Are there project level config secret values?

Hey, I am using the PostgreSQL provider to run some commands for our RDS instance. How can one wait for the RDS instance to be ready before using the postgresql provider?

Has anyone extensively used the Pulumi + AWS CDK integration? Can you comment on your experience with it? We do a lot with CDK and I'd worry that we'd run into a bunch of unsupported resources or other blockers.

Hi there , could you please help me i have a question about the mongodb atlas provider I create atlas projects like this pulumi_atlas_project = mongodbatlas.Project('atlas_project', name=my_config['atlas_project_name'], _org_id_=my_config['atlas_org_id'], _is_collect_database_specifics_statistics_enabled_=True, _is_data_explorer_enabled_=True, _is_performance_advisor_enabled_=True, _is_realtime_performance_panel_enabled_=True, _is_schema_advisor_enabled_=True, _with_default_alerts_settings_=False) If the "name" attribute changes ( or if the name of project changes in atlas ) , pulumi will try to delete/recreate the project. Is is possible to bypass this behaviour for this particular argument ??

Hey everyone, I'm wondering if someone could shed some light on how Pulumi links the GitHub repo to the stack when creating one? we're running Pulumi commands via another tool but when the stacks are created they don't get linked to GitHub. Thanks!

How to use

compute.GetVirtualMachine()

in automation api with golang? Did anybody encounter this kind of error? I'm getting

panic: runtime error: invalid memory address or nil pointer dereference

error :(. The code looks like this:

con := context.Background()
	ctx, err := pulumi.NewContext(con, pulumi.RunInfo{Project: "rest-api", Stack: "pulumi-test"})
	if err != nil {
		fmt.Println(err)
	}
	vm, err := compute.GetVirtualMachine(ctx, "vm480cd303", pulumi.ID("50dd5f24-507b-4b76-a911-4708782d2940"), &compute.VirtualMachineState{})
	
	if err != nil { fmt.Println(err)}
	fmt.Println(vm.Name)

Hello community , I am trying to test Pulumi in order to assess some functionality for IAS automation, I have the following simple use-case: Test pulumi-operator with Pulumi Service backend and try to deploy the pulumi-nginx example https://github.com/metral/pulumi-nginx , but I've got the following problem when applying the Stack , logs from the operator:

{
  "level": "error",
  "ts": "2023-01-18T11:54:20.674Z",
  "logger": "controller_stack",
  "msg": "Failed to update Stack",
  "Request.Namespace": "default",
  "Request.Name": "nginx-k8s-stack-1",
  "Stack.Name": "alinalex/nginx/dev",
  "error": "installing project dependencies: exit status 1",
  "stacktrace": "<http://github.com/pulumi/pulumi-kubernetes-operator/pkg/controller/stack.(*ReconcileStack).Reconcile\n\t/home/runner/work/pulumi-kubernetes-operator/pulumi-kubernetes-operator/pkg/controller/stack/stack_controller.go:459\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:298\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:214|github.com/pulumi/pulumi-kubernetes-operator/pkg/controller/stack.(*ReconcileStack).Reconcile\n\t/home/runner/work/pulumi-kubernetes-operator/pulumi-kubernetes-operator/pkg/controller/stack/stack_controller.go:459\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:298\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:253\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.0/pkg/internal/controller/controller.go:214>"
}

Any clue about the error?

From what I see it is not maintained 😞!

Using the

tls

package, it is not entirely clear to me how I am going to generate a CA and sign a certificate with it. I create the CA with

tls.NewSelfSignedCert

but I would assume I would need to use

tls.NewLocallySignedCert

for signing the certs to this CA? I have also tried with

tls.NewSelfSignedCert

but there is no obvious way to reference the CA from this function. Any help would be greatly appreciated.

Hello, can someone help me with this error?

$ pulumi plugin install resource pulumi-resource-github v4.11.0-alpha.1645193352

[resource plugin pulumi-resource-github-4.11.0-alpha.1645193352] installing
error: [resource plugin pulumi-resource-github-4.11.0-alpha.1645193352] downloading from : failed to download plugin: pulumi-resource-github-4.11.0-alpha.1645193352: 403 HTTP error fetching plugin from <https://get.pulumi.com/releases/plugins/pulumi-resource-pulumi-resource-github-v4.11.0-alpha.1645193352-linux-amd64.tar.gz>

This probably has been answered a bunch of times, but now with some namespaced/hierchiaal configuration, we can define project-level config in addition to stack level. Yay. I have a question about global / shared configuration. How are folks managing configuration that is shared amongst multiple stacks? One 'hack' in Terraform I used to do was to make a module whose sole purpose was to

output

things I wanted other modules or states to be able to re-use. Is this something one could do in pulumi as well using

pulumi.Output()

and a bunch of namespace configs?

Hello community Is there anyway we can build web based UI to manage multiple aws account using pulumi? ( currently using scalr tool, and we decided to replace it with pulumi) And what is the efficient way to execute custom scripts on individual aws ec2 machine using pulumi?

Hello community I am follow the document https://www.pulumi.com/docs/guides/adopting/from_kubernetes/ and try to Deploying a Single Kubernetes YAML File and get error while load yaml file the command and error as below, any ideas ?

❯ poetry show
arpeggio           2.0.0     Packrat parser interpreter
attrs              22.2.0    Classes Without Boilerplate
certifi            2022.12.7 Python package for providing Mozilla's CA Bundle.
charset-normalizer 2.1.1     The Real First Universal Charset Detector. Open, modern and actively mainta...
dill               0.3.6     serialize all of python
grpcio             1.50.0    HTTP/2-based RPC framework
idna               3.4       Internationalized Domain Names in Applications (IDNA)
jmespath           1.0.1     JSON Matching Expressions
parver             0.4       Parse and manipulate version numbers.
protobuf           4.21.12
pulumi             3.52.0    Pulumi's Python SDK
pulumi-aws         5.21.1    A Pulumi package for creating and managing Amazon Web Services (AWS) cloud ...
pulumi-kubernetes  3.23.1    A Pulumi package for creating and managing Kubernetes resources.
pyyaml             6.0       YAML parser and emitter for Python
requests           2.28.1    Python HTTP for Humans.
semver             2.13.0    Python helper for Semantic Versioning (<http://semver.org/>)
six                1.16.0    Python 2 and 3 compatibility utilities
urllib3            1.26.14   HTTP library with thread-safe connection pooling, file post, and more.
❯ python
Python 3.10.7 (main, Oct 17 2022, 11:07:33) [Clang 13.1.6 (clang-1316.0.21.2.5)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import pulumi
>>> import pulumi_kubernetes as k8s
>>>
>>> guestbook = k8s.yaml.ConfigFile('guestbook', 'guestbook-all-in-one.yaml')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi_kubernetes/yaml/yaml.py", line 350, in __init__
    __ret__ = invoke_yaml_decode(text)
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi_kubernetes/yaml/yaml.py", line 348, in invoke_yaml_decode
    inv = pulumi.runtime.invoke('kubernetes:yaml:decode', {'text': text}, invoke_opts)
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/invoke.py", line 142, in invoke
    invoke_result, invoke_error = _sync_await(asyncio.ensure_future(do_rpc()))
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/sync_await.py", line 54, in _sync_await
    return loop.run_until_complete(fut)
  File "/Users/william/.pyenv/versions/3.10.7/lib/python3.10/asyncio/base_events.py", line 646, in run_until_complete
    return future.result()
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/invoke.py", line 137, in do_rpc
    raise exn
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/rpc_manager.py", line 68, in rpc_wrapper
    result = await rpc
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/invoke.py", line 107, in do_invoke
    resp, error = await asyncio.get_event_loop().run_in_executor(None, do_invoke)
  File "/Users/william/.pyenv/versions/3.10.7/lib/python3.10/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/Users/william/git_repo/k8s_lab/.venv/lib/python3.10/site-packages/pulumi/runtime/invoke.py", line 103, in do_invoke
    return monitor.Invoke(req), None
AttributeError: 'NoneType' object has no attribute 'Invoke'
>>>

It seems cause by no kubernetes provider ?

Hi, I could use some help resolving this error/inconsistency i experience. I've recently upgraded the provider plugin

@pulumi/aws

to a newer version. Now when i do a

preview

i get the following warning:

warning: resource plugin aws is expected to have version >=5.27.0, but has 5.9.2; the wrong version may be on your path, or this may be a bug in the plugin

When doing a

pulumi plugin ls

i see the following:

NAME          KIND      VERSION  SIZE    INSTALLED       LAST USED
aws           resource  5.27.0   499 MB  1 hour ago      1 hour ago
aws           resource  5.9.2    387 MB  48 minutes ago  48 minutes ago

If run the following command to remove the 5.9.2 version

pulumi plugin rm resource aws 5.9.2

and then run a

preview

i get the following error:

error: could not load plugin for aws provider 'urn:pulumi:test::sapbasis::pulumi:providers:aws::default_5_27_0': aws (resource) plugin [C:\Program Files\chocolatey\bin\p
ulumi-resource-aws.exe] wrote a non-numeric port to stdout ('0'): strconv.Atoi: parsing "Cannot find file at '..\\\\lib\\pulumi\\home\\plugins\\resource-aws-v5.9.2\\pulu
mi-resource-aws.exe' This usually indicates a missing or moved
 file.\r": invalid syntax

This indicates that the stack is somehow still using the 5.9.2 Provider. Doing an export of the stack with

pulumi stack export --file out.json

- the stack has no references to the 5.9.2 version but are instead all listed as using

::pulumi:providers:aws::default_5_27_0

. Any ideas? Sincerely

I am doing some testing on different types of deployments for Pulumi and for the moment I am testing the operator. I've tried multiple configuration but right now what I need is using ProgramObject. I have the following concerns regarding this approach: • How the providers are being injected, because we have only yaml and not a programming context? The Pulumi Yaml can be used in an airgapped env?

am creating an aks cluster with pulumi kubernetes and after deploying elastic search service i try to get it with Service.Get() but it shows strange error

var crdsOperator = new ConfigFile("crds-operators", new ConfigFileArgs
                 {
                     File = Path.Combine(Environment.CurrentDirectory, "KubernetesFiles", "crds.yaml")
                 }, new ComponentResourceOptions { Provider = aksProvider });

                 var elasticOperator = new ConfigFile("elastic-operators", new ConfigFileArgs
                 {
                     File = Path.Combine(Environment.CurrentDirectory, "KubernetesFiles", "operator.yaml")
                 }, new ComponentResourceOptions { Provider = aksProvider, DependsOn = { crdsOperator.Ready() } });

                 var elasticSecret = new ConfigFile("elastic-secret", new ConfigFileArgs
                 {
                     File = Path.Combine(Environment.CurrentDirectory, "KubernetesFiles", "elastic-secret.yml")
                 }, new ComponentResourceOptions { Provider = aksProvider, DependsOn = { elasticOperator.Ready() } });

                 var elasticMonitor = new ConfigFile("elastic-monitor", new ConfigFileArgs
                 {
                     File = Path.Combine(Environment.CurrentDirectory, "KubernetesFiles", "elastic-monitor.yml")
                 }, new ComponentResourceOptions { Provider = aksProvider, DependsOn = { elasticSecret.Ready() } });

                 var sev = Kubernetes.Core.V1.Service.Get(
                    "ingress",
                    "default/es-log-monitoring-test-es-http",
                       new CustomResourceOptions { Provider = aksProvider, DependsOn = { elasticMonitor.Ready() } }

and the elastic-monitor.yml looks like this

apiVersion: <http://elasticsearch.k8s.elastic.co/v1|elasticsearch.k8s.elastic.co/v1>

kind: Elasticsearch

metadata:

name: es-log-monitoring-test

namespace: default

spec:

version: 8.4.2

image: elasticsearch:8.4.2

http:

service:

spec:

type: LoadBalancer

tls:

selfSignedCertificate:

disabled: true

nodeSets:

- name: node

count: 1

podTemplate:

spec:

containers:

- name: elasticsearch

resources:

requests:

memory: 1500Mi

limits:

memory: 1800Mi

volumeClaimTemplates:

- metadata:

name: elasticsearch-data # Do not change this name unless you set up a volume mount for the data path.

spec:

accessModes:

- ReadWriteOnce

resources:

requests:

storage: 50Gi

storageClassName: default

config:

xpack.ml.enabled: true

node.store.allow_mmap: false

and when it reaches the service get it produces this error kubernetescore/v1Service : error: 3 errors occurred: * Resource 'es-log-monitoring-test-es-http' was created but failed to initialize * Service does not target any Pods. Selected Pods may not be ready, or field '.spec.selector' may not match labels on any Pods * Service was not allocated an IP address; does your cloud provider support this?

Hello, I'm trying to use Secrets and SecretsProvider with integration tests and the error I'm getting leads me to believe the secret value is not getting decrypted. I'm currently setting the secret as the encrypted value I get when using the

pulumi config set

. Any ideas, thank you.

Not sure which channel is right for this. I am using GitHub action to do a configuration drift check on a cron schedule. I am attempting to create an issue in GitHub when drift is detected. The step looks like this:

- uses: pulumi/actions@v4
        id: pulumi
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        with:
          stack-name: ${{ env.stack }}
          command: preview
          refresh: true
          expect-no-changes: true
          diff: true

When I attempt to access the stack output as below, it comes back blank:

${{ steps.pulumi.outputs.output }}

Any suggestions on the correct way to access the output? I essentially want the same output that would be there if

comment-on-pr

were set to

true

. Since my action is running on cron rather than pr, I’m unable to use that command. Many thanks! 🙏

Hi Team, I am new to pulumi and trying to create ECS task definition on AWS. Along with this, I am also creating more resources like cluster, role, security group. In this task definition, I am passing few environment variables. In this env variables, I am passing Id/ARN of other resources. But pulumi is throwing error for fetching data of resources(cluster, secutiry group and role) and assigning this error as a value to these env variables. Below is screenshot of what is deploying on AWS.

Hello, I have a question regarding the Pulumi Operator: • Why the image has so a large size for a go binary likely 4.69 Gb? This large space is coming from the pre-installed provisioners? • As the image is so large most probably the attack area is direct proportional with that in terms of security.

Hi everyone. I am newbie in Pulumi i have a question. Question is that we have data source in terraform to use existing resources in terraform. So what options are available in Pulumi to use existing resource without import ?. Thanks in advanced.

Hi Channel. Is there any way to access resource from AWS through Pulumi? I have a situation where I need to first check if resource with given name already exists or not. If not then I need to create otherwise skip it and pass the arn of existing resource to other resource.

Is it possible to get access to the Stack name while configuring a config value... etc test: ${stackname}.something?

I am setting up neo4j cluster using helm chart on gke in Pulumi. Helm values setup neo4j with node selector to pool1 but it errors out complaining there is no node exists with labels. I also checked this is not node selector label values as other deployments in Pulumi work with same, neo4j helm setup without pulumi also accepts node selector so not sure what is happening with Pulumi when it should be same. Here is the code gist and error trace below.

error: Error: invocation of kubernetes:helm:template returned an error: failed to generate YAML for specified Helm chart: failed to create chart from template: execution error at (neo4j-cluster-core/templates/_helpers.tpl:73:16): No node exists in the cluster which has all the below labels (.Values.nodeSelector)
     %smap[<http://cloud.google.com/gke-nodepool:primarynodes-f059c87|cloud.google.com/gke-nodepool:primarynodes-f059c87>]
        at Object.callback (workspace/code_play/typescript_projects/dev/gke-cluster/k8s/node_modules/@pulumi/runtime/invoke.ts:172:33)
        at Object.onReceiveStatus (/workspace/code_play/typescript_projects/dev/gke-cluster/k8s/node_modules/@grpc/grpc-js/src/client.ts:338:26)
        at Object.onReceiveStatus (/workspace/code_play/typescript_projects/dev/gke-cluster/k8s/node_modules/@grpc/grpc-js/src/client-interceptors.ts:426:34)
        at Object.onReceiveStatus (/workspace/code_play/typescript_projects/dev/gke-cluster/k8s/node_modules/@grpc/grpc-js/src/client-interceptors.ts:389:48)
        at /workspace/code_play/typescript_projects/dev/gke-cluster/k8s/node_modules/@grpc/grpc-js/src/call-stream.ts:276:24
        at processTicksAndRejections (node:internal/process/task_queues:77:11)

Looking for some clarity on the

pulumi refresh

command as I just ran it and it seemingly removed a resource that was manually added for troubleshooting purposes. From the documentation here it states:

Any such changes are adopted into the current stack.

It’s not clear if this is referring to the “current stack” as just the state held within Pulumi’s state management OR if “current stack” means the actual resources in the Cloud Provider

Hi! I'm trying to set up an orgpolicy in GCP using Pulumi. Since the pulumi-gcp plugin has a bug preventing me to add a gcp.projects.OrganizationPolicy policy (see: https://github.com/pulumi/pulumi-gcp/issues/291), I am trying to use the v2 orgpolicy to do the same thing. Problem is when I'm trying to add a new orgpolicy on my project I get this error:

gcp:orgpolicy:Policy (primary):
    error: 1 error occurred:
        * Error creating Policy: failed to create a diff: failed to retrieve Policy resource: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the <http://orgpolicy.googleapis.com|orgpolicy.googleapis.com>. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see <https://cloud.google.com/docs/authentication/>. If you are getting this error with curl or similar tools, you may need to specify 'X-Goog-User-Project' HTTP header for quota and billing purposes. For more information regarding 'X-Goog-User-Project' header, please check <https://cloud.google.com/apis/docs/system-parameters>.
    Details:
    [
      {
        "@type": "<http://type.googleapis.com/google.rpc.ErrorInfo|type.googleapis.com/google.rpc.ErrorInfo>",
        "domain": "<http://googleapis.com|googleapis.com>",
        "metadata": {
          "consumer": "projects/764086051850",
          "service": "<http://orgpolicy.googleapis.com|orgpolicy.googleapis.com>"
        },
        "reason": "SERVICE_DISABLED"
      }
    ]

How to list resources with the Azure Native provider? I see examples of how to create resources, and some free functions with the prefix

list

. But for example, listing all virtual machine scale set instances is supported by the Azure API but I cannot find that functionality in the Pulumi Azure Native provider API docs. How can I do this?

Hi all, is it possible to get prompted for diff approval/cancellation of a

pulumi up

from the pulumi web console instead of the terminal? I’m hoping to automate deployment approval from a github actions workflow

We've had a few instances lately of pulumi updates getting stuck with cloud and causing further problems to concurrent previews. What I notice: 1. Deploy gets stuck (loading spinner in summary) 2. All that shows in Diff is the StackReference that practically the entire program depends on (suspect) 3. Nothing but a few warnings in diagnostics 4. I have to manually use

pulumi cancel

to get around this 5. Previews that were started while the update was happening (usually not a problem) gets stuck (loading spinner in summary and "updating" constantly") but does show stack outputs in diff Follow on questions: 1. Is there a way to cancel a preview since they don't seem to become unstuck? 2. Is this a known issue or one that others have experienced? 3. Is there something we can do to be more resilient?

Hi, is the awsx.ecr.Image actually supposed to always rebuild and re-push the image every time you do

pulumi up

, even if the Dockerfile it's using hasn't changed? That what it's doing for me, but I'd expect to to only rebuild and push if the Dockerfile has changed.