I am currently evaluating if Pulumi is something that we make use of for managing and bootstrapping our fleet of kubernetes cluster. idea is to bootstrap in common services (efk stack, ingress, namespaces, service account, etc...) i am doing something relatively simple in TypeScript because it has the kubernetes extension SDK, i wrote the same thing in Go and that's fine.

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

const config = new pulumi.Config();
const provider = new k8s.Provider("kubernetes", { kubeconfig: config.require("cluster-config") });

const ta = new k8s.core.v1.ServiceAccount("test-account", {
    metadata: {
        name: "test-account",
        namespace: "default"
    }
}, { provider });


export const tokenName = pulumi.interpolate `${ta.metadata.namespace}/${ta.secrets[0].name}`

type KubernetesData = { [key: string]: string }

export const token = k8s.core.v1.Secret.get(tokenName, tokenName).data.apply(v => {
    return (<KubernetesData>v)["token"]
});

// export const token = k8s.core.v1.Secret.get("default/test-account-token-7rz8w", "default/test-account-token-7rz8w").data.apply(v => {
//     return (<KubernetesData>v)["token"]
// });

1. Argument of type 'Output<string>' is not assignable to parameter of type 'string'.ts(2345) 2. Parameter 'v' implicitly has an 'any' type. however, if i use the call that is commented or this

export const token = k8s.core.v1.Secret.get("harcoded-works", tokenName).data.apply(v => {
    return (<KubernetesData>v)["token"]
});

is this here a less verbose method to getting values from one resource and feed it into another?

Here's an easy one: I demoed Pulumi to my architecture guild. They loved it, but raised a few questions I couldn't answer. The biggest one was around user security of stacks. Let's say I have 4 stacks: 1. the personal dev stack of a devops who wants to test code on his/her own 2. the shared dev stack for a team, which gets updated once code goes to develop 3. the uat stack 4. the prod stack How can I protect stacks so that the dev can create / destroy 1, but our CICD pipeline manages the other 3? So the dev has rights to stack 1, but no rights to muss with stacks 2, 3, and 4?

How can I specify in

.pulumi/ci.json

to use production stack on release tag instead of master branch for Github Actions?

Hi! First off, loving Pulumi, coming from using Terraform and Serverless Framework, I absolutely love the approach. I seem to have run into a use case that I can't seem to find a solution for and have searched quite a bit. I am deploying a Cloud Function to GCP. My Cloud function has a dependency on Prisma Client. The main issue is that I need to run/add a post install script for my cloud function that generates the prisma client. I have tried adding the following to my main package.json file. This doesnt work because when I look at the source being generated for the Cloud function, the package.json is only a few dependency for the function itself and no scripts section.

"scripts": {
    "postinstall": "npx prisma generate"
  }

Am I running into a limitation here? Is there a way to have pulumi deploy a function with a custom package.json to achieve a post install script?

Hi there 🙂. I need help concerning a k8s provider and component resource in a child stack. I am importing resources from a parent stack and creating a provider like so:

const k8sProvider = new k8s.Provider(`${prefix}-k8s-provider`, {
  kubeconfig: clusterStack.getOutput("kubeConfig"),
});

...

const providers = {
  gcp: gcpProvider,
  kubernetes: k8sProvider,
}

and then passing it to a component resource:

const externalDNS = new ExternalDNS(
  `${prefix}-external-dns`,
  {
    labels,
    domain,
    zonePolicy: "sync",
    nodeSelector: {
      [`${domain}/nodeType`]: "main"
    }
  },
  { providers },
  );

I am getting an error that seems to indicate the provider is wrong ? Any pointers I can use, I am out of ideas...

error: Missing required configuration variable 'customer-services:k8sMasterPassword'
        please set a value using the command `pulumi config set customer-services:k8sMasterPassword <value>`

Hi All. Newbie question here, is there a way to handle shared resources? For example say I have two temporary projects that both need to create resources within the same Azure Resource Group. Is there the concept of having whichever project is called first create the resource group? If so, how does cleanup work once the projects are torn down and their resources deleted i.e. how would I automatically remove the Resource Group? I guess what I would like to happen is 1. Pulumi Up one project (this will create the Resource Group and stick some resources in it) 2. Pulumi Up another project that will add resources to the same Resource Group 3. Tear down one of the projects, deleting its resources. Pulumi would 'know' that another project still has a reference to the Resource Group so wouldn't delete it 4. Tear down the other project, deleting its resources. Pulumi would see there are no more references to the Resource Group and also remove that Is that a supported scenario or would I need to manually manage/delete the Resource Group independent from the two projects?

Anyone got some good examples for testing Pulumi deployments in a CI environment?

Hi all, I'm putting together a proposal to use Pulumi as our IaC tool. I see Pulumi has a tf2pulumi tool. Can that be used to translate a Terraform PROVIDER to a Pulumi PROVIDER? I assume some tool like this exists for Pulumi to have so many providers already.

Hello. I just noticed that in v2.0.0 the

getOutputSync

was removed and the

getOutputValue

was introduced. Is there more info on the changes around it? I see that the

…Value

behaves differently from the

…Sync

, but I can’t find any docs on that. Since it uses Promises, I believe the result will be different, right? Is there more info about it? Thanks in advance!

Hi, how can I configure project to keep all Pulumi*.yaml files in separate folder?

Hey, where can I get deets on the update details to tf2pulumi's support for TF 12? When it will be ready, when it will be in beta, etc?

I have a custom

pulumi.ComponentResource

. In the constructor of this component, I create a

gcp.compute.Network

. When unit testing, in the

setMocks

function, as in the examples, I do a

switch(type)

and I only left the

default

clause in there with a

console.log

statement. When running the tests, I create an instance of my component. I expect the

newResource

callback to be invoked twice but I only see it for my component, not for the inner

gcp.compute.Network

. Are my expectations wrong?

What happens if I do a

pulumi login --gcs

in two locations at once and try to deploy the same stack?

Is

v2.0.0

released now?

pulumi new                                                                                                    
warning: A new version of Pulumi is available. To upgrade from version '1.14.1' to '2.0.0', run 
   $ curl -sSL <https://get.pulumi.com> | sh

Pulumi doesn’t seem to be detecting CI properly anymore and is asking for the

--yes

option. Is this intentional?

Hey, i am new to pulumi. can someone share with me what are the best practices for using pulumi with different aws accounts and state buckets, regarding different variables values, using remote state and so on? thanks in advanced.

Hi, Just FYI, https://www.pulumi.com/webinars/pulumi-update-2020-04-29/ form not working, timeout

So I'm using the Rancher2 Provider and

getCluster

returns a promise. I'm then trying to use

getProject

with cluster id via

cluster.then(cluster => cluster.id)

however I get an error saying

Error: Promises cannot be passed in as arguments to a data source call.

How am I supposed to get around that?

One thing which is not clear to me in unit testing Pulumi infra is how to mimic an update of existing infra. How can I mimic in a unit test a certain state as starting point, create my infra and validate the proposed change set? Is it possible?

did

getOutputSync

get removed in pulumi 2.0.0 ??

Is there a way to detect a change in code? I need to pass new and old credentials as env to ensure the app reconfigures itself to use the new credentials.

hi guys, are there any plans or talks on opensourcing the Pulumi api?

Where is the format of the "import" string documented? e.g.: for a namespaced resource in Kubernetes is it: Given resource $NAME, $KIND, and namespace as $SPACE for readability. Namespaced resources: •

$NAME

aka

istio-citadel

- the name of the resource •

$KIND/$NAME

aka

deployment.apps/istio-citadel

- the resource kind and name •

$SPACE/NAME

aka

istio-system/istio-citadel

- the namespace and name of the resource (omitting the resource kind) Non-namespaced resources: •

$NAME

aka

istio-citadel

- the name of the resource •

$KIND/$NAME

aka

deployment.apps/istio-citadel

- the resource kind and name

Further, how does that interplay with Helm Charts? Do I declare

{ import: '???' }

on the chart, or do I use per-yaml resource transformations?

Okay, I think I've answered that question by just trying a bunch of things, leaving me with more questions! 1. Is it possible to pass a dynamic (

Input/Output

) value to the

import

property? I am able to pass an Input/Output to the

metadata.name

and

metadata.namespace

into the object args, but I cannot then reference said name and namespace in the

import

arg? 2. Is it possible to pass in a value for

opts: { import: ??? }

that automatically determines what to import? For Kubernetes resources where the name and namespace are part of the resource itself, that is, for any given object defining

{ metadata: ObjectMeta }

we can determine the ID deterministically, so having to repeat it seems un-DRY.

This is all an XY Problem though, the root problem is: I have a helm chart (ugh) that sometimes hangs (double ugh!) when I try to Pulumi deploy it, and when it hangs it doesn't serialize the state and checkpoints back. This then puts me in a really bad state because I have a bunch of dangling resources that I can't import correctly. How do I handle this?

Are there any plans to create utilities in Pulumi to help with authoring helm charts? It would be amazing to write charts using code rather than YAML + go templates.

Hi! After 2.0 update i'm having troubles managing AWS named profiles. Since in new versions eks cluster access is controlled with a named profile (that's a great thing!). Problem is, that in development env I have a named profile and in CI/CD [github action] a default one. When updating from dev machine profile name is stored in the resource description and CICD pipeline is fails, because it's on a default profile. One of the solutions i'm thinking about is to write ~/.aws/credentials on CICD that has a same profile, but that seams like doing something wrong.. am I missing something here, is there some config variable to allow eks access on a default profile in a github action?

hi, maybe I missed something, but is there a way to set/import/load config/secret values in bulk? I'm asking because my playground project is getting more and more configuration and secret values and creating a new stack is getting annoying. Or can I maybe copy config/secets from another stack? I also startet to use nested config values. Is there no way to set the whole complex config value from e.g. a JSON string?

Just checked policy-packs for the first time. Seems really promising 👍 1. Can you “acknowledge” a CrossGuard-policy,

enforcementLevel: "advisory"

, directly at the resource? To get this check out of the list of policy violations. Similar like

nolint

flags. 2. How can you check if a value is a secret value, i.e. encrypted in the stack? Just read that secrets are unencrypted in policy-pack checks.