[esc] add at scale doc #13465
[esc] add at scale doc #13465
Conversation
dschaller
force-pushed
the
esc/atscale
branch
from
d72eaba to
0b05ea3
Compare
|
Your site preview for commit d72eaba is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-13465-d72eaba7.s3-website.us-west-2.amazonaws.com. |
|
Your site preview for commit 0b05ea3 is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-13465-0b05ea34.s3-website.us-west-2.amazonaws.com. |
| return fmt.Errorf("failed to open environment: %v", err) | ||
| } | ||
|
|
||
| awsProvider, err := getAwsProviderFromEnv(ctx, values) |
There was a problem hiding this comment.
I think this example can be simplified because the default aws provider will pick up these env vars automatically if the environment is imported by the stack config.
I think using the ESC SDK within a stack makes the example appear more complicated, and we might be better served having a different non-stack example of using the SDK instead.
There was a problem hiding this comment.
👍 yeah I did have the thought this is a somewhat exaggerated example meant to show using JIT secrets in a practical application.
I ended up sticking with it because while the provider will use the environment variables by default you have to set those which when performing updates locally means you have to open the environment as an explicit step. With this you don't have to do any of that. Just as long as your PAT is set correctly.
There was a problem hiding this comment.
is an explicit open really required? just having the environment in the config seems to work for me 😕
environment:
- dev-sandbox
import * as aws from "@pulumi/aws";
const bucket = new aws.s3.BucketV2("my-bucket");
export const bucketName = bucket.id;
Co-authored-by: Claire <[email protected]>
|
Your site preview for commit 4514bf6 is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-13465-4514bf66.s3-website.us-west-2.amazonaws.com. |
|
Hey @dschaller Are you ready for a docs team review on this or still working on it? |
|
Hey @interurban let me convert this to a draft based on some convo I had async with @nyobe |
Proposed changes
add doc on using ESC at scale, breaking down the steps based on user role, and providing examples of RBAC team access, JIT access of secrets/configuration, revision tags, providers, etc.