What is the correct way to get nested config value? I set the value like this:

pulumi config set-all --path \
  --secret passwords.pw1=Secret

How do I call this in the code? I cannot see to wrap my head around strange paths in the yaml file

cfg = pulumi.Config()
# Neither of these worked:
cfg.require_secret('passwords.pw1')
cfg.require_secret('["passwords"].["pw1"]') # does not work

passwordConfig = pulumi.Config("passwords")

passwordConfig.require_secret("pw1")

I think is what you need (untested)

thanks I will try that

okay give me a few minutes

I wish Config could just deserialize into an Object it I'm trying to workout how can I use this with Pydantinc object or at least a data class as my config object

@great-sunset-355 it can be grabbed as an object:

config = pulumi.Config()
passwords = config.require_object("passwords")
pw = passwords.get("pw1")

<http://pulumi.log.info|pulumi.log.info>(pw)

yeah that's what I'm working with

the snippet above works for me

yeah I'm trying to deserialize it into an object (dataclass or pydantic settings) so I do not have to refer to the sections as strings

yes that's expected behaviour

I think that the problem is that in python Output looks like a dictionary so I'd naturally expect to behave that way This snippet works

from dataclasses import dataclass
import pulumi 

@dataclass
class MyConfig:
    pw1: Any 

    config = pulumi.Config()
    passwords = config.require_secret_object("passwords")
    mycfg = MyConfig(passwords['pw1'])
    print(mycfg)

However this does not:

from dataclasses import dataclass
import pulumi 

@dataclass
class MyConfig:
    pw1: Any 

    config = pulumi.Config()
    passwords = config.require_secret_object("passwords")
    mycfg = MyConfig(**passwords)
    print(mycfg)

with error

TypeError: attribute of type 'Output' is not callable
    error: an unhandled error occurred: Program exited with non-zero exit code: 1

I wonder if there is a way to get the

keys

from the Output without knowing them

No, that’s not possible because output is asynchronous. Have a read of this: https://www.leebriggs.co.uk/blog/2021/05/09/pulumi-apply.html Essentially you’ll have to use an apply

I see then using apply will expose the secrets in the sate anyway

you need to do it inside an

apply

because it's an output

config:
  NS:obj:
    ALLOWED_HOSTS:
    - <http://URL1.com|URL1.com>
    - <http://URL2.com|URL2.com>

I'm trying to construct call

','.join(ALLOWED_HOSTS)

as an string input for another resource And since my ALLOWED_HOSTS is part of a secret object it is not possible even with apply I keep getting `Output`s never the value

any secret is an output, that's how secrets work because it needs to decrypt the value, so it's async. if you're working with outputs it MUST be inside an apply if you want to use it with another string

how can I get a list back not string?

from config?

yeah

this returns the correct types:

config = pulumi.Config()
foo = config.require_object("foo")

allowed_hosts = foo.get("allowed_hosts")

print(type(allowed_hosts))
<http://pulumi.log.info|pulumi.log.info>(allowed_hosts[0])
<http://pulumi.log.info|pulumi.log.info>(allowed_hosts[1])

If you want it as a secret object:

config = pulumi.Config()
foo = config.require_object("foo")
secret_foo = config.require_secret_object("foo")

allowed_hosts = foo.get("allowed_hosts")
secret_allowed_hosts = foo.get("allowed_hosts")

print(type(allowed_hosts))
<http://pulumi.log.info|pulumi.log.info>(allowed_hosts[0])
<http://pulumi.log.info|pulumi.log.info>(allowed_hosts[1])

<http://pulumi.log.info|pulumi.log.info>(secret_allowed_hosts[2])

secret_foo.apply(lambda host: print(host))

this line is wrong I believe

secret_allowed_hosts = foo.get("allowed_hosts")

ah yes, fixing

I wonder if using async and await would fix it

why use async/await when you can use apply? it does the same thing

I find apply way too complicated

i'm sorry to hear you're finding it too complicated, unfortunately you're going to come across it quite a lot 🙂

am I expected to get an error when running your code?

You’ll need to populate the config the same as I did obviously

I did this:

pulumi config set-all --path \
    --plaintext foo.allowed_hosts[0]=host1 \
    --plaintext foo.allowed_hosts[1]=host2

Away from keyboard at the moment be back soon

can I make something wait for output though?

yes, using

apply

If I need to wait for a Cloudformation stack to finish do I just write a function that waits until it's done and then unblocks the rest of the code?

yep, you'd wait for an output, see this as an example: https://github.com/jaxxstorm/pulumi-examples/blob/main/python/aws/wait-for-loadbalancer/__main__.py

I tried that and still got an exception + the example did not use the function

wait_for_loadbalancer

it does not wait for the function