cool-dress-96114
03/07/2023, 5:31 PMup
and refresh
states on resources that have additional configuration as separate resources, and was wondering if anyone had any advice.
Pulumi code snippet:
secGroup, err := ec2.NewSecurityGroup(ctx, "secgroup", &ec2.SecurityGroupArgs{
NamePrefix: namePrefix,
Ingress: &ec2.SecurityGroupIngressArray{
&ec2.SecurityGroupIngressArgs{
CidrBlocks: pulumi.StringArray{pulumi.String("10.0.0.0/8")},
Description: pulumi.String("description"),
FromPort: <http://pulumi.Int|pulumi.Int>(0),
Protocol: pulumi.String("-1"),
ToPort: <http://pulumi.Int|pulumi.Int>(0),
},
},
VpcId: vpcId,
}, []pulumi.ResourceOption{awsPulumiProvider}...)
if err != nil {
return err
}
_, err = ec2.NewSecurityGroupRule(ctx, "rule", &ec2.SecurityGroupRuleArgs{
CidrBlocks: pulumi.StringArray{pulumi.String("11.0.0.0/8")},
Description: pulumi.String("description"),
FromPort: <http://pulumi.Int|pulumi.Int>(0),
Protocol: pulumi.String("-1"),
SecurityGroupId: secGroup.ID(),
ToPort: <http://pulumi.Int|pulumi.Int>(0),
Type: pulumi.String("ingress"),
}, awsPulumiProvider)
if err != nil {
return err
}
So what we’ve done is create a security group with an ingress rule defined inline, and then later on add another ingress rule.
• When running refresh
the security group resource notices it has an extra rule, and updates.
• Then after running up
, the security group resource diffs the state with the expected state, and notices it needs to delete the rule (from the inline state, not the separate rule).
• Then after running refresh
again, the security group rule is deleted because it doesn’t exist.
• Then after running up
again, the separate security group rule is recreated, and we do it all over again.
This happens with a lot of different types of resources, anything where we’re defining additional configuration out of line (another example being defining an AWS VPC Route Table, and adding a routing rule later), and basically means that we cannot use `refresh`… ever, which obviously is not desirable.salmon-account-74572
03/07/2023, 5:53 PMcool-dress-96114
03/07/2023, 5:56 PMsalmon-account-74572
03/07/2023, 6:03 PMcool-dress-96114
03/07/2023, 6:07 PMsalmon-account-74572
03/07/2023, 6:24 PM