This message was deleted.

I use conceptual names referring to the purpose of the resource. If I have an s3 bucket that is for shared files than I will call it

shared-files-bucket

. If that bucket is a child resource of a

ComponentResource

that I implemented than I prefix it with the name provided to that component resource. So then it would be

{name}-shared-files-bucket

. This would remain unique as long as the name of the component resource is unique, which is already a constraint. If you are creating servers, presumably each server has a purpose. Presumably each security group is created for a reason. Presumably each rule has a specific function. I don't think you should be "generating" names because you know what you are using the resource for at the time that you are writing the IaC

I know what the servers are for. I know what the security groups are for. But, say, you create 5 loadbalancers

lb-{1..5}

and 20 app servers

app-{1..20}

. You create security groups, to allow access to say port 80 on each of

app

servers. Then you create security rules, one per each IP of loadbalancer. And each of those rules needs to have a unique name.

I think maybe you need to consider making encapsulated grouping of resources via a component resource implementation so you can constrain the scope of your resources more easily, thus scoping the naming of your resource more easily

Do you have a link handy for a starting point for that?

Yeah, thank you 👍

do you have this functioning yet? do you have like a chicken-and-egg scenario where

api.region1

needs to know the IP address for

api.region2

but

api.region2

hasn't been deployed yet so you don't know the IP?

For the chicken and egg problem I always create the security groups beforehand so that they can reference each other.

that works of course unless he needs the actual IP addresses for config, in which case I was going to suggest using some kind of service discovery instead of inputting the IP addresses - and then order wouldn't matter at all. But that's why I asked

The issue is that

.apply

does manage to get the IPs out at execution time, so that part is working. But it requires unique names for each of the SecurityGroupRules, and for those you cannot use properties of defined objects (since using names was the obvious thing to try)

You know how many IPs you have in that collection though. So you can do this:

for (int i =0; i < 6; i++) // the number of IPs
{
    var ipAddress = ipAddresses.GetAt(i);
    var securityGroup = new SecurityGroup("{name}-sec-grp-{i}", {...});
    var securityGroupRule = new Rule("{name}-sec-grp-rule-{i}", {...});
}

now obviously it sucks that you can't do

ipAddresses.Length

in order to limit the loop to how many IP addresses you have programmatically, since

OutputList<T>.Length()

can't be used there - but when the number of IP addresses you have changes it is still better to have to simply change that number than to mess with large blocks of duplicate code.

I worked about it differently, though in a similar way: I set a variable

COUNTER=0

before I create everything, increment it after creating each resource, and use it in the names. But then when more machines appear, suddenly the numbers in names don't match, and pulumi is convinced it needs to change the IPs in the rules for stuff to match. And for example OpenStack really doesn't like you trying to create two exactly same rules as it adjusts things, throwing an error and thus erroring out pulumi run.

Interesting. Can you clarify what you mean by this: "But then when more machines appear, suddenly the numbers in names don't match, and pulumi is convinced it needs to change the IPs in the rules for stuff to match."

I mean when I create more machines. Because recently I only had

api

and

clientA

, but now turned out I also need

clientB

in each region.

ah so you added a new machine, and more IP addresses were needed, and since ordering wasn't preserved and those IP addresses weren't appended to the end of the collection - now the numbers don't match the IPs that they used to be, and pulumi is thinking it needs to update those other resources?

Yeah

what if before doing your loop you did

var sortedIpAddresses = ipAddresses.Apply(x => x.Sort());

that way ordering was preserved?

Let me see how much work it would be to sanitize the project so I can share it

It might be that in this case you need to allow those rules to be recreated/updated. I mean presumably it's not like you are adding a new machine on every up call right, this is you going in and modifying the pulumi stack. So it may just be the cost of having pulumi manage this infrastructure. Is there other resources outside of the stack that also depend on those resources? Like referencing them directly?

hmmm does the pulumi resource option to

DeleteBeforeReplace

help with that?

It helped with some, but not with all cases of that

probably when there is the mismatch it is still an issue

That's more than I had ;) I'll try to look at the component resources, though I'm not sure I'll have a chance to work much more with this particular project