https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# general
s
This message was deleted.
w
Is it expected to need to run 
helm repo update
?
After doing that manually the update nearly succeeded:
Copy code
pulumi:pulumi:Stack (k8s-infra-dev):
    error: update failed
 
  kubernetes:policy:PodSecurityPolicy (monitoring/po-grafana):
    error: Plan apply failed: resource monitoring/po-grafana was not successfully created by the Kubernetes API server : podsecuritypolicies.policy "po-grafana" already exists
Ran again and preview looks like the following:
Copy code
Type                                           Name                   Plan
     pulumi:pulumi:Stack                            k8s-infra-dev
     └─ kubernetes:helm.sh:Chart                    po
 +      ├─ kubernetes:policy:PodSecurityPolicy      monitoring/po-grafana  create
 -      └─ kubernetes:extensions:PodSecurityPolicy  monitoring/po-grafana  delete
Is this a case of the resource api versions changing and not being picked up by Pulumi?
g
Yeah, Pulumi just interacts with helm on your system, so you have to run 
helm repo update
to pull in new chart info.
We aren’t currently auto-aliasing PSPs, so that would explain the error you’re seeing
https://github.com/pulumi/pulumi-kubernetes/issues/828 is tracking getting those added for all resources types
w
Thanks. Is there a workaround to specify the alias myself?
So for CI/CD, we should always run 
helm repo update
outside of Pulumi?
g
You could specify the alias with a transformation along the lines of https://github.com/pulumi/pulumi-kubernetes/blob/049ce63bcafb65b12a2b89621ac6a399118844db/sdk/nodejs/helm/v2/helm.ts#L43-L60 I think
Copy code
transformations: [
    (obj: any, opts: pulumi.CustomResourceOptions) => {
        if (obj.kind === "PodSecurityPolicy") {
            opts.aliases = [
                { parent: opts.parent, type: "kubernetes:policy/v1beta1:PodSecurityPolicy"},
                { parent: opts.parent, type: "kubernetes:extensions/v1beta1:PodSecurityPolicy"},
            ];
        }
    },
],
would work
I’d run 
helm repo update
after it gets installed in your CI pipeline
w
The transform worked great, thanks again.
👍 1
Open in Slack
PreviousNext
Powered by