Hey team how do I get the identity of the ingress applicatio

Question

Hey team how do I get the identity of the ingress application gateway add on of AKS cluster My scenario is as below I m creating a new AKS cluster using `ManagedCluster` API with `ingressApplicationGateway` as one of the add on profiles After the creation I m trying to get the identity of this add on in order to assign the required permissions to manage the application gateway But I m having trouble getting this identity using `UserAssignedIdentity Get` Pulumi preview fails because it expects the identity to be already available but it wouldn t be until the cluster is created Thanks

tall-librarian-49374 · Answer

Could you share your relevant code There s probably an `apply` missing somewhere in the chain

flaky-planet-42808 · Answer

Sure ```var ingressAddOnProfileName = ingressApplicationGateway var cluster = new ManagedCluster clusterName new ManagedClusterArgs lt SNIP gt AddonProfiles = ingressAddOnProfileName new ManagedClusterAddonProfileArgs Enabled = true Config = applicationGatewayId appGateway Id var agicReader = new RoleAssignment cluster AddonProfiles Apply x = gt x ingressAddOnProfileName Identity ObjectId AzureBuiltInRole Reader resourceGroupName roleName ```

flaky-planet-42808 · Answer

So RoleAssignment is our custom method to create role assignments

flaky-planet-42808 · Answer

Pulumi preview fails with this error ```failed with an unhandled exception System NullReferenceException Object reference not set to an instance of an object at KubernetesCluster string clusterName string location string environment string environmentPrefix Output lt string gt securityStorageAccountId UserAssignedIdentity appGatewayIdentity string clusterSubnetId Output lt string gt loganalyticsWorkspaceId PublicIPAddress appGatewayPublicIp + ImmutableDictionary lt string ManagedClusterAddonProfileResponse gt x = gt 2 in KubernetesCluster cs line 321 at Output lt U gt Pulumi Output lt T gt Apply lt U gt Func lt T U gt func + T t = gt at async Task lt OutputData lt U gt gt Pulumi Output lt T gt ApplyHelperAsync lt U gt Task lt OutputData lt T gt gt dataTask Func lt T Output lt U gt gt func at async Task lt OutputData lt object gt gt Pulumi Output lt T gt Pulumi IOutput GetDataAsync at async Task lt object gt Pulumi Serialization Serializer SerializeAsync string ctx object prop bool keepResources x 2 at async Task lt SerializationResult gt Pulumi Deployment SerializeFilteredPropertiesAsync string label IDictionary lt string object gt args Predicate lt string gt acceptKey bool keepResources at async Task lt PrepareResult gt Pulumi Deployment PrepareResourceAsync string label Resource res bool custom bool remote ResourceArgs args ResourceOptions options at async Task lt string urn string id Struct data ImmutableDictionary lt string ImmutableHashSet lt Resource gt gt dependencies gt Pulumi Deployment RegisterResourceAsync Resource resource bool remote Func lt string Resource gt newDependency ResourceArgs args ResourceOptions options at async Task lt string urn string id Struct data ImmutableDictionary lt string ImmutableHashSet lt Resource gt gt dependencies gt Pulumi Deployment ReadOrRegisterResourceAsync Resource resource bool remote Func lt string Resource gt newDependency ResourceArgs args ResourceOptions options at async Task Pulumi Deployment CompleteResourceAsync Resource resource bool remote Func lt string Resource gt newDependency ResourceArgs args ResourceOptions options ImmutableDictionary lt string IOutputCompletionSource gt completionSources ```

flaky-planet-42808 · Answer

line 321 is the where we do the role assignments

tall-librarian-49374 · Answer

I see I think the engine assumes that AddonProfiles are populated already because they are both input and outputs You may need to add null checks inside your Apply and return some default value for the sake of preview

important-book-47803 · Answer

I have run into a similar issue where once a change is made to the managed cluster the AddonProfiles ingressApplicationGateway Identity gets set to null and so fails with a null exception If deploying to an empty stack this works or changes outside of the managed cluster Looks like as the managged cluster already exists it assumes all values are populated Will let you know if I find anything

flaky-planet-42808 · Answer

Update I was able to workaround this problem by doing the role assignment within the `Apply` also made role assignment function to explicitly depend on the cluster by using `CustomResourceOptions DependsOn = cluster ` so that the role assignments wouldn t run before cluster creation during preview ```var ReaderAssignment = cluster AddonProfiles Apply x = gt new RoleAssignment x ingressAddOnProfileName Identity ObjectId AzureBuiltInRole Reader ApplicationResourceGroup GetResourceGroupId environment $ clusterName agic reader assignment cluster ```

tall-librarian-49374 · Answer

Creating resources inside `Apply` is generally discouraged as your previews may not be accurate I m fairly sure you could produce inputs in Apply and then assign them to `RoleAssignment` at the top level Let me know if you need help with that