pulumi-kubernetes

Changed

• Updated Kubernetes schemas and libraries to v1.32.0. (https://github.com/pulumi/pulumi-kubernetes/pull/3343)

Changed

• [nodejs] Resolves punycode deprecation warnings by using native fetch instead of node-fetch. (https://github.com/pulumi/pulumi-kubernetes/issues/3301)

Fixed

• pulumi.com/waitFor and other await annotations now correctly take precedence over default await logic. (https://github.com/pulumi/pulumi-kubernetes/issues/3329)

• JSONPath expressions used with the pulumi.com/waitFor annotation will no longer hang indefinitely if they match non-primitive fields. (https://github.com/pulumi/pulumi-kubernetes/issues/3345)

• [java] CRDs that contain any x-kubernetes-* fields can now be succesfully created and managed by Pulumi. (https://github.com/pulumi/pulumi-kubernetes/issues/3325)

Fixed

• Objects created on clusters older than 1.18 will no longer see a before-first-apply conflict when Pulumi performs a server-side apply for the first time. (https://github.com/pulumi/pulumi-kubernetes/pull/3275)

• The provider's user agent is now set correctly when communicating with the Kubernetes API server. (https://github.com/pulumi/pulumi-kubernetes/issues/3267)

Fixed

• The provider's Pulumi dependency was updated to version v3.136.1 to address potential "pulumi.runtime.invokeOutput is not a function" errors. (https://github.com/pulumi/pulumi/issues/17518)

Added

• Schemagen is now a library that can be consumed by other packages. (https://github.com/pulumi/pulumi-kubernetes/pull/3187)

Changed

• Updated beta Kubernetes client libraries to stable v1.31 release. (https://github.com/pulumi/pulumi-kubernetes/pull/3196)

[!IMPORTANT] The enableSecretMutable and enableConfigMapMutable options may become the default behavior in a future v5 release of the provider.

Programs that depend on the replacement of Secrets and ConfigMaps (e.g. to trigger updates for downstream dependencies like Deployments) are recommended to explicitly specify immutable: true.

Added

• The new enableSecretMutable provider configuration option treats changes to Secrets as updates instead of replacements (similar to the enableConfigMapMutable option).

  The default replacement behavior can be preserved for a particular Secret by setting its immutable field to true. (https://github.com/pulumi/pulumi-kubernetes/issues/2291)

• A warning is now emitted if an object has finalizers which might be blocking deletion. (https://github.com/pulumi/pulumi-kubernetes/issues/1418)

• EXPERIMENTAL: Generic await logic is now available as an opt-in feature. Running a program with PULUMI_K8S_AWAIT_ALL=true will now cause Pulumi to await readiness for all resources, including custom resources.

  Generic readiness is determined according to some well-known conventions (like the "Ready" condition) as determined by cli-utils.

  Pulumi's current behavior, without this feature enabled, is to assume some resources are immediately available, which can cause downstream resources to fail.

  Existing readiness logic is unaffected by this setting. (https://github.com/pulumi/pulumi-kubernetes/issues/2996)

• EXPERIMENTAL: The pulumi.com/waitFor annotation was introduced to allow for custom readiness checks. This override Pulumi's own await logic for the resource (however the pulumi.com/skipAwait annotation still takes precedence).

  The value of this annotation can take 3 forms:

  1. A string prefixed with jsonpath= followed by a JSONPath expression and an optional value.

     The JSONPath expression accepts the same syntax as kubectl get -o jsonpath={...}.

     If a value is provided, the resource is considered ready when the JSONPath expression evaluates to the same value. For example this resource expects its "phase" field to have a value of "Running":

     `pulumi.com/waitFor: "jsonpath={.status.phase}=Running"`
     

     If a value is not provided, the resource will be considered ready when any value exists at the given path, similar to kubectl wait --for jsonpath=.... This resource will wait until it has a webhook configured with a CA bundle:

     `pulumi.com/waitFor: "jsonpath={.webhooks[*].clientConfig.caBundle}"`
     

  2. A string prefixed with condition= followed by the type of the condition and an optional status. This matches the behavior of kubectl wait --for=condition=... and will wait until the resource has a matching condition. The expected status defaults to "True" if not specified.

     `pulumi.com/waitFor: "condition=Synced"`
     
     `pulumi.com/waitFor: "condition=Reconciling=False"`
     

  3. A string containing a JSON array of multiple jsonpath= and condition= expressions.

     `pulumi.com/waitFor: '["jsonpath={.foo}", "condition=Bar"]'`
     

• Pulumi will now emit logs for any Kubernetes "Warning" Events associated with resources being created, updated or deleted. (https://github.com/pulumi/pulumi-kubernetes/pull/3135/files)

Fixed

• The immutable field is now respected for ConfigMaps when the provider is configured with enableConfigMapMutable. (https://github.com/pulumi/pulumi-kubernetes/issues/3181)

• Fixed a panic that could occur during deletion. (https://github.com/pulumi/pulumi-kubernetes/issues/3157)