hi friends, I'm back again. Does anyone know off the top of their head where to find the unique IDs for K8s resources?

it looks like the

.get()

function for a k8s resource errors out when it doesn't exist. what's the right way to handle this scenario so that the resource is created if it doesn't exist?

How to get Cloud Run URL using Go? For

.Statuses

it's returning

cloudrun.ServiceStatusArrayOutput

but I have no idea what to do with this object.

Deploying GKE on GCP, anyone get this when trying to push .yaml files

Error: invocation of kubernetes:yaml:decode returned an error: failed to initialize discovery client: The gcp auth plugin has been removed.
    Please use the "gke-gcloud-auth-plugin" kubectl/client-go credential plugin instead.
    See <https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke> for further details

Trying to manage a split-horizon dns setup having pulumi manage the private dns side of things. If I try to add/remove a VPC via Pulumi, I get back:

gcp:dns:ManagedZone (brinqa-net-private):
    error: 1 error occurred:
    	* updating urn:pulumi:brinqa-prod::brinqa-net-private::gcp:dns/managedZone:ManagedZone::brinqa-net-private: 1 error occurred:
    	* Error updating ManagedZone "projects/brinqa-prod/managedZones/brinqa-net-private": googleapi: Error 400: The field 'entity.managedZone.id' cannot be modified., immutableField

Why would Pulumi be trying to update/change the id field of the zone? The diff shows it only trying to update

privateVisibilityConfig.networks

I think this applies to my issue, not sure how to go about fixing it for Pulumi, other than have a bug report submitted, and wait for a release that fixes the issue: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_managed_zone#networks

Okay, pretty sure I found the bug. No idea where/with who to file the bug with though:

I0321 22:26:42.150801 2409260 log.go:75] Unmarshaling property for RPC[Provider[gcp, 0xc0015a85a0].Update(projects/brinqa-prod/managedZones/brinqa-net-private,urn:pulumi:brinqa-prod::brinqa-net-private::gcp:dns/managedZone:ManagedZone::brinqa-net-private).outputs]: managedZoneId={2.9610687372243656e+18}

managedZoneId is cast as an Int, which is then changed to scientific notation. the problem is

2.9610687372243656e+18

recasts as

2961068737224365600

, whereas the actual id for my zone is:

2961068737224365485

(not to mention there's a rounding error there, but that's another nit to pick). If someone can point me to the right place to file said bug, I'll be more than happy to do it.

The docs for

gcp.compute.AttachedDisk

say:

Note: When using

gcp.compute.AttachedDisk

you must use

lifecycle.ignore_changes = ["attached_disk"]

on the

gcp.compute.Instance

resource that has the disks attached. Otherwise the two resources will fight for control of the attached disk block.

How do I do this? ie, where does this go?

Just an FYI, we're running a workshop in about 90 minutes if you'd like to join us: https://www.pulumi.com/resources/kubernetes-on-google-cloud/

Hello folks, I want to import GCP resources that are created through console. Is there a reference doc that lists how to reference each and every gcp resource through its ID? For instance what is the correct command for importing instanceGroup as the below one continues to state the referenced resource doesn't exist even though it is already created and used. pulumi import gcpcompute/instanceGroupInstanceGroup my-instance-group projects/my-project/zones/us-central1-a/instanceGroups/my-instance-group I've tried with zone and regions variations and also with InstanceGroupManager but so far no luck.

Anyone is using GCP Cloud SQL Postgres Database instance together with Postgresql provider to set initial roles for other users?

any support for Bigquery as datasource for Grafana? Doesn’t look like it, just curious if anybody has a workaround for it

Hi, Is it correctly understood, that the gcp.cloudbuild.Trigger connecting to the Github repo only works for Github Enterprise users? Or is it possible with Github Team? Thank you, Elias

Hi Guys, I'm trying to use google-native to create id-platform resources. Classic version works perfectly ok but google-native giving below message. Any thoughts how to resolve this? I'm authenticated using service-account. The below message appears for any resource of id-platform. { "error": { "code": 401, "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", "status": "UNAUTHENTICATED", "details": [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "reason": "CREDENTIALS_MISSING", "domain": "googleapis.com", "metadata": { "service": "identitytoolkit.googleapis.com", "method": "google.cloud.identitytoolkit.admin.v2.ProjectConfigService.ListDefaultSupportedIdpConfigs" } } ] } }

I am having a hard time finding documentation on gcp apis. Is the right way to get the information is to look at Terraform documentation when it says

This Pulumi package is based on the google-beta Terraform Provider.

?

Hello folks, Which module can be used to create credentials and consent screen in GCP? Thx

I'm trying to work out how to create scheduled disk snapshots in Pulumi. I noticed that

google-native.compute/alpha.Snapshot

has a

sourceSnapshotSchedulePolicy

output property, but it isn't really clear how to set this up. There's a terraform module that Google points at for doing this, but I don't know how to use that from Pulimi either. Has anyone done this or have any pointers?

Anyone know if it's possible to upgrade CloudSQL MySQL to a newer version using pulumi, or will pulumi only support instance re-creation when the version is changed?

Hi all, is it possible to supress the warning around not having a GCP Project set? Setting a project is not something I can/want to happen as I am dynamically provisioning the project. Thanks!

Hi everyone! I know a lot of you want to use the latest gke-gcloud-auth-plugin with GitHub Actions – so do I, and having the itch for a few months now I’ve created a GitHub Action that solves that for us. Just add this to your workflow, and I’ll be installed:

- uses: cobraz/setup-gke-gcloud-auth-plugin@v1

Feel free to contribute by opening issues and PRs here: https://github.com/cobraz/setup-gke-gcloud-auth-plugin

I don't like that you have to set

gcp:project

in a file in order to be able to run

pulumi up

since then it's visible in your repo...

Hello 👋 I'm new to Pulumi and trying to integrate it into my devops. I want to a service account that can be used by github actions to push/pull gcr images. I'm trying to grant the SA the correct permissions, but when I deploy this stack I dont see the storage admin role associated in with the SA in the IAM tab of the cloud console.

pulumi up -s staging

runs successfully so I dont think I have any errors. Can someone help me understand how to accomplish this?

const registry = new gcp.container.Registry('gcr', {
  project: gcp.config.project,
  location: 'US',
})

const gcrServiceAccount = new gcp.serviceaccount.Account(
  'gcr-service-account',
  {
    accountId: 'gcr-service-account',
    displayName: 'GCR Service Account',
    description:
      'Service account for CI services that interact with GCR',
  }
)

export const storageIAM = new gcp.storage.BucketIAMMember(
  'gcr-storage-bucket-iam',
  {
    bucket: registry.bucketSelfLink,
    role: 'roles/storage.admin',
    member: gcrServiceAccount.email.apply(
      (email) => `serviceAccount:${email}`
    ),
  }
)

How do I list compute Instances in a GCP project? In AWS I use

aws.ec2.getInstances

. The GCP API (not Pulumi) has

new compute.InstancesClient().aggregatedListAsync(...)

but this doesn't seem to be exposed in Pulumi anywhere. Am I missing something?

👋 Hello, team! Im trying to use pulumi operator in GKE. This operator is trying to deploy resources in the GCP account where is running (cloud run functions). I have a GCP service account mapped to the K8s service account and GKE_METADATA enabled. When pulumi operator runs it uses the GCP ServiceAccount by default (gcp automatically created) instead of the one associated with the K8s service account. The GCP provider is created without creds. I was expecting pulumi to get the credentials from GKE_METADATA and use them. Do i have the wrong assumption? how can I ask pulumi to use the SA coming from K8s?

Hi, Im trying to make

cloudrun.DomainMapping

with pulumi. However, my resource gets a postfix, such that the wanted domain is wrong. I want:

domain.example

I get:

domain.example-postfix

In pulumi, my domain mapping resource is:

domain_map = gcp.cloudrun.DomainMapping(
        "domain.example",
        location=gc_location,
        metadata=gcp.cloudrun.DomainMappingMetadataArgs(
            namespace=project_id,
        ),
        spec=gcp.cloudrun.DomainMappingSpecArgs(
            route_name=service.name,
        ),
        opts=pulumi.ResourceOptions(depends_on=[service]),
    )

Anyhelp is greatly appriceated! Best Regards Elias

How to do import with google-native? I'm trying to import pubsub subscription but I'm getting

error: Preview failed: property "projectsId"/"project" not found

. There are no examples for that

Hello guys, I've been trying to create a dns record set by using a dns_authorization data, with this code Trying to create the dns_authorization entries 'CNAME', fails with this error -

* Error creating DNS RecordSet: googleapi: Error 400: Invalid value for 'entity.change.additions[_<http://acme-challenge.gcp.foo.bar.io|acme-challenge.gcp.foo.bar.io>.][CNAME].name': '_<http://acme-challenge.gcp.foo.bar.io|acme-challenge.gcp.foo.bar.io>.', invalid

I redacted some data from the code but it should be pretty similar Did anyone encounter such issue before? Or knows what this means? Documentation about it is pretty bleak

Hello there. I am new to pulumi but loving it so far. I have a bunch of functions deployed in gcp and I want to create an API Gateway ( in GCP) and use the functions as x-google-backend. The functions have not been created by pulumi so I thought I could use the gcp.cloudfunctionsv2.getFunction to import them using their name. anyone familiar with

gcp.cloudfunctionsv2.getFunctionOutput

I can't find examples or make it work. any help is appreciated.

Hi, I'm building the CI/CD pipeline for the app I'm working on running in Google Cloud Run (GCR), where the CI/CD pipeline is managed by Google Cloud Build (GCB). GCB is set up with a trigger to the Github repo. All the IaC is build with Pulumi, and thus I want to integrate my Pulumi setup in the CD steps through the

cloudbuild.yaml

file. I have tried to follow the guide her: https://www.pulumi.com/docs/guides/continuous-delivery/google-cloud-build/

#!/bin/bash

# Download and install required tools.
# pulumi
curl -L <https://get.pulumi.com/> | bash
export PATH=$PATH:$HOME/.pulumi/bin

#Login to starlab project
pulumi login <gs://folder>

#Choose stack
pulumi stack select <stack-name>

#update pulumi
pulumi preview

pulumi login

works properly, however it cannot see the stack in the repo. It just throws the error:

error: no stack named 'starlab-iac' found

Another problem I have, is that I dont understand how to set my

PULUMI_CONFIG_PASSPHRASE

such that it is possible to run pulumi commands in

cloudbuild.yaml

such as

pulumi up

. Any help with my problem would be greatly appreciated. Best Regards Elias

Maybe I'm missing something obvious but after making a vanilla external address, how do I get the IP to use in a DNS update? I didn't expect

id

to work here but what should I use? I don't see it in the outputs in the documentation anywhere...

# First make an external IP
external_ip = gcp.compute.GlobalAddress(
    "externalip-%s" % cell_id,
    name = "externalip-%s" % cell_id)

# ... later ...

ingress_A_record = gcp.dns.RecordSet(
        "ingress-A-record-%s" % cell_id,
        managed_zone = dns_zone.name,
        name = "ingress.%s." % gcp_domain,
        type="A",
        rrdatas=[external_ip.id],
        ttl=300)