I'm trying to destroy a stack with a gateway and some lambdas and it seems like pulumi is trying to destroy the awsiampolicies for the lambdas first and encountering "DeleteConflict: Cannot delete a policy attached to entities." What's the work around here that doesn't involve me having to go hand delete everything? (im actually trying to move the api-gateway to a new region by handing the gateway a provider in a different region from where its deployed.)

Does anyone have any nice blog posts etc covering how they’ve used Pulumi at their org? We have a few services (with more coming) which are currently helm charts we deploy with helm onto a cluster provisioned by Pulumi. I can’t decide if it makes most sense to bring those into the existing pulumi stack, or if I should have a seperate pulumi per service which has cross-stack referneces to the main infra stack for getting the kubecontext etc

I’m leaning towards having them seperate, because it feels more sane to only “pulumi up” the stack of the service we are deploying when we do a release, versus having to Pulumi up a potentially extremely large stack

Hoe does tf2pulumi work with modules (if at all)?

have y’all considered abstracting IAM for pulumi in the same way CDK does it? for example, in CDK you can simply specify “read permissions” and it will generate the appropriate iam actions for the specified resource. maybe a crosswalk feature?

How can I reason about the relationship between Pulumi and the Operator Lifecycle Manger and https://operatorhub.io/? (Helm, for example, seems to get in the way of "the Pulumi way" as it hides complexity behind "values") I understand that I might be able to install the OLM via Pulumi, e.g.: https://gist.github.com/offlinehacker/856b64ec5ad5ab3829bf01f1fb29958d - ok, that should be helpful in and of itself. Wouldn't it then make sense to use Pulumi to ask the OLM to install things? Not sure what to search for in the docs to see how this could work. Might be a day 1 vs. day 2 type of dichotomy; maybe I'm not understanding the Pulumi philosophy yet? 🤣

Just tried Pulumi for the last 30 minutes. Want to share my experience and thoughts. Also hope someone can check if I missed/mis-understood anything

Overall, the tutorial is very good, I used AWS and was able to follow the instructions smoothly. Kudos

At first, I am confused why

pulumi new aws-typescript

required me to login. After read a little about project and stack, my understanding is that I’m uploading data to pulumi.com in order to use the tool. I don’t understand why. I’m using aws cdk now. It is a pure tool. So Pulumi is a service?

Also with the interactive prompt, how can I even automate this with CI/CD?

After the project files are generated, I was HORRIFIED when I see

Pulumi.yaml

. The whole point is I don’t want to write CloudFormation yaml or K8s yaml or Helm Chart yaml. I say get rid of it if you can

Just found this at almost bottom of FAQ https://www.pulumi.com/docs/troubleshooting/faq/#how-does-pulumi-depend-on-pulumi-com

Hello guys! I want to understand the best approach to tackle my use case. I have a Pulumi stack for one of my GCP projects. Within that stack, I have a GKE cluster and a Provider class (pulumi_kubernetes python module), via which I apply manifests and connect to the cluster itself. As for now, I apply several helm charts within the same pulumi stack. I want to move all helm-related code/workflows to another stack, with the idea that infrastructure will be in one stack, and helm workflows that significantly increase pulumi execution time will go to another stack. I am trying to understand how to reference my cluster and k8s_provider in another stack. Of course, I can do pulumi import, which means that I will have to keep the code updated in two stacks whenever I want to change either cluster or provider. Are there any other options, e.g., inter-stack dependencies or something similar? Can someone please recommend how to accomplish that?

you can try to use a stack reference: https://www.pulumi.com/docs/intro/concepts/stack/#stackreferences

Hi, I just installed Pulumi on win10 and trying to login to a pulumi server:

>pulumi login <https://app.pulumi.com/>
Manage your Pulumi stacks by logging in.
Run `pulumi login --help` for alternative login options.
Enter your access token: <Access Token from <https://app.pulumi.com/><username>/settings/tokens >

error: problem logging in: getting user info from <https://app.pulumi.com/>: unmarshalling response object: invalid character '<' looking for beginning of value

it seems like I'm missing something.

If I were to create a stack dependency, is it expected that if I reference an output from one stack into another, Pulumi will run that stack to generate that output? For example, I have a stack that creates and exports an AWS VPC, which I reference in another stack

Hi all! Is it possible to use Pulumi automation to deploy a container to Google Compute Engine? I have not found any GCE examples in Github.

Hi, is there a way to force Pulumi showing secrets when checking out diffs? I don't want this permanent, just on an ad-hoc basis.

Hi, is there a way to force a replacement of a resource instead of having an update? To clarify I'm talking about the code itself, not the usage of

--target-replace

on the CLI. At least I couldn't find anything in the ResourceOptions. Thank you.

Another one: is there a way to mark an Output as not a secret? There's a complex structure that I'm getting from a resource and the whole thing is marked as a secret. I want to be able to extract some data using .apply and then mark it as non secret, so that it can show up in diffs.

A CI/CD and state-storing question… Does it make sense to use

file://

as a backend for local development, and have

s3://

in CI/CD? So basically, different backends in different contexts. Thanks!

I've got a go based Pulumi project leveraging the aws providers, when running the first

pulumi preview

to download and compile the go packages, it seems to use all my RAM (16GB) and will eventually crash. Specific details in thread:

What's the best approach for changing providers with already imported resources? For example changing from the Azure provider to the AzureNextGen provider, using the same resource names seemingly will still result in a delete of the original Azure resources, followed by a create under AzureNextGen. Is there a simple way to do an in place swap without having to delete each resource in the state manually, then add an ImportId to reimport everything?

Hi there! Im planing to use Pulumi in a benchmarking environment. The general flow would be like: • Create resources (computes, etc) • Execute benchmarks • Store results • Destroy resources Is there some sort of

Pulumi.Listener()

to, say send a signal (after benchmark execution) to trigger resource destruction?

I am unable to

pulumi destroy

a stack that has a PostgreS database with a created role that owns resources.

role "{role name}" cannot be dropped because some objects depend on it

is the error im getting. I need to reassign owned resources or somehow delete the database before the role that owns resources in it. How can I achieve this? I thought that setting

skipReassignOwned

on the role would help, but even after applying this and re-running destroy I get the same error.

Hello everybody, I've run into something unexpected. I am using pulumi to create and configure resources in GCP using for an organization for which I have an IAM role. (I don't know what my role/roles are because I don't have permission to view them when I got the IAM section in the GCP console) I ran pulumi up to deploy an httpCallbackFunction however when I hit the endpoint and run

pulumi logs -f

I get an error:

error: failed to get logs: 1 error occurred:
        * rpc error: code = PermissionDenied desc = The caller does not have permission

Is this related to my IAM role/how do I fix this issue?

I have a natgateway created by a new awsx.ec2.vpc. Now it is necessary to remove the natgateway and use a transit gateway. Is it possible to change the route table and remove the natgateway with pulumi?

pulumi up

is taking a reallly long time to provision my infrastructure (the preview step is fine, taking only 30 sec). I have about 150 resources in this stack and I'm not sure if that's above the upper limit that it's supposed to reasonably handle. Any change, even just a minor change to a kubernetes resource annotation is taking several minutes. Has anyone else run into something like this? Unfortunately the trace doesn't give me any information on why it takes so long (this is for a 6min 29 sec

up

step)

[{
  "ID": {
    "Trace": "4eb4fcc5ac88eb53",
    "Span": "78a16bb236ea45fb",
    "Parent": "0000000000000000"
  },
  "Annotations": [
    {
      "Key": "Name",
      "Value": "cHVsdW1p"
    },
    {
      "Key": "_schema:name",
      "Value": null
    },
    {
      "Key": "Span.Start",
      "Value": "MjAyMS0wMi0yMFQwMzoxNTo0NC42NzY4ODczWg=="
    },
    {
      "Key": "Span.End",
      "Value": "MjAyMS0wMi0yMFQwMzoyMjoxNC4wNDc4MTZa"
    },
    {
      "Key": "_schema:Timespan",
      "Value": null
    }
  ],
  "Sub": null
}]

I'm on version

v2.21.1

by the way

Hey folks, I am using the "azuread" plugin and I'm running in to trouble setting some properties on applications (https://www.pulumi.com/docs/reference/pkg/azuread/application/). I've worked around this by shelling out in an

Output

but unfortunately this makes me run into another bug that makes the

pulumi destroy

command fail. Ideally I'd like to hook some custom code into the

destroy

flow but it seems the my C# stack doesn't get invoked at all upon delete. Is it possible to hook into the delete flow of a resource? I tried looking into making a custom plugin but they seem to be Go (?) binaries and dynamic providers are not yet available on C#

Hey @white-balloon-205, I've been looking into getting you the traces that you've been asking for, but man, they are so contaminated with passwords and tokens and what not. Is there any scrub command readily available to clean this stuff up? I could try to write a script to scrub stuff myself, but it will most likely take much more time than I'm able to invest at this point... and obviously we don't have any production-sized projects without tokens etc. because that's the whole point of using pulumi to set them... 😞