pulumi 堆栈的锁定
我是普鲁米的新手。是否有任何选项可以锁定 Pulumi 中的特定堆栈以防止意外更新或删除？我知道强制 RBAC 只向具有所需权限的成员提供此功能。但是，即使具有所有必要权限的人员尝试执行此操作，我仍然希望防止对堆栈进行意外更改。
I am new to Pulumi. Is there any option to lock a particular stack in Pulumi to prevent accidental updates or deletion? I understand that RBAC is enforced to provide this functionality to only members with required permissions.However, I still want to prevent accidental changes to the stack even when the persons with all necessary permissions attempt to do it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您是正确的，因为只有对堆栈具有正确权限的团队成员才能更新或销毁它们。没有办法锁定堆栈。
我要做的就是为您的生产部署建立一个单独的堆栈，然后只允许访问您选择的 CI/CD 管道工具，以便其他人无法进行更新。
这也是 Pulumi 提供预览的原因，以便您在同意更新之前可以看到正在更改的内容。
最近，Pulumi 宣布了“更新计划”（博客文章宣布这一点：https ://www.pulumi.com/blog/announcing-public-preview-update-plans/）可能会对您有所帮助。
You're correct in that only members of teams with the correct permissions on stacks can update them or destroy them. There's no way to lock a stack.
What I would do is have a separate stack for your production deployment and then only give access to your CI/CD pipeline tool of choice so that no one else can do the update.
This is also why Pulumi has previews so that you can see what is being changed before you agree to the update.
Recently, Pulumi announced "Update Plans" (blog post announcing this: https://www.pulumi.com/blog/announcing-public-preview-update-plans/) that might help you out.
保护堆栈免受更改的另一个选项是
保护您的资源。然而，这只会阻止它们被删除。如果您想确保您的资源不会被意外删除，例如需要替换资源的更新，或者有人试图破坏错误的堆栈，那么这非常有用
： pulumi.com/docs/concepts/options/protect/" rel="nofollow noreferrer">https://www.pulumi.com/docs/concepts/options/protect/
不过，如果你想确保根本不做任何改变，那么不幸的是，您需要在云端的身份级别处理它。不幸的是，Pulumi 似乎没有提供如此细粒度的 RBAC 设置。
另请记住，这种保护仅来自 Pulumi 端，如果你想确保资源安全，你可以在 Azure 中添加诸如
锁之类的东西Another option to protect your stack from changes is to
protectyour resources. However, this only prevents their removal.This is mostly useful if you want to ensure that your resources are not deleted by accident, by e.g. an update that would require them to be replaced, or by someone trying to destroy wrong stack:
https://www.pulumi.com/docs/concepts/options/protect/
Still, if you want to make sure no changes are done at all, then unfrotunately you'd need to deal with it at identity level on the cloud side. Pulumi doesn't seem to offer such fine grained RBAC setup unfortunately.
Also remember, that such protection only comes from Pulumi side, if you want to make sure that resources are safe, you can add stuff like
locksin Azure