https://pulumi.com logo
Join Slack
Powered by
Hi, I’m running Pulumi in a GitLab CI/CD pipeline ...
# getting-started
t
Hi, I’m running Pulumi in a GitLab CI/CD pipeline using S3 as the backend and AWS KMS as the secrets provider. During the first pipeline execution, the following command runs successfully and creates the stack and its metadata (
Pulumi.<stack>.yaml
):
Copy code
pulumi stack init "$STACK_NAME" --secrets-provider="<awskms://alias/pulumi?region=$AWS_REGION>"
On subsequent pipeline runs, since the stack already exists, I skip the 
init
step and simply run:
Copy code
pulumi stack select "$STACK_NAME"
pulumi config set ...
However, the second run fails with:
Copy code
error: passphrase must be set with PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables
It seems that because the CI runner is ephemeral and does not retain the 
Pulumi.<stack>.yaml
file from the previous run, Pulumi cannot detect the KMS secrets provider and defaults to the passphrase-based mode. Has anyone encountered this issue and can give me guidance please ?
e
Yeh stack yaml files aren't designed to be ephemeral
If you don't use secrets in config you can kinda get away with not keeping them around because there's a second copy of the secret manager info in state for decrypting anything in there. But we don't re-fetch state for setting config, so you need a new secret manager setup for that.
m
You'll have to run a config refresh in the subsequent pipeline runs to fetch the currently deployed configuration. This will create the 
Pulumi.<stack>.yaml
file, including the reference to your secrets provider:
Copy code
pulumi select $MY_STACK
pulumi config refresh
➕ 1
👀 1
t
Hi @modern-zebra-45309 @echoing-dinner-19531 so based on above suggestion I am trying to: 1. Login to s3 backend
Copy code
pulumi login "$PULUMI_BACKEND_URL"
2. checking if stack exits, if doesn't
Copy code
pulumi stack init "$STACK_NAME" \
         --secrets-provider="<awskms://alias/pulumi?region=$AWS_REGION>"
3. if exits,
Copy code
pulumi stack select "$STACK_NAME"
pulumi config refresh --non-interactive
✅ 1
👍 1
Even then I get the error [pipeline logs below]
🔐 Logging in to Pulumi backend... Logged in to runner-a8sxq5jkx-project-70914294-concurrent-0-55xjfs2n as root (s3://ubik-fragment-wizard-example-pulumi-state-management) 🔎 Checking if Pulumi stack 'newrelic-sandbox-infrastructure' exists... ✅ Stack 'newrelic-sandbox-infrastructure' already exists. ♻️ Attempting to refresh configuration from backend... error: getting latest configuration: no previous deployment ℹ️ Config refresh skipped (stack may not have been deployed yet). ✅ New Relic user key retrieved from Secrets Manager 🔧 Setting Pulumi configuration values... 🔹 Configuring New Relic credentials... error: passphrase must be set with PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables
m
A config refresh only works when you have previously deployed the stack
I think you can just deploy an empty stack that contains nothing but the stack resource itself.
But in order for the config refresh to work, you need a state file for the stack in your backend.
e
yeh if you've never deployed anything and don't have any existing config you could just run 
pulumi stack change-secrets-provider
to reset the secret provider
t
Make sense in that case I can add a condition where if stack doesn't exist (1st deployment) then 
init and no config refresh
and for when it exists then 
config refresh
👍 1
65 Views
Open in Slack
PreviousNext
Powered by