mkdir example-stack

pulumi new--dir example-stack

aws-python

cd example-stack

pulumi up

const resourceId = (resource: string) =>
  pulumi
    .all([resourceGroup.name, currentSubscription])
    .apply(
      ([resourceGroupName, subscription]) =>
        `/subscriptions/${subscription.subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${applicationGatewayName}/${resource}/${defaultName}`
    );

VM_SIZE = pulumi_azure_native.containerservice.ContainerServiceVMSizeTypes(
        config.require('vmSize'),
)

ResourceOptions

parent

dependsOn

def get_appgw_id(gw_name):
    return Output.concat("/subscriptions/",subscription_id,"/resourceGroups/",resource_group.name,"/providers/Microsoft.ManagedIdentity/userAssignedIdentities/",gw_name)
...
...
identity=network.ManagedServiceIdentityArgs(
        type="UserAssigned",
        user_assigned_identities={
        str(Output.concat(gatewayId.id)): {},
        f"{gatewayId.id.apply(lambda id: id)}": {},
        f"{Output.concat('/subscriptions/',subscription_id,'/resourceGroups/',resource_group.name,'/providers/Microsoft.ManagedIdentity/userAssignedIdentities',gatewayId.name)}": {},
        f"/subscriptions/{subscription_id}/resourcegroups/{resource_group.name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{gatewayId.name}": {},
        f"{get_appgw_id(gatewayId.name)}": {},
        f"/subscriptions/*****/resourcegroups/*****/providers/Microsoft.ManagedIdentity/userAssignedIdentities/*****": {},

        },
    ),

for i in range(replicas):
    vm_fqdn = dns_zone.apply(lambda a: f"couchbase{i + 1}-{db_name}.{a}")
    dns.RecordSet(f'couchbase{i + 1}-recordset-pubzone',
        managed_zone = dns_name,
        name = vm_fqdn,
        rrdatas=[replica.network_interfaces.apply(lambda a: a[0].get('networkIp'))],
        ttl = 300,
        type = "A",
        opts=pulumi.ResourceOptions(depends_on=[couch]))

pulumi up

CONFIG_PROJ = p.Config()
REGISTRY_USERNAME = CONFIG_PROJ.require('registryUsername')
REGISTRY_PASSWORD = CONFIG_PROJ.require_secret('registryPassword')

registry_credentials_encoded = base64.b64encode(
    f'{REGISTRY_USERNAME}:{REGISTRY_PASSWORD}'.encode(),
).decode()

REGISTRY_PASSWORD

<pulumi.output.Output object at 0x152478cd0>

REGISTRY_PASSWORD.apply(lambda s: s)

pulumi.Output.all(REGISTRY_PASSWORD).apply(lambda s: s)

Output

serviceAccounts = [
    ("droneci", "droneci", "Drone Service Account", ["roles/storage.admin"]),
    (
        "spinnaker",
        "spinnaker",
        "Spinnaker Service Account",
        [
            "roles/container.admin",
            "roles/container.clusterAdmin",
            "roles/container.developer",
            "roles/storage.admin",
        ],
    )
]

def bindToRole(name: str, sa: Account, args: Optional[dict] = None):
    """Given a GCP IAM Service Account and a list of roles, create a IAMBinginh between them."""
    for i, role in enumerate(args["roles"]):
        IAMBinding(
            f"{name}-{i}",
            members=[sa.email.apply(lambda email: f"serviceAccount:{email}")],
            project=args["project"],
            role=role,
        )

for saName, saId, saDesc, saRoles in serviceAccounts:
    sa = Account(
        saName, project=conf.get("project"), account_id=saId, display_name=saDesc
    )
    bindToRole(
        f"{saName}-roleBinding", sa, {"project": conf.get("project"), "roles": saRoles}
    )
    saKey = util.createServiceAccountKey(f"{saName}-key", sa)
    export(name=f"{saName}-serviceAccount-key", value=saKey)
    export(name=f"{saName}-serviceAccount-secret", value=util.clientSecret(saKey))
    export(name=f"{saName}-serviceAccount-email", value=sa.email)

~ gcp:projects/iAMBinding:IAMBinding: (refresh)
        [id=my-project/roles/storage.admin]
        [urn=urn:pulumi:dev::my-stack::gcp:projects/iAMBinding:IAMBinding::spinnaker-roleBinding-3]
        [provider=urn:pulumi:dev::my stack::pulumi:providers:gcp::default_4_17_0::620feff3-c68d-4f3f-b35d-715c080f8b7d]
        --outputs:--
      ~ etag     : "BwW/YsjdngI=" => "BwW/YucGdm0="
      ~ members  : [
          ~ [0]: "serviceAccount:spinnaker@my-project.iam.gserviceaccount.com" => "serviceAccount:droneci@my-project.iam.gserviceaccount.com"
        ]

self.user_email_iam_role = iam.IAMMember(
            resource_name="gcp-default-account-iam",
            member=self.user_email,
            role="roles/iam.serviceAccountUser",
            service_account_id=<http://self.sa|self.sa>
        )

<http://self.sa|self.sa> = iam.Account(
            resource_name="xx",
            project="xx",
            account_id="xx",
            display_name="xx"
        ),

Error creating service account: googleapi: Error 403: Permission iam.serviceAccounts.create is required to perform this operation on project projects/xx., forbidden

Diagnostics:

pulumi:pulumi:Stack (clearbooks-dev):

Traceback (most recent call last):

File "C:\ProgramData\chocolatey\lib\pulumi\tools\Pulumi\bin\pulumi-language-python-exec", line 14, in <module>

import pulumi

ModuleNotFoundError: No module named 'pulumi'

It looks like the Pulumi SDK has not been installed. Have you run pip install?

If you are running in a virtualenv, you must run pip install -r requirements.txt from inside the virtualenv.

error: an unhandled error occurred: Program exited with non-zero exit code: 1

raise Exception(
    Exception: 'depends_on' was passed a value that was not a Resource.
    error: an unhandled error occurred: Program exited with non-zero exit code: 1