Hi, i'm using pulumi to deploy k8s yaml file, when rerun pulumi, it will report the errors blow, is it normal or how to escape it?

kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-webhook:subjectaccessreviews):
    error: resource cert-manager-webhook:subjectaccessreviews was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-webhook:subjectaccessreviews" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:RoleBinding|rbac.authorization.k8s.io/v1:RoleBinding> (cert-manager/cert-manager-webhook:dynamic-serving):
    error: resource cert-manager/cert-manager-webhook:dynamic-serving was not successfully created by the Kubernetes API server : <http://rolebindings.rbac.authorization.k8s.io|rolebindings.rbac.authorization.k8s.io> "cert-manager-webhook:dynamic-serving" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-view):
    error: resource cert-manager-view was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-view" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-controller-ingress-shim):
    error: resource cert-manager-controller-ingress-shim was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-controller-ingress-shim" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-controller-orders):
    error: resource cert-manager-controller-orders was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-controller-orders" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-issuers):
    error: resource cert-manager-controller-issuers was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-issuers" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:RoleBinding|rbac.authorization.k8s.io/v1:RoleBinding> (kube-system/cert-manager:leaderelection):
    error: resource kube-system/cert-manager:leaderelection was not successfully created by the Kubernetes API server : <http://rolebindings.rbac.authorization.k8s.io|rolebindings.rbac.authorization.k8s.io> "cert-manager:leaderelection" already exists

  kubernetes:apps/v1:Deployment (cert-manager/cert-manager):
    error: resource cert-manager/cert-manager was not successfully created by the Kubernetes API server : deployments.apps "cert-manager" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-clusterissuers):
    error: resource cert-manager-controller-clusterissuers was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-clusterissuers" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-challenges):
    error: resource cert-manager-controller-challenges was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-challenges" already exists

  kubernetes:<http://apiextensions.k8s.io/v1:CustomResourceDefinition|apiextensions.k8s.io/v1:CustomResourceDefinition> (<http://clusterissuers.cert-manager.io|clusterissuers.cert-manager.io>):
    error: resource <http://clusterissuers.cert-manager.io|clusterissuers.cert-manager.io> was not successfully created by the Kubernetes API server : <http://customresourcedefinitions.apiextensions.k8s.io|customresourcedefinitions.apiextensions.k8s.io> "<http://clusterissuers.cert-manager.io|clusterissuers.cert-manager.io>" already exists

  kubernetes:<http://apiextensions.k8s.io/v1:CustomResourceDefinition|apiextensions.k8s.io/v1:CustomResourceDefinition> (<http://certificaterequests.cert-manager.io|certificaterequests.cert-manager.io>):
    error: resource <http://certificaterequests.cert-manager.io|certificaterequests.cert-manager.io> was not successfully created by the Kubernetes API server : <http://customresourcedefinitions.apiextensions.k8s.io|customresourcedefinitions.apiextensions.k8s.io> "<http://certificaterequests.cert-manager.io|certificaterequests.cert-manager.io>" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-certificatesigningrequests):
    error: resource cert-manager-controller-certificatesigningrequests was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-certificatesigningrequests" already exists

  kubernetes:<http://admissionregistration.k8s.io/v1:MutatingWebhookConfiguration|admissionregistration.k8s.io/v1:MutatingWebhookConfiguration> (cert-manager-webhook):
    error: resource cert-manager-webhook was not successfully created by the Kubernetes API server : <http://mutatingwebhookconfigurations.admissionregistration.k8s.io|mutatingwebhookconfigurations.admissionregistration.k8s.io> "cert-manager-webhook" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-controller-certificates):
    error: resource cert-manager-controller-certificates was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-controller-certificates" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-controller-challenges):
    error: resource cert-manager-controller-challenges was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-controller-challenges" already exists

  kubernetes:<http://apiextensions.k8s.io/v1:CustomResourceDefinition|apiextensions.k8s.io/v1:CustomResourceDefinition> (<http://orders.acme.cert-manager.io|orders.acme.cert-manager.io>):
    error: resource <http://orders.acme.cert-manager.io|orders.acme.cert-manager.io> was not successfully created by the Kubernetes API server : <http://customresourcedefinitions.apiextensions.k8s.io|customresourcedefinitions.apiextensions.k8s.io> "<http://orders.acme.cert-manager.io|orders.acme.cert-manager.io>" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRole|rbac.authorization.k8s.io/v1:ClusterRole> (cert-manager-edit):
    error: resource cert-manager-edit was not successfully created by the Kubernetes API server : <http://clusterroles.rbac.authorization.k8s.io|clusterroles.rbac.authorization.k8s.io> "cert-manager-edit" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-certificates):
    error: resource cert-manager-controller-certificates was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-certificates" already exists

  kubernetes:apps/v1:Deployment (cert-manager/cert-manager-webhook):
    error: resource cert-manager/cert-manager-webhook was not successfully created by the Kubernetes API server : deployments.apps "cert-manager-webhook" already exists

  kubernetes:<http://rbac.authorization.k8s.io/v1:ClusterRoleBinding|rbac.authorization.k8s.io/v1:ClusterRoleBinding> (cert-manager-controller-orders):
    error: resource cert-manager-controller-orders was not successfully created by the Kubernetes API server : <http://clusterrolebindings.rbac.authorization.k8s.io|clusterrolebindings.rbac.authorization.k8s.io> "cert-manager-controller-orders" already exists

Hi @helpful-account-44059 this isn't pulumi causing this issue. You're trying to recreate cluster roles that already exist, you need to transform the yaml to remove these if they already exist

thank you, is there a example that how to doing the transform?

it sohuld be very similar to this https://www.pulumi.com/registry/packages/kubernetes/api-docs/helm/v3/chart/#chart-with-transformations