Anyone have any idea why a k8s secret containing a GCP Servi

Question

Anyone have any idea why a k8s secret containing a GCP ServiceAccount s credentials would constantly be replaced every time Pulumi detects it as being empty every time `up` is run

white-balloon-205 · Answer

This is See also

cool-egg-852 · Answer

Thanks

cool-egg-852 · Answer

Once I upgraded the provider I started getting another error unfortunately `error Failed to check for changes in resource sellercenter shopify app ls7jmimu sellercenter shopify app v46sn5kv because of an error computing the JSON patch describing the resource changes Internal error occurred admission webhook <http configmaps vault secrets webhook admission banzaicloud com|configmaps vault secrets webhook admission banzaicloud com> does not support dry run`

cool-egg-852 · Answer

So whatever changes were done are making a critical BC break I think

creamy-potato-29402 · Answer

We re working on a fix

cool-egg-852 · Answer

Is this a known issue I should track on GH

cool-egg-852 · Answer

Also thanks for working on a fix

creamy-potato-29402 · Answer

nope it s tracked in this PR <https github com pulumi pulumi kubernetes pull 682>

cool-egg-852 · Answer

Thanks

creamy-potato-29402 · Answer

< cool egg 852> can you please try development version `0 25 4 dev 1564681515`

creamy-potato-29402 · Answer

that seems like it should fix that cc < gorgeous egg 16927>

cool-egg-852 · Answer

Sure

cool-egg-852 · Answer

Doesn t seem to have fixed it

cool-egg-852 · Answer

I ve seem some more work on that PR Is there another version you d like me to try

gorgeous-egg-16927 · Answer

< cool egg 852> Would you be able to open an issue with a repro I think the error you saw may be a different issue

cool-egg-852 · Answer

Reproducing it is not easy given the requirements I believe I can see if I can make something that reproduces it I have no problem opening a new issue though

cool-egg-852 · Answer

cool-egg-852 · Answer

I ll see what I can do about reproducing it tomorrow though The cause is definitely caused by changes in 0 25 3 though

cool-egg-852 · Answer

My guess is that the new dry run support doesn t consider mutating webhook controllers that don t support dry run

cool-egg-852 · Answer

I m guessing the cluster has the feature enabled and thus it s trying to use the new logic

cool-egg-852 · Answer

I m not entirely familiar with the feature but I think the error needs to be caught and then fallback to the old diffing logic

cool-egg-852 · Answer

I ve filed <https github com banzaicloud bank vaults issues 575> so they can add support for it in the future but obviously pulumi shouldn t fail because of this

gorgeous-egg-16927 · Answer

We re in the process of adding an opt in feature flag for the diff changes and will be defaulting back to the previous behavior ASAP

cool-egg-852 · Answer

Ok cool I won t upgrade the provider until the Looking forward to the fix though for the secrets and such that I started this thread for Hope to see the change soon Thanks for all the hard work

gorgeous-egg-16927 · Answer

<https github com pulumi pulumi kubernetes releases tag v0 25 4> was just released thanks for your patience

cool-egg-852 · Answer

thanks for the update You guys are awesome