Is there a pulumi way to do the following? As in zip a file/directory and get the md5 hash like this.

data "archive_file" "source_archive" {
  source_dir  = var.source_directory
  output_path = "./main.zip"
  type        = "zip"
}

resource "google_storage_bucket_object" "archive" {
  name   = "${lower(replace(base64encode(data.archive_file.source_archive.output_md5), "=", ""))}.zip"
  bucket = google_storage_bucket.source_bucket.name
  source = data.archive_file.source_archive.output_path
}

I saw https://www.pulumi.com/docs/intro/concepts/assets-archives/#archives but as far as I can tell, it just represents an archive. It does not actually create the archive... Please correct me if i'm wrong.

Hey folks! I’m trying to automate making changes to a git repo via pulumi, but I’m having issues. I created a dynamic provider in TypeScript that uses

child_process.exec()

to call out to a bash script, but it seems like the “black magic” that pulumi resorts to for dynamic providers doesn’t like

child_process

. Is there any way around that? What I need to do is clone a git repo into a temp dir, copy some files in a branch, commit, push and create a PR using the GitHub CLI. The bash script does all of that very nicely, if only I could invoke it! 🤔

Is something like this possible? (Essentially destructuring a promise)

const [projectId, projectNumber] = gcp.organizations.getProject({}).then(prj => [prj.id, prj.number])

Hello, I wonder if

await

can be used in typescript. How do you use something like

aws.iam.User.get

which returns a promise without await in your

index.ts

?

Good day everyone... does anyone know if there is a way for the

pulumi cli

to proceess a

.env

file? I want to simulate what our deployment pipelines do by passing in secrets as Env Var and I don't want to make a bunch of actual Env Var in my shell session.

I've recently added CosmosDB provisioning to our pulumi script. I've used the new azure-native SDK (in beside the existing azure SDK for other resources) and when I run the pulumi app locally, everything works. When I run the script on our AzureDevOps build agent, I get this error:

2021-03-04T17:23:48.8597836Z   azure-native:documentdb/v20210301preview:DatabaseAccount (releasesplatform-cosmosdb):
2021-03-04T17:23:48.8598404Z     error: building auth config: obtain subscription() from Azure CLI: Error parsing json result from the Azure CLI: Error waiting for the Azure CLI: exit status 1

This build worked prior to the cosmosdb additions. I've re-run another one of our pipelines that executes a pulumi app and it continues to work.

I just did an

az logout

and tried

pulumi up

and now the error is on my local machine as well.

I have this in my

pulumi config

which is what the pipelines do for authentication with Azure

I've set

"paths": {}

and

baseUrl

in my tsconfig.json Webstorm and VS both see and understand my custom paths just fine. However

pulumi up

says it can't find the modules, any hoops i gotta jump through to get pulumi to understand the pathing?

Hi, I'm using a pulumi.dynamic.ResourceProvider in my typescript program. That works locally, but on the deploy agent I get the following error:

error: no resource plugin 'pulumi-nodejs' found in the workspace or on your $PATH

Does anyone know how to attack this?

TIL: pulumi.Config('aws') lets you reference the aws variables set (bag?) in your Pulumi.yaml. This was 🤯. I had to keep exporting AWS_PROFILE, because I have some cert generation code that requires being run in us-east-1, which uses a

new Provider

which doesn't automatically pick up the profile set by

config set aws:profile blah

After `crd2pulumi`'ing cert-manager crds, I'm trying to use the generated code, but can't figure out where this dependency comes from on

pulumi up

.

Diagnostics:
  pulumi:providers:kubernetes (default_0_0_1):
    error: no resource plugin 'kubernetes-v0.0.1' found in the workspace or on your $PATH, install the plugin using `pulumi plugin install resource kubernetes v0.0.1`

package.json

of my local autogenerated package:

{
  "name": "@pulumi/depo-cert-manager",
  "version": "0.0.1",
  "scripts": {
    "build": "tsc"
  },
  "peerDependencies": {
    "@pulumi/pulumi": "^2.22.0"
  },
  "pulumi": {
    "resource": true
  },
  "devDependencies": {
    "typescript": "^4.2.3"
  }
}

loading that package in the main pulumi program

package.json

with:

"dependencies": {
    "@pulumi/depo-cert-manager": "file:cert-manager-types",

What's causing pulumi to think of this package as a plugin? I changed to

"version": "0.0.2"

, and I get the following on `pulumi up`:

Diagnostics:
  pulumi:providers:kubernetes (default_0_0_2):
    error: no resource plugin 'kubernetes-v0.0.2' found in the workspace or on your $PATH, install the plugin using `pulumi plugin install resource kubernetes v0.0.2`

Hi guys, Is it possible to run some actions in one AWS Organisation and in the same stack reference an item from a different AWS organisation. My case is I have a load balancer in Org A, and a DNS zone in Org B. I want to create a DNS CNAME entry in Org B pointing to Load balancer endpoint from Org A. Is this possible? If yes, how? Thanks

I need to get a collection of lambda function ARNs using the aws-sdk (using promises) prior to executing my infrastructure as code. How do I go about ensuring my promises resolve prior to executing the Pulumi plan?

Anyone seen this error before?

TypeError: Class constructor ComponentResource cannot be invoked without 'new

Is there a way from within TS to determine if Pulumi is currently executing the code?

hello, when calling this function:

export declare function buildAndPushImage(imageName: string, pathOrBuild: pulumi.Input<string | DockerBuild>, repositoryUrl: pulumi.Input<string>, logResource: pulumi.Resource, connectToRegistry?: () => pulumi.Input<Registry>, skipPush?: boolean): pulumi.Output<string>;

what should I pass as "logResource"?

I think I'm hitting a bit of an antipattern here (probably in more ways than one) - but it has seemed to be working fine til now.. In

index.ts

I create a resource (resourceGroup) as

const rg = new azure.resource... etc

then afterwards place rg in an object

createdStuff = { rg: { name: rg.name.apply(name => name), id: rg.id.apply(id => id), resource: rg}}

and that's fine. then i create a complicated set of network operations, storage operations, etc - and put them each into their own module which follow the model (module.ts:

export const createNetwork = function(curStack : any) : any { .. I do all my stuff here  and update curStack with new resources .. until.. return curStack }

). So far this seems fine. Then I tried making my fourth resource this way - and relying on

createdStuff.rg.name

as part of the name of the resource I'm creating.. I've used

createdStuff.rg.name

many times before, in all references to

resourceGroupName

in at least 8 other resources, but THIS it doesn't like.. I'm getting ye old classic

ror: azure-native:keyvault:Vault resource 'Calling [toString] on an [Output<T>] is not supported.

though as you have seen,

createdStuff.rg.name == rg.name.apply(name => name)

. I just feel that it's weird.

In all likelihood I'm doing about 50 things wrong here - but this one has me a bit stumped I must say.

is it possible to alias a resource to another resource that used to be part of a

ComponentResource

? basically I have an S3 bucket inside a

ComponentResource

however I now want to refactor this template and move the bucket out of the component resource, but i don't want to replace the actual resource in AWS. is this possible? I basically removed the entire component resource from my code, copy-pasted just the bucket resource into the template. I've then set a few variations of

aliases

on the resource but each time i run

pulumi up

it's seeing them as two different resources. I feel like maybe i'm just not providing the right alias but just wanted to check if this was actually possible

vpc resources don't seem to be created.

Resources:
    1 unchanged

Do you want to perform this update? yes
Updating (dev):
     Type                 Name               Status     
     pulumi:pulumi:Stack  pulumi-vpc-ts-dev             
 
Resources:
    1 unchanged

Duration: 1s

Hello, I’m looking for a Pulumi example of how to pass a secret (at the moment it’s a pulumi secret) to a ECS Fargate Task container secrets, so I can inject passwords in a secure way. Would you be able to point me to some relevant documentation / resources?

Anyone here managed to use pulumi together with

pnpm

? I'm banging my head against the wall for quite some time now... Afaik

read-package-tree

is used by pulumi to find all dependencies, but this is expecting a flat node_modules directory and disregards the

node_modules/.pnpm

directory. I also desperately used

shamefully-hoist

, which changed the error messages but didn't unblock me. Any ideas?

What's the easiest way to guarantee that a resource will always recreate when running

pulumi up

? In this case it's a

pulumi.dynamic.Resource

and I tried always returning

{ changes: true }

from

diff

, but that didn't work.

Speaking of dynamic resources, does anyone have a good example with thorough testing? I’m piecing things together from various docs but I’d like a idiomatic/best practice to compare with

How do I

pulumi import

a custom resource? The urn has a

$

in it, e.g.:

db$aws:rds/instance:Instance

pulumi import 'db$aws:rds/instance:Instance' production-db-instance-rds prod-mariadb

fails with:

panic: fatal: A precondition has failed for urn

goroutine 190 [running]:
<http://github.com/pulumi/pulumi/sdk/v2/go/common/util/contract.failfast(...)|github.com/pulumi/pulumi/sdk/v2/go/common/util/contract.failfast(...)>

I have to believe I am doing something simply wrong here, but the snippet below will not export my subnet id. Any suggestions? What is the best way to export my subnet ID after the VPC is created?

ipv6VPC = new aws.ec2.Vpc("IPv6VPC_1", {
  "cidrBlock": "10.10.0.0/16",
  "assignGeneratedIpv6CidrBlock": true
});

ipv6Subnet = pulumi.all([ipv6VPC.cidrBlock, ipv6VPC.ipv6CidrBlock]).apply(([v4Cidr, v6Cidr]) => {
  new aws.ec2.Subnet("IPv6Subnet_1", {
    "vpcId": ipv6VPC.id,
    "cidrBlock": v4Cidr.replace(/0.0\/.+$/, "10.0/24"),
    "ipv6CidrBlock": v6Cidr.replace(/00::\/.+/, "10::/64")
  });
})


exports.net1VpcId = ipv6VPC.id;
exports.net1SubnetId = ipv6Subnet.id;

Whenever I pass a listener to my external ALB created with crosswalk’s help I expose my service to the entire world, even though my custom security group rules restrict traffic to my ip address only. Is there a way to disable this behaviour and still use awsx? https://github.com/pulumi/pulumi-awsx/blob/master/nodejs/awsx/lb/application.ts#L231-L249

const http = new aws.ec2.SecurityGroup(
  `${sharedPrefix}-http`,
  {
    name: `${sharedPrefix}-http`,
    ingress: [
      {
        fromPort: 80,
        toPort: 80,
        protocol: 'TCP',
        cidrBlocks: [...whitelisted],
      },
    ],
    vpcId: vpc.id,
    tags: overridenTags,
  },
  { deleteBeforeReplace: true }
);

const https = new aws.ec2.SecurityGroup(
  `${sharedPrefix}-https`,
  {
    name: `${sharedPrefix}-https`,
    ingress: [
      {
        fromPort: 443,
        toPort: 443,
        protocol: 'TCP',
        cidrBlocks: [...whitelisted],
      },
    ],
    vpcId: vpc.id,
    tags: overridenTags,
  },
  { deleteBeforeReplace: true }
);
const alb = new awsx.lb.ApplicationLoadBalancer(albName, {
  name: albName,
  external: true,
  vpc: vpc,
  subnets: vpc.publicSubnetIds,
  securityGroups: [http.id, https.id],
  tags: overridenTags,
});

I’d like to create the app service then get the service principal from the newly created app service in azure, is there a best way to accomplish this? Should I wrap the app in a async function and await to get it to happen in the correct order and wait for the app to finish being created? I know I can’t use the output name of the app as the argument for getServicePrincipal because that will just pass it as an Output<string>. Is there a better way of accomplishing this?