search

pulumi / pulumi-yaml

YAML language provider for Pulumi
Apache License 2.0
38 stars 11 forks source link

YAML doesn't apply aliases from schema - leading to otherwise safe updates being destructive in YAML #532

Closed lukehoban closed 7 months ago

lukehoban commented 7 months ago

Between GCP 6. and 7. we changed the Service Account resource from gcp:serviceAccount:Account to gcp:serviceaccount:Account as discussed in the migration guide.

This works in all other languages, because we codegen an alias between the two, so that there is no visible disruption for users. E.g. https://github.com/pulumi/pulumi-gcp/blob/d02602d583402290228ab266fe00bfaa37c9864b/sdk/nodejs/serviceaccount/account.ts#L162.

In YAML we don't have any codegenerated SDK. But we do read the schema, and I would have expected we would similarly read and apply aliases from the schema.

However, it appears we do not. Deploying this program:

name: xyzcp7
runtime: yaml
resources:
  provider:
    type: pulumi:providers:gcp
    defaultProvider: true
    options:
      version: 6.67.1
      # version: 7.2.2
  account:
    type: gcp:serviceAccount:Account
    # type: gcp:serviceaccount:Account
    properties: 
      accountId: something-totally-weird-1234
      project: pulumi-development
outputs:
  accountname: ${account.name}

Then swap the two sets of commented lines - to update the version and switch to the new type name. And run preview again.

The result is the following:

Previewing update (dev2)

View in Browser (Ctrl+O): https://app.pulumi.com/luke-pulumi-corp/centegenixgcp7/dev2/previews/419c149f-2d75-43b4-9633-a51531fef8d8

     Type                           Name                 Plan       Info
     pulumi:pulumi:Stack            xyzgcp7-dev2             
 ~   ├─ pulumi:providers:gcp        provider             update     [diff: ~version]
 +   ├─ gcp:serviceaccount:Account  account              create     
 -   └─ gcp:serviceAccount:Account  account              delete     

Resources:
    + 1 to create
    ~ 1 to update
    - 1 to delete
    3 changes. 1 unchanged

Note that there is a "create" and a "delete" there, which there should not be since the resources identity should have stayed the same due to the alias.

lukehoban commented 7 months ago

Note that this can be worked around by users by adding an options block that defines the aliases in the user code:

  account:
    type: gcp:serviceAccount:Account
    # type: gcp:serviceaccount:Account
    properties: 
      accountId: something-totally-weird-1234
      project: pulumi-development
    options:
      aliases:
        - urn:pulumi:dev2::centegenixgcp7::gcp:serviceAccount/account:Account::account

Note that this needs to hard code the URNs of the resources, which is slightly cumbersome. Once https://github.com/pulumi/pulumi-yaml/issues/156 is addressed, it will be possible to more simply alias the type name alone, without having to repeat all other parts of the URN.