i'm using helm.v3.Release and trying to upgrade postgres-operator from 1.7.1 to 1.8.0, seems like their CRD changed but pulumi isn't upgrading it. Any suggestions?

Hi! I have a helm chart that includes a batch job, and everytime I run

pulumi up

, the changeset includes running a helm upgrade due to the batch job. Is there a way to ignore changes to batch jobs that may be created as part of the helm release?

This is more of a k8s/EKS question than a Pulumi one, but I'm hoping someone here will have some insight. I'm provisioning EKS clusters. I'm setting up the efs-csi driver for PVC. I could have 1 EFS drive and use a separate Access Point for each service which needs PV, or I could make an EFS drive for each service. I can't decide which is better or if there's really any difference. What would you do and why?

Is there any way I can easily customize the kubernetes Provider to open up an SSH tunnel to a bastion-host before performing any operations against the cluster?

Hey everyone, can anyone share proven practices on installing a cluster on own hardware (baremetal, VMs on hypervisors) with pulumi. Similar to EKS/GKE but not on cloud (trying to find a way to include pulumi to an homelab environment)

can’t seem to get the simple EKS with Fargate example to work, the IAM user I’m using has the

AdministratorAccess

policy

import * as pulumi from "@pulumi/pulumi";
import * as awsx from "@pulumi/awsx";
import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";

export const createCluster = (stackName: string) => {
  const vpc = new awsx.ec2.Vpc(`${stackName}-eks-cluster`, {
    numberOfAvailabilityZones: "all",
  });

  const rolesSSOAdmin = pulumi.output(aws.iam.getRoles({
    nameRegex: ".*AWSReservedSSO_AWSAdministratorAccess.*",
  }))

  const cluster = new eks.Cluster(stackName, {
    fargate: true,
    vpcId: vpc.id,
    createOidcProvider: true,
    privateSubnetIds: vpc.privateSubnetIds,
    publicSubnetIds: vpc.publicSubnetIds,
    enabledClusterLogTypes: [
      "api",
      "audit",
      "authenticator",
      "controllerManager",
      "scheduler",
    ],
    roleMappings: [
      {
        groups: ["system:masters"],
        roleArn: rolesSSOAdmin.arns[0],
        username: "pulumi:admin-usr",
      },
    ],
  });

  return cluster;
};

error:

eks:index:VpcCni (prod-vpc-cni):
    error: Command failed: kubectl apply -f /var/folders/07/53v8pkz52xd_324b5n15b9l40000gn/T/tmp-369306DJMe7fe12yG.tmp
    error: You must be logged in to the server (the server has asked for the client to provide credentials)

ideas?

can anyone share some guidance on how to control the version of EKS k8s engine? I found info on setting the node’s AMI but not the cluster itself specifically wondering about fargate, as there’s no AMI settings there

hi folks, could someone share how do you run

pulumi up

in a k8s cluster? i searched in the doc and slack, but couldn't find anything i need to create a resource against a k8s service address but i can't do

port forward

in this case. i'd like to run

pulumi up

in cluster, specifically in a a cicd pipeline

is anyone getting this error

Kubeconfig user entry is using deprecated API version <http://client.authentication.k8s.io/v1alpha1|client.authentication.k8s.io/v1alpha1>. Run 'aws eks update-kubeconfig' to update.

I recently upgraded my local kubectl to 1.24, so i've had to upgrade my awscli to 2.6.3 (released in the past few days)

Maybe i'll have better luck in here. 🙂 Does anyone have any suggestion for this? https://pulumi-community.slack.com/archives/C84L4E3N1/p1652114588651209

i'm using pulumi in github actions... and this client authentication v1alpha1 is frustrating. I've upgraded

@pulumi/eks

to 0.38, but my output kubeconfig is still showing v1alpha1... which then breaks everything downstream. I've added the

unfor19/install-aws-cli-action

to ensure i've got the latest AWS cli version. Anyone else found a solution for github actions besides rolling back

kubectl

to an old version?

looking into my issues with v1alpha1... it looks like my generated kubeconfig is at issue, and the 0.38 version still generates v1alpha1. https://github.com/pulumi/pulumi-eks/blob/d599a1b1f3650dba4c3dc4f560080e95ce6fb5b1/nodejs/eks/cluster.ts#L225

getting a deprecation warning for the whole stack, how can I find the resource that’s generating it?

pulumi:pulumi:Stack (infra-sandbox):
    Warning: <http://apiextensions.k8s.io/v1beta1|apiextensions.k8s.io/v1beta1> CustomResourceDefinition is deprecated in v1.16+, unavailable in v1.22+; use <http://apiextensions.k8s.io/v1|apiextensions.k8s.io/v1> CustomResourceDefinition

any recommendations for a local dev k8s cluster provider to use for dev stack? minukube? k3d? kind?

Hello, I need some help. Im getting this error with Github actions:

getting credentials: exec plugin is configured to use API version <http://client.authentication.k8s.io/v1beta1|client.authentication.k8s.io/v1beta1>, plugin returned version <http://client.authentication.k8s.io/v1alpha1|client.authentication.k8s.io/v1alpha1>

Any walkaround of how to solve this ?

the inputs to https://www.pulumi.com/registry/packages/kubernetes/api-docs/yaml/configfile/#inputs seems to be empty? is there a any documentation to see what is possible to be passed into the resource? specifically ideally i want to change the pulumi name for the resources created in the file, i have multiple clusters in 1 stack and it’s currently giving me an error saying the urn already exists.

I'm using the

kustomize

module in pulumi-python, trying to deploy from GitHub. How can I use

transform

to add

namespace

to all resources? Or is there a better workaround?

hi pulumi kubes folks... I am trying to understand the wording in Helm-release

<https://www.pulumi.com/registry/packages/kubernetes/api-docs/helm/v3/release/>

around development version which says

devel bool

    Use chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored.

i am looking at this because i want to deploy longhorn 1.3.0-rc1 to test it as a helm release. the way this reads i can specify the version OR devel=true, but not both . . . is this right ? I know its not working for me to specify both, but i dont really understand the logic. the devel flag lets helm look at development versions in the helm repo as well as released versions. What is the point of having a devel flag if you cant specify WHICH devel version you want to deploy ???

Hey folks! If you're at KubeCon EU this morning, drop by our booth and say hello!

is there a way to change the URN created by resources in a helm chart? like give it a prefix or something?

adding to the ^question, the only problem i have with resources is the CRD the helm charts creates, helm v3 supports

skip-crds

flag, is there a way to pass this to the pulumi helm object?

Is it possible to organise stacks in a subfolder?

I have an infrastructure project for several Kubernetes clusters and I'm concerned about there being so many Pulumi stack config files at the top level

Because I have a stack-per-cluster

@powerful-planet-88446 absolutely, check out: https://www.pulumi.com/docs/guides/organizing-projects-stacks/. If you are worried about access control as well to those projects and stacks you should check out the following features in the pulumi service: https://www.pulumi.com/docs/intro/pulumi-service/teams/ & https://www.pulumi.com/docs/intro/pulumi-service/projects-and-stacks/#stack-permissions

Hi, We are just getting started using Pulumi in our organisation. We are using Python as we are a Python shop for our main applications. We have got Pulumi creating an eks cluser using pulumi-eks, now we are trying to get it to actually deploy something to the cluster. We are following https://www.pulumi.com/registry/packages/kubernetes/how-to-guides/eks/ modifying the code as that is in JavaScript/TypeScript, however it I'm having problems when specifying the cluster The example has:

{
        provider: cluster.provider,
}

as the third parameter(opts), I tried converting this to Python as:

opts=pulumi.ResourceOptions(provider=cluster.provider),

However my IDE complains about it being the wrong type (Output[Provider] instead of ProviderResource) and when running

pulumi up

, I get:

ValueError: Attempted to register resource kubernetes:apps/v1:Deployment with a provider for '<pulumi.output.Output object at 0x7f695f68c5d0>'
    error: an unhandled error occurred: Program exited with non-zero exit code: 1

Any idea of what I am doing wrong or how I can fix this?

hi folks, I’m looking to test a pulumi k8s setup as part of CI before actually deploying to production has anyone tried out https://github.com/helm/kind-action or https://github.com/marketplace/actions/setup-minikube ?

https://docs.datadoghq.com/agent/kubernetes/control_plane/?tab=helm#EKS datadog recommends adding annotations to default/kubernetes service so API server metrics are collected with pulumi, I can’t seem to find a way to GetService, but even so I remember that all of the attributes are read only and I can’t seem to find a way to specify this customization in the

eks.Cluster

resource ideas?

I am trying to replicate what the

pulumi-eks

package does in golang but I appear to get an error. I'm trying to update the configmap for

aws-auth

. In the nodejs/eks version it does this

const eksNodeAccess = new k8s.core.v1.ConfigMap(`${name}-nodeAccess`, {
        apiVersion: "v1",
        metadata: {
            name: `aws-auth`,
            namespace: "kube-system",
        },
        data: nodeAccessData,
    }, { parent, provider: k8sProvider });

Which appears to work by actually altering the configmap. However in golang when I try do the same I get an error

_, err = corev1.NewConfigMap(ctx, "aws-auth", &corev1.ConfigMapArgs{
			Metadata: &metav1.ObjectMetaArgs{
				Name: pulumi.String("aws-auth"),
				Namespace: pulumi.String("kube-system"),
			},
			Data:       pulumi.StringMap{
				"mapRoles": roleConfig,
			},
		}, pulumi.Provider(kubeProvider))

The error is

resource kube-system/aws-auth was not successfully created by the Kubernetes API server : configmaps "aws-auth" already exists

How does the node version manage to do it whilst the go version can't?