Hi. It seems that Pulumi Kubernetes provider doesn’t know it needs to recreate

(Cluster)RoleBinding

when a

roleRef

is changed - shall I open a github issue?

kubernetes:<http://rbac.authorization.k8s.io:RoleBinding|rbac.authorization.k8s.io:RoleBinding> (k8s-auditors):
    error: Plan apply failed: 1 error occurred:
    
    * <http://RoleBinding.rbac.authorization.k8s.io|RoleBinding.rbac.authorization.k8s.io> "k8s-auditors" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"<http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>", Kind:"ClusterRole", Name:"view"}: cannot change roleRef

I'd recommend checking that that change can be made via, say, kubectl first (assuming you haven't already) - I know there are some rules about what resources can be updated vs need to be recreated when it comes to rolebindings, but I can't remember exactly what they are

Yes, changing the value in-place is not allowed by Kubernetes API server. I think I saw a similar issue and if I remember correctly, Pulumi has a list of resources that need to be recreated instead of changed in place.

@gifted-island-55702 I’ll fix this today.

Great - thank you @creamy-potato-29402. BTW when such an issue gets fixed is is enough to upgrade npm or python package to the new version or do we need a new pulumi binary release?

@gifted-island-55702 just upgrade the package.