Hi, Can you provide an answer to this issue?
<http...
# awsf
fancy-account-81543
03/04/2024, 12:29 AMHi, Can you provide an answer to this issue?
https://github.com/pulumi/pulumi-cloud-requests/issues/363
l
little-cartoon-10569
03/04/2024, 12:38 AMHave you cleared the sslPolicy property?
little-cartoon-10569
03/04/2024, 12:39 AMThat GitHub project is for issues about the Pulumi app / service (https://app.pulumi.com). This Slack is a better place for questions about whether or not something is a bug with the AWS provider.
little-cartoon-10569
03/04/2024, 12:40 AMIt's pretty hard to know what all those GitHub repos are for, Pulumi has a lot of them. But issues generally aren't for questions, they're for things that actually need to be fixed.
f
fancy-account-81543
03/04/2024, 12:47 AMAn error occurred during the process of rollback the configuration from TLS to TCP after configuring it on NLB. When creating a listener with aws.lb.Listener(), the ssl_policy parameter was not set. According to CloudTrail, the previous ssl_policy is still applied.
l
little-cartoon-10569
03/04/2024, 12:49 AMssl_policy must be unset when protocol is TCP. So you just need to remove that property from your constructor. Or maybe explicitly set it to undefined or whatever the equivalent is in your preferred language.
f
fancy-account-81543
03/04/2024, 12:52 AMI have configured it this way, but Pulumi is trying to create a listener using the previous ssl_policy.
Copy code
vpce_execute_api_external_listener = aws.lb.Listener(
"external-nlb-listener",
default_actions=[aws.lb.ListenerDefaultActionArgs(type="forward", target_group_arn=api_external_nlb_tg.arn)],
load_balancer_arn=lunar_api_external_nlb.arn,
port=443,
protocol="TCP"
)l
little-cartoon-10569
03/04/2024, 2:13 AMCan you explicitly set the ssl_policy to be undefined / null?
f
fancy-account-81543
03/04/2024, 2:14 AMYes, I will give it a try.
fancy-account-81543
03/04/2024, 5:00 AMEven if I add ssl_policy=None explicitly, the same error message still occurs.
Copy code
vpce_execute_api_external_listener = aws.lb.Listener(
"external-nlb-listener",
default_actions=[aws.lb.ListenerDefaultActionArgs(type="forward", target_group_arn=api_external_nlb_tg.arn)],
load_balancer_arn=lunar_api_external_nlb.arn,
port=443,
protocol="TCP",
ssl_policy=None
)fancy-account-81543
03/04/2024, 7:46 AM1. Delete the target group and listener.
2. Add the target group and listener again, this time set to TCP.
I successfully deployed it in two stages.
l
little-cartoon-10569
03/04/2024, 6:35 PMGreat that it's solved but it shouldn't have to be like that. Pulumi can mark the ssl_policy as delete-replace, if necessary.