https://pulumi.com
Join Slack
How do you integrate pulumi with terraform? I am specifically talking about secrets which should not...
# general
b
How do you integrate pulumi with terraform? I am specifically talking about secrets which should not be visible on tf vars, so opening the environment and passing the data to terraform through TF_VARS doesn’t seem fully correct - or am I missing something? (https://www.pulumi.com/docs/esc/integrations/infrastructure/terraform/) Basically I would like to use pulumi esc as a source for terraform, so that it can coordinate with vercel / google secret manager and keep the values in sync. What do you think?
l
I think you just use environment variables. 
esc run devenv -- tf plan
should work.
b
aren’t TF vars visible in plaintext (e.g. in the tf state files)? Should we save API keys there?
l
They're only available for the life of the executing environment. Yes, they're in plain text for that duration, and in that process.
Also see this:
The command to run is assumed to be non-interactive by default and its output streams are filtered to remove any secret values. Use the -i flag to run interactive commands, which will disable filtering.
From https://www.pulumi.com/docs/esc/cli/commands/esc_run/
So if you accidentally log a secret to the console in your Pulumi program, that at least will be mangled.
BTW I'm not talking about TFvars. Just env vars.
b
Ok thank you, let me look more into this! 🙂
4 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by