We are using the Pulumi GitHub App together with the Pulumi GitHub Action to see the preview of the infrastructure changes as comments in our PRs. It works fine, but as a rather crucial omission, the comments do not display warnings that the

pulumi preview

command itself does. In particular, the PR comment shows a resource is going to be imported, but it doesn't tell that the import is going to fail. See the attached output of

pulumi preview

ran locally vs. the PR comment. Is there a way to display the warnings in the PR comments as well?

Is there a way to 'inherit' configs from a Stack? We have 'per engineers' stacks and ideally I'd put the config in the 'main' Pulumi.yaml and not copy it over to every engineer... I found only today about the pulumi cp which is nice but Ideally I'd avoid to copy over and over those configs..

Hi All ! when using k8s.yaml.ConfigFile and changing it, pulumi tries to create new resources on every change and then try to delete the old ones, which it fails to even create new ones since there are already created, anyway to solve this issue ?

does pulumi keep release branches for each version? can't find a 3.3.1 branch

Is there a easy way to update the AWS provider

pulumi:providers:aws

in the stack state (aside from export, delete, import). If you remove (below) the AWS profile config

pulumi config rm aws:profile

it seems to persist in state regardless of what I try unless manually deleted

config:
  aws:profile: someProfile

I'm trying to keep it simple for devs so they don't have to switch between roles (we have several accounts) for each local deploy/testing, but in our automated pipeline we're running

pulumi config rm aws:profile

before

pulumi up --non-interactive -y

as we have instances in each specific account with a IAM Profile attached to provide the needed credentials to run the pulumi updates. But it's keeping that config in the state (tried a

pulumi refresh

) but keep getting

error configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found.

on any refresh/up attempts on any machine that doesn't have the previously set AWS profile configured locally

perhaps a silly question here - but looking at the

providers

option to component resources - does it automatically supply the correct provider to the correct resource, i.e. if i send

{
  kubernetes: kubernetes-provider,
  azure: azure-instance-provider
}

Will the azure provider be used when I perform a

new <http://azure-native.XYZ|azure-native.XYZ>

inside the component resource? Really.. what I'm wondering is.. how do I know what the /name/ of the provider actually is? in this case - is it azure? or azure-native?

I'm using TypeScript and creating some AWS listeners. I want two different ports 443 and 22. I need a clean way to create these without duplicating the new construct. The port property only takes an single string and not an array. Any ideas?

Is there a fast way to find my github repo ID?

I'm really stuck on an issue using a dynamic provider resource. It's kind of a complex case and maybe I am just missing something really obvious. I'll try to summarize as succinctly as possible here: I am trying to create an AWS Client VPN Endpoint for my vpc using the self service portal with single sign-on. The client and the single sign-on portal have to have separate SAML providers, which is supported but it's a new enough feature that it hasn't been added to Terraform yet. (TF issue here: https://github.com/hashicorp/terraform-provider-aws/issues/16019). What I'm trying to do is write a dynamic resource provider to use the aws-sdk directly to create the client vpn endpoint since it supports setting this option. it appears to work, in that it creates the client vpn endpoint and wires everything up the way it should in the first run. It's just that subsequent runs of pulumi update will always try to delete and replace it, even when nothing has changed. Then when it tries to delete I get some errors related to missing parameters that from what I can tell shouldn't be missing based on the code. One complication is that I'm working in an AWS organization setup where resources are managed across multiple aws accounts by explicitly passing providers that assume IAM roles. So I set

AWS_PROFILE

to the "main" account credentials and then create a provider resource for each account I actually want to work in. I don't know how to use the pulumi provider to get credentials for the AWS sdk so I'm just passing a role arn to the dynamic resource and using STS assume role to get temporary credentials. Which appears to work, sometimes. My dynamic resource provider is more or less modeled following the example here: https://github.com/pulumi/examples/blob/master/classic-azure-ts-dynamicresource/cdnCustomDomain.ts

Sorry that's kind of a wall of text. Would be very grateful for any insight.

When building a container during a Pulumi run, I get a lot of output from the docker run itself, which tends to swamp the output coming from Pulumi. Is there any way I can selectively hide that docker output?

Can anyone tell me why Pulumi doesn't simply update an existing resource instead of delete-replace? None of the changes in the diff require a delete-replace. Pulumi simply needs to patch the existing resource. It literally defaults to delete-replace my entire production cluster. It's so annoying. It has cost me days of debugging.

digitalocean:index/kubernetesCluster:KubernetesCluster: (replace) :lock:
        [id=XXXXXXX]
        [urn=urn:pulumi:prod::infra::digitalocean:index/kubernetesCluster:KubernetesCluster::prod]
        [provider: urn:pulumi:prod::infra::pulumi:providers:digitalocean::default_2_6_0::2a8029dd-96f0-4006-a641-d3c66e947378 => urn:pulumi:prod::infra::pulumi:providers:digitalocean::default_4_0_0::output<string>]
      + autoUpgrade: true
      ~ nodePool   : {
          ~ size: "s-1vcpu-2gb" => "s-2vcpu-4gb"
        }
      ~ version    : "1.18.3-do.0" => "1.18.14-do.0"

• Hi everyone, running the command

pulumi new <https://github.com/><user>/<repo>

with the right repo url, I get the following error:

error: authentication required

. I'm already logged in (pulumi login). Which credentials I'm missing?

Anyone had any issues with using Pulumi with Azure DevOps Pipelines and Nuget feeds? We've recently hit a blocker where a "nuget restore" step in the pipeline works fine, but the next step where we call Pulumi up is failing with "The plugin credential provider could not acquire credentials." errors

hey guys, just wondering is there any support for exporting existing stacks to terraform ?

Is there a Pulumi equivalent to https://registry.terraform.io/browse/modules and/or a way to use TF modules with Pulumi?

Can someone explain the functional difference if I declare a parameter as type pulumi.Output vs Pulumi.Input? For example if I want to pass in an output into a function as a parameter, what is the difference if I declare the accepted value as an Output vs and Input?

Hey guys, are there any good examples out there for using the pulumi.tls package? The examples in the docs are very sparse. I'm basically looking to replicate this, but automate it with Pulumi. Any pointers would be appreciated

is there a recommended way of upgrading stacks created with previous versions of pulumi?

Hello ! Is there someway to create in the same project resources for N different cloud provideres ?

example, create an instance at GCP and another at AWS in same code ?

I'm trying to debug an error creating a GCP cloud function. The relevant output from

pulumi up --yes --logtostderr -v=9

is:

I0526 17:59:10.036118  643767 provider_plugin.go:695] Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight) executing (#props=13)
I0526 17:59:10.036168  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: __defaults={[{ingressSettings} {maxInstances} {timeout}]}
I0526 17:59:10.036235  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: availableMemoryMb={4000}
I0526 17:59:10.036276  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: entryPoint={generateHighlight}
I0526 17:59:10.036300  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: eventTrigger={map[__defaults:{[]} eventType:{providers/cloud.pubsub/eventTypes/topic.publish} resource:{projects/olivertesting7/topics/generate-highlight-event}]}
I0526 17:59:10.036366  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: __defaults={[]}
I0526 17:59:10.036391  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: eventType={providers/cloud.pubsub/eventTypes/topic.publish}
I0526 17:59:10.036410  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: resource={projects/olivertesting7/topics/generate-highlight-event}
I0526 17:59:10.036471  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: ingressSettings={ALLOW_ALL}
I0526 17:59:10.036493  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: maxInstances={0}
I0526 17:59:10.036515  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: name={generateHighlight}
I0526 17:59:10.036536  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: project={olivertesting7}
I0526 17:59:10.036550  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: region={us-central1}
I0526 17:59:10.036570  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: runtime={nodejs12}
I0526 17:59:10.036589  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: sourceArchiveBucket={companion-cloud-functions-prod}
I0526 17:59:10.036608  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: sourceArchiveObject={generateHighlight-9465c8d}
I0526 17:59:10.036629  643767 rpc.go:72] Marshaling property for RPC[Provider[gcp, 0xc0017ded80].Create(urn:pulumi:prod::deploy::gcp:cloudfunctions/function:Function::generateHighlight).inputs]: timeout={60}
I0526 17:59:10.044856  643767 eventsink.go:59] Creating cloud function: projects/olivertesting7/locations/us-central1/functions/generateHighlight
I0526 17:59:10.044914  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Creating cloud function: projects/olivertesting7/locations/us-central1/functions/generateHighlight<{%reset%}>)
I0526 17:59:10.046240  643767 eventsink.go:59] Waiting for state to become: [success]
I0526 17:59:10.046292  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Waiting for state to become: [success]<{%reset%}>)
I0526 17:59:10.047382  643767 eventsink.go:59] Instantiating Google Cloud CloudFunctions Client for path <https://cloudfunctions.googleapis.com/>
I0526 17:59:10.047470  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Instantiating Google Cloud CloudFunctions Client for path <https://cloudfunctions.googleapis.com/><{%reset%}>)
I0526 17:59:10.049297  643767 eventsink.go:59] Retry Transport: starting RoundTrip retry loop
I0526 17:59:10.049326  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Retry Transport: starting RoundTrip retry loop<{%reset%}>)
I0526 17:59:10.050011  643767 eventsink.go:59] Retry Transport: request attempt 0
I0526 17:59:10.050037  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Retry Transport: request attempt 0<{%reset%}>)
I0526 17:59:10.447234  643767 eventsink.go:59] Retry Transport: Stopping retries, last request failed with non-retryable error: googleapi: got HTTP response code 400 with body: HTTP/2.0 400 Bad Request
I0526 17:59:10.447275  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Retry Transport: Stopping retries, last request failed with non-retryable error: googleapi: got HTTP response code 400 with body: HTTP/2.0 400 Bad Request<{%reset%}>)
I0526 17:59:10.447978  643767 eventsink.go:59] Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
I0526 17:59:10.448016  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"<{%reset%}>)
I0526 17:59:10.448709  643767 eventsink.go:59] Cache-Control: private
I0526 17:59:10.448757  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Cache-Control: private<{%reset%}>)
I0526 17:59:10.449341  643767 eventsink.go:59] Content-Type: application/json; charset=UTF-8
I0526 17:59:10.449370  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Content-Type: application/json; charset=UTF-8<{%reset%}>)
I0526 17:59:10.449960  643767 eventsink.go:59] Date: Thu, 27 May 2021 00:59:10 GMT
I0526 17:59:10.449999  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Date: Thu, 27 May 2021 00:59:10 GMT<{%reset%}>)
I0526 17:59:10.450494  643767 eventsink.go:59] Server: ESF
I0526 17:59:10.450519  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Server: ESF<{%reset%}>)
I0526 17:59:10.451018  643767 eventsink.go:59] Vary: Origin
I0526 17:59:10.451053  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Vary: Origin<{%reset%}>)
I0526 17:59:10.451543  643767 eventsink.go:59] Vary: X-Origin
I0526 17:59:10.451577  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Vary: X-Origin<{%reset%}>)
I0526 17:59:10.451979  643767 eventsink.go:59] Vary: Referer
I0526 17:59:10.451985  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Vary: Referer<{%reset%}>)
I0526 17:59:10.452092  643767 eventsink.go:59] X-Content-Type-Options: nosniff
I0526 17:59:10.452098  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>X-Content-Type-Options: nosniff<{%reset%}>)
I0526 17:59:10.452223  643767 eventsink.go:59] X-Frame-Options: SAMEORIGIN
I0526 17:59:10.452230  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>X-Frame-Options: SAMEORIGIN<{%reset%}>)
I0526 17:59:10.452352  643767 eventsink.go:59] X-Xss-Protection: 0
I0526 17:59:10.452360  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>X-Xss-Protection: 0<{%reset%}>)
I0526 17:59:10.452489  643767 eventsink.go:59] 
I0526 17:59:10.452496  643767 eventsink.go:62] eventSink::Debug(<{%reset%}><{%reset%}>)
I0526 17:59:10.452631  643767 eventsink.go:59] {
I0526 17:59:10.452639  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>{<{%reset%}>)
I0526 17:59:10.452794  643767 eventsink.go:59]   "error": {
I0526 17:59:10.452802  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>  "error": {<{%reset%}>)
I0526 17:59:10.453001  643767 eventsink.go:59]     "code": 400,
I0526 17:59:10.453009  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>    "code": 400,<{%reset%}>)
I0526 17:59:10.453158  643767 eventsink.go:59]     "message": "The request has errors",
I0526 17:59:10.453168  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>    "message": "The request has errors",<{%reset%}>)
I0526 17:59:10.453285  643767 eventsink.go:59]     "errors": [
I0526 17:59:10.453293  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>    "errors": [<{%reset%}>)
I0526 17:59:10.453423  643767 eventsink.go:59]       {
I0526 17:59:10.453430  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>      {<{%reset%}>)
I0526 17:59:10.453566  643767 eventsink.go:59]         "message": "The request has errors",
I0526 17:59:10.453575  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>        "message": "The request has errors",<{%reset%}>)
I0526 17:59:10.453708  643767 eventsink.go:59]         "domain": "global",
I0526 17:59:10.453715  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>        "domain": "global",<{%reset%}>)
I0526 17:59:10.453865  643767 eventsink.go:59]         "reason": "badRequest"
I0526 17:59:10.453873  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>        "reason": "badRequest"<{%reset%}>)
I0526 17:59:10.454043  643767 eventsink.go:59]       }
I0526 17:59:10.454052  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>      }<{%reset%}>)
I0526 17:59:10.454180  643767 eventsink.go:59]     ],
I0526 17:59:10.454187  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>    ],<{%reset%}>)
I0526 17:59:10.454309  643767 eventsink.go:59]     "status": "INVALID_ARGUMENT"
I0526 17:59:10.454318  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>    "status": "INVALID_ARGUMENT"<{%reset%}>)
I0526 17:59:10.454464  643767 eventsink.go:59]   }
I0526 17:59:10.454473  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>  }<{%reset%}>)
I0526 17:59:10.454597  643767 eventsink.go:59] }
I0526 17:59:10.454604  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>}<{%reset%}>)
I0526 17:59:10.454744  643767 eventsink.go:59] Retry Transport: Returning after 1 attempts
I0526 17:59:10.454754  643767 eventsink.go:62] eventSink::Debug(<{%reset%}>Retry Transport: Returning after 1 attempts<{%reset%}>)
I0526 17:59:10.455025  643767 provider_plugin.go:1391] provider received rpc error `Unknown`: `1 error occurred:

Short version, the topic exists, the API is enabled. I'm setting the

eventType

to

providers/cloud.pubsub/eventTypes/topic.publish

and the

resource

for that event type to an existing topic,

projects/olivertesting7/topics/generate-highlight-event

. The same code swapping only

event_type

to

trigger_http

works fine so I'm pretty sure this issue is trying to make it pubsub triggered rather than http triggered. Any help would be great!

i wonder if anyone else has struggled with this: if pulumi wants to delete an s3 bucket, it fails if the bucket is not empty - how have you tackled this in your pulumi code? I’d like it to just empty the bucket before attempting to delete it

Hello, I'm using Pulumi to provision an RDS instance, and I'd like to run an SQL script that would create the tables for that database and essentially make it ready to work on. Was wondering what's the best practice for this, not sure if AWS supports anything like that, was trying to see if Pulumi has an hook that runs when the instance is created but couldn't find anything like that

Hi, I'm trying to write my own provider using the boilerplate template but I think there is a breaking bug. From what I can tell the provider is expected to output to stdout the port it is listening on, but what appears to happen is that grpc logging beats it to it.

Hello everybody. Does anybody know how i can attach an registry to an kubernets cluster in azure ? I do this over the cli with this command : az aks update … --attach-acr but i want todo it with pulumi. Does anybody know this ? Greetings !

I'm still struggling to get a GCP cloud function with a pubsub trigger to work . See https://pulumi-community.slack.com/archives/C84L4E3N1/p1622077138338500 above. In desperation I manually created one and then did a

pulumi import

to see how to do it. I got the following:

import pulumi
import pulumi_gcp as gcp

generate_highlight = gcp.cloudfunctions.Function("generateHighlight",
    available_memory_mb=4096,
    entry_point="generateHighlight",
    ingress_settings="ALLOW_ALL",
    labels={
        "deployment-tool": "console-cloud",
    },
    max_instances=0,
    name="generateHighlight",
    runtime="nodejs12",
    source_archive_bucket="companion-cloud-functions-prod",
    source_archive_object="generateHighlight-9465c8d",
    timeout=60,
    opts=pulumi.ResourceOptions(protect=True))

Note that the pubsub trigger which is set on the function is not mentioned here. But the docs says to use

event_trigger

on the

Function

constructor to set up the trigger. Any help would be very much appreciated.

here (https://www.pulumi.com/docs/intro/concepts/project/#stack-settings-file) it says:

When using ephemeral stacks, the stack settings are typically not checked into source control.

So my question is… let’s say I’m deploying an

xyz

ephemeral stack, for which maybe I need a couple of configuration params (so, in

Pulumi.xyz.yml

).. what would be the best practice here? Should we create the stack file on the go (prepare it), or? maybe I’m missing something… thanks!

I have a stack that creates resource X, then it calls an API to extract data from X (using X.id as an argument), and then use X.property in resource Y - for some reason, Pulumi is complaining during planning that the API call doesn't have X.id available. What am I missing? Shouldn't this be handled by the Input and Output logic?