colossal-caravan-76991
09/23/2022, 9:29 AMlively-crayon-44649
09/23/2022, 10:24 AM// Normal Pulumi code setting up the bastion (in your case K8s cluster)
// ...
// Spawn a tunnel (spawn here from Node's child_process) using the details
// from the setup. bastion is an EC2 instance with SSM agent in my case. I
// return the same resource to appease the type checker/have something I can
// dependsOn later if need be.
const bastionTunnel = bastion.id.apply(id => {
spawn(
"aws",
[
"--profile",
config.aws.profile,
"--region",
config.aws.region,
"ssm",
"start-session",
"--target",
id,
"--document-name",
"AWS-StartPortForwardingSessionToRemoteHost",
"--parameters",
`{"host":["my-database-host"],"portNumber":["5432"], "localPortNumber":["9876"]}`,
],
)
return account.bastion
})
// Pulumi code that's going to set up the database. Pass in localhost:9876. Of course you
// would likely not hardcode the port, but find a free one, then pass the URL in as a variable
// or something
new pg.Database("foo", { host: "localhost:9876", ... ])
colossal-caravan-76991
09/23/2022, 10:31 AMI'm not sure what language you're in(TypeScript)
Which is essentially to "mid Pulumi script" just bring up the tunnel you need.Indeed that sounds very much like what we need, what extension points/hooks did you use for that? (We couldn't think of anything else than the provider API, but we're not married to that idea for sure.)
lively-crayon-44649
09/23/2022, 10:32 AM.run
will be better but I've not actually deployed this to prod yet -- just something I was playing around with and seems to workcolossal-caravan-76991
09/23/2022, 10:33 AMlively-crayon-44649
09/23/2022, 10:35 AMapply
or a local command you are encoding a dependency between later resources and the tunnel you set up.spawn
will block until process exit (which won't happen since the tunnel is long-running) and an asynchronous one will return immediately. So see how you get on I guess.colossal-caravan-76991
09/23/2022, 10:38 AMlively-crayon-44649
09/23/2022, 10:40 AMpreview
, once for up
colossal-caravan-76991
09/23/2022, 10:40 AMrun
package BTW, I did not know about it.lively-crayon-44649
09/23/2022, 10:41 AMcolossal-caravan-76991
09/23/2022, 10:45 AM(FWIW I don't think you want remote commands, but they are also potentially useful to know about)I do think the same yeah; best used with moderation.
The tunnel is still open afterRepresenting the connection/tunnel as a resource which other resources can depend on is an interesting approach too but I can't imagine that there would be a way to easily destroy them when necessary. I'll also consider your idea of cheating a little bit (e.g. try to register a hook with the runtime, nodejs in our case, to be called on process exit, which could just work). If you ever try out an approach feel free to ping in this thread (even a long time from now), I'd be happy to hear about it. And if anyone has any input for a.. erh, "_clean_" solution to setup+teardown, please chime in., and it will start a new one during the Previewing update stage.pulumi up
limited-rainbow-51650
09/23/2022, 11:13 AMcolossal-caravan-76991
09/23/2022, 11:25 AMup
call. I think our tricky issue comes from the fact that we can only establish this "port forward" connection to the target resource (Postgres pod) after it is created -- it does not exist yet before the up
call.
As such, I don't know that the hooks proposed there would solve the scenario.
(I suspect an XY problem https://en.wikipedia.org/wiki/XY_problem, probably related to our desire to keep both the creation of the Postgres service and its databases in the same stack as alluded to in my original message, but I am having a hard time convincing myself that this is such a bad idea. Implicit resources dependency management via Pulumi inputs and outputs is awesome. In contrast, orchestrating the setup of multiple stacks in the correct order feels like going in the wrong direction. It's a recurring issue we have with multiple internal services which need bootstrapping once they're up so we're paying reasonable attention to how we solve this given we'll probably use the same strategy many times.)lively-crayon-44649
09/23/2022, 12:06 PMcolossal-caravan-76991
09/26/2022, 10:10 AM