I tried to create a Pulumi resource inside a context manager

Question

I tried to create a Pulumi resource inside a context manager `with` block and it doesn t seem to be respecting the context Details to follow

clean-engineer-75963 · Answer

I mentioned in an earlier message that I needed to create a Kubernetes Deployment then port forward into one of its Pods to configure the software

clean-engineer-75963 · Answer

That software is Hashicorp Vault so I thought I could use the pulumi vault provider to get that work done

clean-engineer-75963 · Answer

I got clever and wrote a context manager which starts the port forward to the Vault pod and terminates it when the context closes

clean-engineer-75963 · Answer

And put all of the pulumi vault resources inside the `with` block

clean-engineer-75963 · Answer

And that doesn t seem to be working at all

clean-engineer-75963 · Answer

The code looks like this ```vault provider = pulumi vault Provider vault provider address= lt https 127 0 0 1 8200 gt skip tls verify=True token=corev1 Secret get vault init results pulumi Output concat base namespace metadata name vault init results data root token with PortForward get ready vault pod 8200 vault token = pulumi vault Token vault token display name= my token policies= my policy renewable=True ttl=20 60 opts =pulumi ResourceOptions provider=vault provider ```

clean-engineer-75963 · Answer

The context manager definitely works I ve tested it separately

clean-engineer-75963 · Answer

This is its code ```class PortForward Context manager which starts a port forward for the duration of the context The Python Kubernetes client library does not yet support port forwards so this calls kubectl for now def init self pod port local port=None self pod = pod self remote port = port if local port is not None self local port = local port else self local port = port self address = f 127 0 0 1 self local port def enter self = pexpect spawn kubectl port forward self pod f self local port self remote port self pf expect exact f Forwarding from self address f gt self remote port r n self pf expect exact f Forwarding from 1 self local port f gt self remote port r n return self def exit self exc type exc val exc tb self pf terminate force=True return False```

clean-engineer-75963 · Answer

The error I get from `pulumi up` is this ```Diagnostics vault index Token vault token error Get <https 127 0 0 1 8200 v1 auth token lookup self> dial tcp 127 0 0 1 8200 connect connection refused``` Suggesting that the port forward is not active while the resource is being created

clean-engineer-75963 · Answer

I also tested the PortForward with the hard coded name of the Pod to forward to to cut out that `get ready vault pod ` function which normally goes and finds the right Vault pod to connect to

white-balloon-205 · Answer

Yes the resource creation is done in a separate process and at a different point in time than the `Token` constructor is called The latter causes the resource to be registered as part of the desired state but the decision about whether to create or update a resource as a result and then the act of doing that is asynchronous wrt the resource being registered the call the `Token` returning I think what you really want here is either dynamic providers a custom provider implemented inside your Pulumi program that can participate in the resource graph or lifecycle hooks not yet available but tracked in