Hi, I am creating an aws provider to assume a role into another account to get information from an eks cluster (shown below): When I call this function, I get the following exception:

Exception: invoke of aws:eks/getCluster:getCluster failed: invocation of aws:eks/getCluster:getCluster returned an error: error reading from server: EOF

Any suggestions on how to get around this? Thanks Note: I have imported eks as

from pulumi_aws

def generate_cross_account_kubeconfig(cluster_name:str, role_arn: str):
        
        eks_provider = Provider(
            f"assume-role-{role_arn.split('/')[1]}",
            assume_role = [
                role_arn,
            ]
        )



        eks_cluster= eks.get_cluster(
            name=cluster_name,
            opts = pulumi.InvokeOptions(provider = eks_provider)
            )

where can I find documentation on migrating local state to an organization's pulumi cloud

Hello everyone, Is there a way to generate a random secret password without having to store it in the state unencrypted? My concern is

.ToSecret

accepts a raw value which I have to generate and store somewhere presumably.

is it possible to use an Output in an Asset?

Hello, surely a newbie question but: is it possible to use local docker images when using Pulumi on a local dev machine? I have minikube set. Pulumi ready, working with Python. I tried

artifacts = docker.Image(
    "artifacts-image",
    build=docker.DockerBuildArgs(
        context="./artifacts",
        dockerfile="artifacts/Dockerfile",
    ),
    image_name="artifacts",
    skip_push=True
)

artifacts_container = ContainerArgs(
    name="artifacts-container",
    image=artifacts.image_name,
)

deployment = Deployment(
    "backend",
    metadata=backend_metadata,
    spec=DeploymentSpecArgs(
        replicas=1,
        selector=app_selector,
        template=PodTemplateSpecArgs(
            metadata=backend_php_metadata,
            spec=PodSpecArgs(
                volumes=[
                ],
                init_containers=[
                    artifacts_container,
                ],
                containers=[
                ],
            ),
        ),
    ),
)

pulumi up

gives me the message

warning: [Pod backend-95bd4bd6-5c4c5f594c-bqb8t]: containers with incomplete status: [artifacts-container]

kubectl describe pod backend-95bd4bd6-5c4c5f594c-bqb8t

shows the error

Failed to pull image "artifacts": rpc error: code = Unknown desc = Error response from daemon: pull access denied for artifacts, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

but the image is shown by

docker image ls

so it looks like it tries to get from some provider instead of locally. Is there a config somewhere to get images locally? https://github.com/pulumi/pulumi-docker/issues/148 was not really helpful or I must have missed something.

Greetings, How can I go about using github actions to automatically deploy my docker-compose app to AWS when a PR to main or dev is merged? I am using Python in my Pulumi infra folder. Any examples would be greatly appreciated.

Hello, We use Pulumi to manage our AWS resources. I have been having an issue where every time I run

pulumi preview

, I see uncommitted changes to my recently created objects (usually S3 Buckets with the change

diff: -serverSideEncryptionConfiguration

). When I run

pulumi up

and then preview again, I still see the same uncommitted changes. I do not see any material difference in the S3 buckets themselves in the AWS UI or otherwise. Does anyone know what is causing Pulumi to perceive the configuration for these resources to be different? I could not find any similar examples in these channels. Thanks!

what is the easiest way to require setting kubetnetes:context in config?

Trying to get traction with pulumi in my workplace, wondered if there's an RSS feed for the challenges & pulumi news somewhere? Would be good to use slack to get notifications about new challenges & news.

This message was deleted.

Hey guys, I wrote a class that creates AWS resources to create backups of EC2 instances. It's just a simple test but fails when it trys to run the method aws.iam.get_policy_document(). "AttributeError: 'NoneType' object has no attribute 'id'" The module deploys the real infrastructure fine, but attempting to test it is giving me this error. Anyone able to assist?

Hello guys, i'm new to pulumi and i want to ask what should i do if i forgot the pulumi passphrase ? Are there anyway to recovering / reset my passphrase other than deleting my old pulumi project and create a new one ? I'm using AWS3 to store pulumi login information. Thank you all.

Hello! I am having issues deploying a MySQL container on ECS with EFS. I am running into an issue where either the ECS Task can't pull the image from Docker or it cannot find the EFS. Any suggestions on how to fix this? Maybe I am missing something. I attached my code as a reply to prevent chat hogging.

Hi! Trying to get started with Pulumi and evaluating if it would be the tool of choice for our IaC. Looks very promising but I have stumbled into an issue. We manage our teams as AWS organizations thus it would be great to create these organizations with Pulumi. There is even an example available that I was following but for some reason

aws.Provider

is causing issues when trying to assume a role. I couldn’t get the provider working in my app and even If you run this example: https://github.com/pulumi/examples/tree/master/aws-ts-organizations you get an error:

└─ pulumi:providers:aws                   devAccountProvider                         1 error


Diagnostics:
  pulumi:providers:aws (devAccountProvider):
    error: rpc error: code = Unavailable desc = error reading from server: EOF

  pulumi:pulumi:Stack (aws-ts-organizations-examples):
    panic: interface conversion: interface {} is resource.Computed, not resource.PropertyMap
    goroutine 40 [running]:
    <http://github.com/pulumi/pulumi/sdk/v3/go/common/resource.PropertyValue.ObjectValue(...)|github.com/pulumi/pulumi/sdk/v3/go/common/resource.PropertyValue.ObjectValue(...)>
    	/home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v3@v3.64.0/go/common/resource/properties.go:435
    <http://github.com/pulumi/pulumi-aws/provider/v5.preConfigureCallback(0x14002ca3b80|github.com/pulumi/pulumi-aws/provider/v5.preConfigureCallback(0x14002ca3b80>?, {0x140005ff320?, 0x14000c8a000?})
    	/home/runner/work/pulumi-aws/pulumi-aws/provider/resources.go:361 +0x920
    <http://github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge.(*Provider).CheckConfig(0x14002ca3b80|github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge.(*Provider).CheckConfig(0x14002ca3b80>, {0x112d29d88, 0x140005ff800}, 0x140005f6360)
    	/home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v3@v3.45.3/pkg/tfbridge/provider.go:327 +0x2a0
    <http://github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_CheckConfig_Handler.func1({0x112d29d88|github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_CheckConfig_Handler.func1({0x112d29d88>, 0x140005ff800}, {0x1123f2920?, 0x140005f6360})
    	/home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v3@v3.64.0/proto/go/provider_grpc.pb.go:426 +0x74
    <http://github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc.OpenTracingServerInterceptor.func1({0x112d29d88|github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc.OpenTracingServerInterceptor.func1({0x112d29d88>, 0x140005fe630}, {0x1123f2920, 0x140005f6360}, 0x140005fc2c0, 0x14002e86870)
    	/home/runner/go/pkg/mod/github.com/grpc-ecosystem/grpc-opentracing@v0.0.0-20180507213350-8e809c8a8645/go/otgrpc/server.go:57 +0x30c
    <http://github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_CheckConfig_Handler({0x112a211e0|github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_CheckConfig_Handler({0x112a211e0>?, 0x14002ca3b80}, {0x112d29d88, 0x140005fe630}, 0x14002eb20e0, 0x14002db0820)
    	/home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v3@v3.64.0/proto/go/provider_grpc.pb.go:428 +0x138
    <http://google.golang.org/grpc.(*Server).processUnaryRPC(0x140008303c0|google.golang.org/grpc.(*Server).processUnaryRPC(0x140008303c0>, {0x112d3b860, 0x14002fd8000}, 0x140004d6000, 0x14002defb60, 0x11b7a1cb8, 0x0)
    	/home/runner/go/pkg/mod/google.golang.org/grpc@v1.54.0/server.go:1345 +0xc64
    <http://google.golang.org/grpc.(*Server).handleStream(0x140008303c0|google.golang.org/grpc.(*Server).handleStream(0x140008303c0>, {0x112d3b860, 0x14002fd8000}, 0x140004d6000, 0x0)
    	/home/runner/go/pkg/mod/google.golang.org/grpc@v1.54.0/server.go:1722 +0x82c
    <http://google.golang.org/grpc.(*Server).serveStreams.func1.2()|google.golang.org/grpc.(*Server).serveStreams.func1.2()>
    	/home/runner/go/pkg/mod/google.golang.org/grpc@v1.54.0/server.go:966 +0x84
    created by <http://google.golang.org/grpc.(*Server).serveStreams.func1|google.golang.org/grpc.(*Server).serveStreams.func1>
    	/home/runner/go/pkg/mod/google.golang.org/grpc@v1.54.0/server.go:964 +0x290

Any help to move forward would be highly appreciated here! Thank you!

Hi, getting started with Pulumi here. I'm trying to create a digital ocean app and I'm connecting it to my github repo which is private and I end up getting an error that says

Error creating App: POST <https://api.digitalocean.com/v2/apps>: 400 (request "742db93e-8ca6-4ad6-98df-376a6de74385") Account does not have access to the repo

. My github is infact connected to my digital ocean cause that's how I've been creating apps so far and triggering auto deployments. Any idea on how to sort this? maybe the digital ocean api url is different? 🤔

^ Update. I've managed to sort that out but how can I spin up resources asynchronously? For eg: I spin the db up first and then i use those credentials for my app?

Anyone have experience with mocking aws.iam.get_policy_document() in python?

Hi, I'm trying to install a Helm chart for

Botkube

, could anyone please share a pointer on how to set the parameters? https://docs.botkube.io/installation/slack#install-botkube-backend-in-kubernetes-cluster

Hi, what is the proper way of handling credential configuration in dynamic providers? I tried accessing

pulumi.Config()

inside a dynamic provider class, but kept getting errors that the configuration is not defined (even though it is). Turns out this is a known issue (Slack thread here, GH issue here). However, a Pulumi blog post says this should be possible:

Provider Credentials

If you need to use the credentials used by the rest of your Pulumi app, also known as the ambient provider credentials, you can access the relevant credentials (and other configuration) through the

<provider>.config

where

provider

is the imported provider module.

The code that is not working for me is:

class AlertRuleProvider(ResourceProvider):
    def create(self, props):
        _es_username = Config('foobar').require('password')

when run:

error: Exception calling application: Missing required configuration variable 'foobar:password'
        please set a value using the command `pulumi config set foobar:password <value>`

--- I don’t want to pass the credentials as a prop to the provider, because then it gets stored in the state file. On top of the security concerns, I expect there will be problems with this when the credentials expire and new ones need to be used. So what is the correct approach to interface with 3rdparty APIs from dynamic providers? Thank you

Hey, I am looking for an example, how to create (and manage) a kubernetes service account token. The kubectl command looks like this:

kubectl create token <user-name>

You can find more details about the TokenRequest API Here: https://www.programmingwithwolfgang.com/use-the-tokenrequest-api-to-create-tokens-in-kubernetes/ How can I create such an token object via pulumi. I didn’t find anything in the examples repository ( https://github.com/pulumi/examples). Also the AI generated code tells me to apply the TokenRequest Object to the K8s Server, but I believe the TokenRequest is a read-only endpoint. Thanks, Patrick PS: We are using TypeScript, so we would benefit from a TS example.

Hi folks! Is there a way to know the reason for a resource replacement? I’m not sure what happened, but now Pulumi wants to recreate everything just to change

name

. For example,

gcp.Address

++gcp:compute/address:Address: (create-replacement)
        [id=projects/sandbox-pulumi/regions/us-central1/addresses/retool-b629537]
        [urn=urn:pulumi:sandbox::infra::gcp:compute/address:Address::retool]
      ~ name: "retool-b629537" => "retool-5775aba"
    +-gcp:compute/address:Address: (replace)
        [id=projects/sandbox-pulumi/regions/us-central1/addresses/retool-b629537]
        [urn=urn:pulumi:sandbox::infra::gcp:compute/address:Address::retool]
      ~ name: "retool-b629537" => "retool-5775aba"

Even though this

Address

has no dependencies.

pulumi refresh --yes

didn’t help. The only workaround I found is leaving

pulumi.IgnoreChanges([]string{"name"})

everywhere like here

ip, err := compute.NewAddress(ctx, "retool", nil,
		pulumi.DependsOn([]pulumi.Resource{enabledServices.Compute}),
		pulumi.IgnoreChanges([]string{"name"}))

How do I get

pulumi refresh

to use the latest configuration values? I have a

databricks:token

that recently expired and I am trying update the stack, I've run the "recovering configuration" steps in a new folder and running

config get databricks:token

does show the correct token so I'm not sure why refresh is using the old config value

For anyone getting started and have question on Pulumi, Luke Hoban (CTO) is live right now on this AMA if you want to ask him a question. We are gonna go past 9am PDT / 4pm UTC. https://www.reddit.com/r/sre/comments/13k3w91/infrastructure_as_code_ama_with_luke_hoban_cto_of/

Hey, team! I'm trying to achieve the following: • create ec2 instances • essentially have

pulumi up

block till the instance is

running

I have the Pulumi python starter template - is there some docs/examples I can look at to achieve this? Is the appropriate way to keep polling till the system reaches the desired state? potentially relevant reference to what got generated after

pulumi new

# Create and launch an EC2 instance into the public subnet.
server = aws.ec2.Instance("server",
    instance_type=instance_type,
    subnet_id=subnet.id,
    vpc_security_group_ids=[sec_group.id],
    user_data=user_data,
    ami=ami,
    tags={
        "Name": "webserver",
    })

🤖 Is there anyway to use Pulumi ai to generate local files instead of running as i iterate conversationally similar to the web ui? See 🧵

Hi I’m trying to understand the issue reported by this error message pulumiprovidersaws (default): error: rpc error: code = Unknown desc = unable to validate AWS credentials. Details: validating provider credentials: retrieving caller identity from STS: operation error STS: GetCallerIdentity, https response error StatusCode: 0, RequestID: , request send failed, Post “https://sts.eu-west-1.amazonaws.com/”: dial tcp: lookup sts.eu-west-1.amazonaws.com on [20018a07b3ff5001]53: no such host Make sure you have set your AWS region, e.g.

pulumi config set aws:region us-west-2

. This is result of pulumi up --debug Context: The environment variables for AWS are set, and ‘aws s3 ls’ returns the list of buckets. The stack is selected. Can someone point me to the right direction on this? Thanks in advance

basic question: can I have multiple programs in a project and can I reference resources from program1:devstack to program2:prdstack ?

Is there a way to reset the passphrase secret provider? I've played around a bit with

change-secrets-provider

and ended up in an inconsistent state. Now, I'd like to completely reset the secrets. I wouldn't mind re-entering the secrets, so that could be lost. This is just in a dev environment, so I might as well delete everything. But I'm curious if there is a better way to fix this.

Hello, I'm new here but I am using Pulumi from quite some time and recently I got into big problem. While using pulumi-kubernetes 3.23.1 with pulumi 3.60.0 every time I use ConfigMapPatch and change the data pulumi replaces ConfigMap instead of updating it. I have enabled SSA in kubernetes provider and still ConfigMap is replaced on data change.

Hey guys! Complete newbie here. Using Digital Ocean & Pulumi - loving it so far. I have a very noobie question to ask... All my IAC is sitting inside the index.ts file and I can't find any examples where people have split the configuration out into multiple files. EG:

config ->
    dns.ts
    postgres.ts
    ...*.ts

index.ts

Where index.ts imports from the files within the config folder. Is this possible, or even a good idea? 😅