Hey all, I recently deployed the aws-load-balancer-controller chart into an EKS cluster with Pulumi. The actual deploy worked great, but now every

pulumi preview

is convinced that it needs to delete all the resources deployed by that chart:

└─ kubernetes:<http://helm.sh/v3:Chart|helm.sh/v3:Chart>                                                   aws-load-balancer-controller                                                 
 -      ├─ kubernetes:<http://rbac.authorization.k8s.io/v1:Role|rbac.authorization.k8s.io/v1:Role>                               default/aws-load-balancer-controller-leader-election-role         delete     
 -      ├─ kubernetes:core/v1:Secret                                                  default/aws-load-balancer-tls                                     delete     
 -      ├─ kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding>                 aws-load-balancer-controller-rolebinding                          delete     
 -      ├─ kubernetes:core/v1:ServiceAccount                                          default/aws-load-balancer-controller                              delete     
 -      ├─ kubernetes:<http://rbac.authorization.k8s.io/v1:RoleBinding|rbac.authorization.k8s.io/v1:RoleBinding>                        default/aws-load-balancer-controller-leader-election-rolebinding  delete     
 -      ├─ kubernetes:core/v1:Service                                                 default/aws-load-balancer-webhook-service                         delete     
 -      ├─ kubernetes:<http://admissionregistration.k8s.io/v1:ValidatingWebhookConfiguration|admissionregistration.k8s.io/v1:ValidatingWebhookConfiguration>  aws-load-balancer-webhook                                         delete     
 -      ├─ kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole>                        aws-load-balancer-controller-role                                 delete     
 -      ├─ kubernetes:<http://admissionregistration.k8s.io/v1:MutatingWebhookConfiguration|admissionregistration.k8s.io/v1:MutatingWebhookConfiguration>    aws-load-balancer-webhook                                         delete     
 -      ├─ kubernetes:apps/v1:Deployment                                              default/aws-load-balancer-controller                              delete     
 -      └─ kubernetes:<http://apiextensions.k8s.io/v1beta1:CustomResourceDefinition|apiextensions.k8s.io/v1beta1:CustomResourceDefinition>           targetgroupbindings.elbv2.k8s.aws                                 delete

If you actually go through with the

pulumi up

though, it (correctly) leaves all those resources alone. Has anyone seen anything like this recently? I saw a few old issues about

pulumi preview

being wrong, but none that were presently open.

can you share your code?

I can share part of it! https://gist.github.com/benesch/4854b113991381f5c2db674acbdfe097

i can't see anything immediately obvious, I'm wondering if it's the transformation? can you try comment that out and see if it still tries to delete?

Yeah, I had the same thought earlier. Commenting it out doesn’t help unfortunately. Let me get you a small reproducer.