Hey all is there a Pulumi module available somewhere for set

Question

Hey all is there a Pulumi module available somewhere for setting up all the required GCS resources to host your own state

billowy-army-68599 · Answer

all you need for Pulumi state is a GCS storage bucket locking is handled by the consistency of the storage object

billowy-army-68599 · Answer

there s a bit of a chicken and egg problem doing it with Pulumi because you need state to create that bucket too smile

ripe-knife-11053 · Answer

Pivoting between state stores is fine

ripe-knife-11053 · Answer

Also I would expect said module to include a GCP KMS setup for encrypting the secrets

billowy-army-68599 · Answer

secrets aren t in plaintext in Pulumi so you don t need to encrypt the state store

ripe-knife-11053 · Answer

ripe-knife-11053 · Answer

Some kind of encryption provider is required for self managed state

billowy-army-68599 · Answer

they re encrypted at runtime by the engine you pass your key to your pulumi config <https www pulumi com blog peace of mind with cloud secret providers >

billowy-army-68599 · Answer

so if you actually look at the state on the bucket there s no values in plaintext

ripe-knife-11053 · Answer

Right but that key needs to come from somewhere A passphrase OK or a GCP KMS key better

ripe-knife-11053 · Answer

Hence why I m looking for a module that just does all of this similar to the ones that are available for Terraform

billowy-army-68599 · Answer

we don t have a module for this just yet but I can throw an example together

ripe-knife-11053 · Answer

If it ll only take you a few minutes that would be appreciated

billowy-army-68599 · Answer

which language SDK are you using

billowy-army-68599 · Answer

here it is in typescript ```const keyring = new gcp kms KeyRing stateEncryption location global const encryptionKey = new gcp kms CryptoKey stateEncryption keyRing keyring id rotationPeriod 1000000s protect true you may want to turn this on parent keyring const bucket = new gcp storage Bucket state versioning enabled true ``` You ll need to add IAM permissions too

ripe-knife-11053 · Answer

Python