{"record":{"id":"45f4b59a337a2654","repo":"pulumi/pulumi","slug":"configuring-policy-pack-q-w","errorCode":null,"errorMessage":"configuring policy pack %q: %w","messagePattern":"configuring policy pack %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/engine/update.go","lineNumber":323,"sourceCode":"\t\t\tvar configFromFile map[string]plugin.AnalyzerPolicyConfig\n\t\t\tif pack.Config != \"\" {\n\t\t\t\tconfigFromFile, err = resourceanalyzer.LoadPolicyPackConfigFromFile(pack.Config)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t}\n\t\t\tconfig, validationErrors, err := resourceanalyzer.ReconcilePolicyPackConfig(\n\t\t\t\tinfo.Policies, info.InitialConfig, configFromFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"reconciling policy config for %q: %w\", info.Name, err)\n\t\t\t}\n\t\t\tif len(validationErrors) > 0 {\n\t\t\t\tsort.Strings(validationErrors)\n\t\t\t\treturn nil, fmt.Errorf(\"validating policy config for %q: %s\",\n\t\t\t\t\tinfo.Name, strings.Join(validationErrors, \"; \"))\n\t\t\t}\n\t\t\tif err = analyzer.Configure(plugctx.Request(), config); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"configuring policy pack %q: %w\", info.Name, err)\n\t\t\t}\n\t\t}\n\t\tanalyzers = append(analyzers, analyzer)\n\t}\n\treturn analyzers, nil\n}\n\n// HostFactory constructs the plugin host for a deployment.\ntype HostFactory func(\n\tctx context.Context, d, statusD diag.Sink, debug plugin.DebugContext,\n) (plugin.Host, error)\n\n// UpdateOptions contains all the settings for customizing how an update (deploy, preview, or destroy) is performed.\n//\n// This structure is embedded in another which uses some of the unexported fields, which trips up the `structcheck`\n// linter.\n//\n//nolint:structcheck","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/engine/update.go#L305-L341","documentation":"After validation, the engine pushes the final config to the analyzer plugin via gRPC `Configure`. If that RPC fails (plugin crash, transport error, plugin rejects the config), the error is wrapped with the pack name. This means the config passed local validation but the plugin could not accept or apply it.","triggerScenarios":"Calling analyzer.Configure(plugctx.Request(), config) after successful validation when the analyzer plugin process is dead, the gRPC call fails, or the plugin-side configuration logic errors (e.g. invalid enforcement level, plugin version that can't deserialize the config).","commonSituations":"Policy pack plugin crashed or was killed (OOM) mid-deployment; plugin binary incompatible with the CLI's gRPC protocol version; plugin rejects enforcementLevel or config it cannot parse despite passing schema validation.","solutions":["Check the wrapped error and plugin stderr/logs for the root cause (crash vs config rejection)","Rebuild the policy pack with a @pulumi/policy version compatible with your CLI","Re-run and watch plugin diagnostics; fix any config values the plugin rejects","Ensure adequate resources/permissions so the plugin process isn't killed"],"exampleFix":"// before: stale plugin binary crashes on Configure\npulumi plugin rm --all && pulumi up --policy-pack ./pack --policy-pack-config cfg.json\n// after: rebuilt pack accepts config\nnpm rebuild && pulumi up --policy-pack ./pack --policy-pack-config cfg.json","handlingStrategy":"try-catch","validationCode":"info, err := analyzer.GetAnalyzerInfo(ctx)\nif err != nil { return err } // plugin must be alive and protocol-compatible before Configure\nif info.SupportsConfig { /* proceed with validated config */ }","typeGuard":null,"tryCatchPattern":"err := runWithPolicyPack(cfgPath)\nif err != nil && strings.Contains(err.Error(), \"configuring policy pack\") {\n    log.Printf(\"plugin failed to accept config: %v\", err)\n    log.Println(\"check plugin logs, rebuild the pack, or remove stale plugins (pulumi plugin rm --all)\")\n    os.Exit(1)\n}","preventionTips":["Ensure the pack plugin version matches the CLI's gRPC protocol expectations","Monitor plugin process health (crashes/OOM) during deployments","Test Configure against the pack in CI before production runs","Remove stale plugins and rebuild packs after CLI upgrades"],"tags":["policies","configuration","grpc","plugin"],"backgroundTag":"policy-pack-configure-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}