Hello lovely Pulumi users, my org has been trialling Pulumi - we're using the Kubernetes operator with ArgoCD to spin up databases for an app to use as a backend. One of the things that gives us pause for how we'd roll this out to production is how to make sure we're catching any unintended delete/recreate operations. I can think of three broad ways to handle this: • Find a way to report the output of

pulumi preview

when making a pull request • Use the

protect

resource option? (link) • Have users merge in a change that uses the new operator preview functionality (link), then review the output of that, then make a second PR to remove the preview flag Running a CI job that generates a

preview

and posts the output in a comment on the PR seems like the cleanest and safest option to me, but I don't know a way to de-translate the stack definition from the custom resource kubernetes manifest format! Has anyone else looked at this kind of problem? If so, would love to know what you came up with.

Hey @kind-napkin-56243, Engin from Pulumi here. Great you are using the PKO. Have a look at our new function in version 2.3.0 to have a preview run going on: https://github.com/pulumi/pulumi-kubernetes-operator/releases/tag/v2.3.0 For me the best way to handle the changes if you want to go true GitOps. Using systems like Kargo could add to this, if you let the preview run, then when it did run successful you could use the promote steps of Kargo, to set preview to false in a dedicated “live” branch, that Argo CD checks on.

Hi @many-telephone-49025, thanks for your reply! Yes, that new preview functionality is what I linked in my third bullet point above, it's great to see that in place 🙂 We'd been thinking of setting up something like https://github.com/dag-andersen/argocd-diff-preview for "show the changes in a Github comment" but that isn't a good fit for Pulumi where it would only show the change to the stack custom resource, not the output of Pulumi preview (which is a very reasonable division of responsibility between Argo and Pulumi!). Haven't looked at Kargo, if that works more smoothly with custom resources maybe that's a better route to go towards as we mature our deployment tech.