purple-plumber-90981
11/17/2021, 11:54 PMbillowy-army-68599
11/17/2021, 11:56 PMpurple-plumber-90981
11/18/2021, 12:09 AMbillowy-army-68599
11/18/2021, 12:10 AMpurple-plumber-90981
11/18/2021, 12:11 AMbillowy-army-68599
11/18/2021, 12:12 AMpurple-plumber-90981
11/18/2021, 12:12 AMbillowy-army-68599
11/18/2021, 12:14 AMpurple-plumber-90981
11/18/2021, 12:15 AMbillowy-army-68599
11/18/2021, 12:16 AMpurple-plumber-90981
11/18/2021, 12:17 AMbillowy-army-68599
11/18/2021, 12:22 AM.get
function lookup will be an output. That's just how Pulumi works, it turns any remote value into an output.
It does this because the amount of time it make take to retrieve that value is anywhere between 1ms to <amount of time it takes to provision an EKS cluster>
So while the value exists in your stack file somewhere, it could take 1ms or it could take 5 hours to retrieve.
Pulumi uses apply
to deal with that wait time. You can't "convert" an output into a string, what you can do is wait for the output value to resolve, or be known, and then deal with that result. Using an apply is like saying "once this value has been returned" (whether that's an EKS arn or a stack reference) do something with the result. Anything inside the apply happens once the output has been resolved.
I wrote a blog post about this earlier in the year which lots of folks have told me helps their understanding:
https://www.leebriggs.co.uk/blog/2021/05/09/pulumi-apply.htmlpurple-plumber-90981
11/18/2021, 12:23 AMbillowy-army-68599
11/18/2021, 12:24 AMpurple-plumber-90981
11/18/2021, 12:29 AMekscreate_stackref = pulumi.StackReference(f"{pulumi_stack_info['name']}-create")
longhorn_backup_role = aws.iam.Role(
f'longhorn-{pulumi_stack_info["region"]}-backup-role',
description = 'IAM role to allow longhorn to backup to s3 regional bucket',
force_detach_policies = True,
assume_role_policy=pulumi.Output.all(ekscreate_stackref.get_output('oidc_provider_arn'), ekscreate_stackref.get_output('oidc_provider_url')).apply(
lambda args: json.dumps(
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": args[0],
},
-create
stackbillowy-army-68599
11/18/2021, 12:48 AMekscreate_stackref = pulumi.StackReference(f"{pulumi_stack_info['name']}-create")
ekscreate_stackref.get_output('oidc_provider_url'))
ekscreate_stackref.apply(
// create your role inside the apply
)
steep-sunset-89396
11/18/2021, 12:56 AMpurple-plumber-90981
11/18/2021, 1:07 AMDiagnostics:
pulumi:providers:aws (eu-west-1):
error: could not read plugin [/home/bmeehan/.pulumi/plugins/resource-aws-v4.28.0/pulumi-resource-aws] stdout: EOF
pulumi:pulumi:Stack (itplat-ipd-eks-use1-configure):
fatal error: runtime: out of memory
runtime stack:
runtime.throw(0x9606908, 0x16)
steep-sunset-89396
11/18/2021, 1:08 AMpurple-plumber-90981
11/18/2021, 1:08 AMsteep-sunset-89396
11/18/2021, 1:13 AMpurple-plumber-90981
11/18/2021, 1:19 AMDiagnostics:
aws:iam:Role (longhorn-us-east-1-backup-role):
error: 1 error occurred:
* 1 error occurred:
* creating inline policy (s3_policy): MalformedPolicyDocument: Actions/Condition can contain only one colon.
status code: 400, request id: 4eb8b37f-587a-4b92-a4b8-e8ee0b2fc29a
"Condition": {
"StringLike": {f"{args[1]}:aud".replace('https://', ''): "<http://sts.amazonaws.com|sts.amazonaws.com>"},
},
<snip>\"Condition\": {\"StringLike\": {\"<http://oidc.eks.us-east-1.amazonaws.com/id/<the_id_redacted>:aud\|oidc.eks.us-east-1.amazonaws.com/id/<the_id_redacted>:aud\>": \"<http://sts.amazonaws.com|sts.amazonaws.com>\"}}}]}"
steep-sunset-89396
11/18/2021, 1:33 AM"Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:DeleteObject" "s3:ListMultipartUploadParts"]
vs
"Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:DeleteObject", "s3:ListMultipartUploadParts"]
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "GrantLonghornBackupstoreAccess0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:DeleteObjects3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::aureq-us-east-1/*",
"arn:aws:s3:::aureq-us-east-1"
]
}
]
}
And AWS didn't like it.little-cartoon-10569
11/18/2021, 8:56 PM