — is there an updated version of development spinup instructions? https://github.com/pulumi/pulumi/tree/master/sdk/nodejs#building-and-testing

flat-insurance-25294

01/16/2020, 11:33 PM

Is there any approach of getting a stack output based on what stack it is?

Copy code

if (config.isProduction == false) {
    export const rdsPassword = rds.masterPassword
}

Like that wouldn’t work.

helpful-kitchen-78641

01/16/2020, 11:40 PM

I am having trouble with ACM and I suspect the cause is from using a specific region provider. I am using an S3 backend, and most of my project will take place in our default region (

us-west-2

). I am creating a certificate in

us-east-1

because I need to use it as part of a cloudfront distribution, which requires the cert to live there.

Copy code

// [...]
const regionProvider = new aws.Provider('us-east-provider', {region: 'us-east-1'});

const certCertificate = new aws.acm.Certificate('cert', {
  domainName: '<http://dashboard.mydomain.com|dashboard.mydomain.com>',
  subjectAlternativeNames: [
    '*.<http://dashboard.mydomain.com|dashboard.mydomain.com>',
  ],
  validationMethod: 'DNS',
  tags,
}, {provider: regionProvider});

const certValidation = new aws.route53.Record('certValidation', {
  name: certCertificate.domainValidationOptions[0].resourceRecordName,
  records: [certCertificate.domainValidationOptions[0].resourceRecordValue],
  ttl: 300,
  type: certCertificate.domainValidationOptions[0].resourceRecordType,
  zoneId: dashboardR53Zone.id,
});

const certCertificateValidation = new aws.acm.CertificateValidation('cert', {
  certificateArn: certCertificate.arn,
  validationRecordFqdns: [
    certValidation.fqdn,
    certValidation.fqdn, // both entries use the same value/name per the AWS console
  ],
});

After running

pulumi up

I receive the following error:

Copy code

Diagnostics:
  aws:acm:CertificateValidation (cert):
    error: Error describing certificate: ResourceNotFoundException: Could not find certificate arn:aws:acm:us-east-1:[REDACTED]:certificate/60c[REDACTED]df9d9.
        status code: 400, request id: 4c00[REDACTED]aef6

I can see the certificate with that ARN in the AWS console, so I'm not sure how to proceed

helpful-kitchen-78641

01/16/2020, 11:42 PM

i can move this to #aws if that's where it should go

helpful-kitchen-78641

01/17/2020, 12:04 AM

figured it out, missing the

{provider: regionProvider}

in the validation 🤦‍♂️

adventurous-vase-24423

01/17/2020, 11:19 AM

Is there a getting started guide for golang?

powerful-football-81694

01/17/2020, 1:22 PM

Hi everyone, I suspect my question went unnoticed so I’m bumping it, and clarifying a bit. I’m looking for a way to create a new stack as part of a DevOps pipeline. The stack name could for example be input using a user-configurable pipeline variable, or it could be the name of the branch that triggered the build. I want to use the Pulumi Task Extension for Azure Pipelines to initialize a new stack if it does not already exist. The obvious thing to try is to use set

command: stack

and

options: init $(StackName)

in the YAML. However, the

Pulumi@1

task has a mandatory

stack

parameter, and the task always tries to select that stack the first thing it does, before it proceeds to execute the actual command, which of course results in an error because the stack does not yet exist.

busy-dusk-74339

01/17/2020, 2:30 PM

my pulumi state has deviated from reality and i’m not sure how to fix it. i have an ec2 instance that i created from a specific commit; it has instance termination protection enabled. a colleague of mine went to add some new ebs volumes to the same stack, and when he went to run pulumi up, it wanted to replace the ec2 instance, because it thought something had changed in its security group definition (i see no such changes in the code). since instance termination was enabled, pulumi failed to delete the original ec2 instance. it did create the replacement instance, but failed before it ever got to the new s3 volumes my colleague was trying to create. even if i check out the commit that i last successfully deployed the ec2 instance from, pulumi still insists there are some sg changes. how do i get back to a sane state, here?

busy-dusk-74339

01/17/2020, 2:32 PM

when i run

pulumi preview --diff

it highlights

securityGroups

as having changes, but the contents of the object are identical to the instance above that it wants to delete …

busy-dusk-74339

01/17/2020, 2:33 PM

Copy code

- aws:ec2/instance:Instance: (delete)
    [id=i-0b024d1ad4cb75dba]
    [urn=urn:pulumi:dev::talend_poc::aws:ec2/instance:Instance::talend_poc_instance]
    [provider=urn:pulumi:dev::talend_poc::pulumi:providers:aws::default_1_8_0::90aafd96-3c4a-4649-9def-fb795391f334]
    ami                  : "ami-04bfa3d65c8508b02"
    disableApiTermination: true
    getPasswordData      : false
    iamInstanceProfile   : "talend_poc_profile-1f0f54b"
    instanceType         : "m4.xlarge"
    keyName              : "ops"
    rootBlockDevice      : {
        deleteOnTermination: true
        volumeSize         : 300
    }
    securityGroups       : [
        [0]: "sg-095e0af0371379410"
        [1]: "sg-078d2ef15a737ac03"
    ]
    sourceDestCheck      : true
    subnetId             : "subnet-08d1f41a5bd97f622"
    tags                 : {
        Name       : "talend-poc"
        application: "talend-poc"
    }
    userData             : "IyEvYmluL2Jhc2gKCnN..."

busy-dusk-74339

01/17/2020, 2:33 PM

Copy code

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::talend_poc::pulumi:pulumi:Stack::talend_poc-dev]
    > pulumi:pulumi:StackReference: (read)
        [id=PLOS/iam/dev]
        [urn=urn:pulumi:dev::talend_poc::pulumi:pulumi:StackReference::PLOS/iam/dev]
        name: "PLOS/iam/dev"                                                                                                                                                                                                                                                                                                                                      +-aws:ec2/instance:Instance: (replace)
        [id=i-099b9ef2206465ee3]
        [urn=urn:pulumi:dev::talend_poc::aws:ec2/instance:Instance::talend_poc_instance]
        [provider: urn:pulumi:dev::talend_poc::pulumi:providers:aws::default_1_8_0::90aafd96-3c4a-4649-9def-fb795391f334 => urn:pulumi:dev::talend_poc::pulumi:providers:aws::default_1_18_0::output<string>]
      ~ securityGroups: [
          + [0]: "sg-095e0af0371379410"
          + [1]: "sg-078d2ef15a737ac03"
        ]

helpful-kitchen-78641

01/17/2020, 7:44 PM

is it possible to read the value of the aws config keys? i.e. I have this in my

Pulumi.stack.yaml

Copy code

config:
  aws:profile: StagingAdmin

and in my

index.ts

code I would like to do something like:

Copy code

const prof = config.require('aws:profile');

helpful-kitchen-78641

01/17/2020, 7:50 PM

ah, found it:

const prof = aws.config.profile;

busy-dusk-74339

01/17/2020, 10:39 PM

any ideas how to troubleshoot changes to a stack?

busy-dusk-74339

01/17/2020, 10:40 PM

pulumi is convinced that it needs to add 2 security groups to my ec2 instance, but when i view the instance in the console, both of the SGs it wants to add are already there

loud-nest-15724

01/18/2020, 1:41 PM

Hi all, I've been digging into how Pulumi stores secrets when using S3 for state management It seems like secret values are being store in plain text in the outputs section of the state. here's a example of the program I am running - https://gist.github.com/Jmen/27f1eaafe3660f384c34b65af6b13d4f and an example of what is stored in the state - https://gist.github.com/Jmen/343468cfe680e12d3613bda9b8378b2b is there currently a limitation in the .net implementation, or the S3 support?

mysterious-egg-7415

01/18/2020, 4:27 PM

Can we get the Terraform ACME provider added to Pulumi: https://www.terraform.io/docs/providers/acme/index.html

steep-toddler-94095

01/19/2020, 3:17 AM

`docker.Image`'s

build.cacheFrom

parameter does not seem to allow me to use an image with a different name as the cache source. It's different from how

docker --cache-from

works. Am I out of luck on this if i want to use another image for the build cache?

broad-dog-22463

01/20/2020, 10:50 AM

Just thought I'd throw this piece of code out there - it's for multiple region deployments of resources in Pulumi - this specific example is for Lambdas

Copy code

const providers: {[key: string]: aws.Provider} = {
    "us-east-1": new aws.Provider("us-east-1", {region: "us-east-1"}),
    "us-east-2": new aws.Provider("us-east-2", {region: "us-east-2"}),
    "us-west-2": new aws.Provider("us-west-2", {region: "us-west-2"})
};

for (const providerKey of Object.keys(providers)) {
    const provider = providers[providerKey];

    const lambda = new aws.lambda.Function(`my-lambda-function-${providerKey}`, {
        name: "lambda-for-account-cleanup",
        runtime: aws.lambda.Go1dxRuntime,
        timeout: 900,
        role: iamRoleArn,
        handler: "main",
        code: new pulumi.asset.FileArchive("../deployment.zip"),
        environment: {
            variables: {
                "DESTROY_ENABLED": "false"
            }
        },
        tags: {
            "Owner": "Stack72",
            "Purpose": "AccountCleanup",
        }
    }, {provider: provider});
}

💯 1

👍 1

limited-rainbow-51650

01/20/2020, 11:09 AM

If I’m not mistaken, the provider code for the various languages supported by Pulumi is mostly generated from TF providers by the bridge support, or from e.g. an OpenAPI/Swagger. Am I correct that higher level abstractions (e.g. Crosswalk) are implemented separately by hand each language at a time?