https://pulumi.com
Join Slack
Hi, Can you provide an answer to this issue? <https://github.com/pulumi/pulumi-cloud-requests/issues...
# aws
f
Hi, Can you provide an answer to this issue? https://github.com/pulumi/pulumi-cloud-requests/issues/363
l
Have you cleared the sslPolicy property?
That GitHub project is for issues about the Pulumi app / service (https://app.pulumi.com). This Slack is a better place for questions about whether or not something is a bug with the AWS provider.
It's pretty hard to know what all those GitHub repos are for, Pulumi has a lot of them. But issues generally aren't for questions, they're for things that actually need to be fixed.
f
An error occurred during the process of rollback the configuration from TLS to TCP after configuring it on NLB. When creating a listener with aws.lb.Listener(), the ssl_policy parameter was not set. According to CloudTrail, the previous ssl_policy is still applied.
l
ssl_policy must be unset when protocol is TCP. So you just need to remove that property from your constructor. Or maybe explicitly set it to undefined or whatever the equivalent is in your preferred language.
f
I have configured it this way, but Pulumi is trying to create a listener using the previous ssl_policy.
Copy code
vpce_execute_api_external_listener = aws.lb.Listener(
    "external-nlb-listener",
    default_actions=[aws.lb.ListenerDefaultActionArgs(type="forward", target_group_arn=api_external_nlb_tg.arn)],
    load_balancer_arn=lunar_api_external_nlb.arn,
    port=443,
    protocol="TCP"
)
l
Can you explicitly set the ssl_policy to be undefined / null?
f
Yes, I will give it a try.
Even if I add ssl_policy=None explicitly, the same error message still occurs.
Copy code
vpce_execute_api_external_listener = aws.lb.Listener(
    "external-nlb-listener",
    default_actions=[aws.lb.ListenerDefaultActionArgs(type="forward", target_group_arn=api_external_nlb_tg.arn)],
    load_balancer_arn=lunar_api_external_nlb.arn,
    port=443,
    protocol="TCP",
    ssl_policy=None
)
1. Delete the target group and listener. 2. Add the target group and listener again, this time set to TCP. I successfully deployed it in two stages.
👍 1
l
Great that it's solved but it shouldn't have to be like that. Pulumi can mark the ssl_policy as delete-replace, if necessary.
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by