npx @buildinternet/releases get pulumiAdds pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create ESC environments, plus state migration callbacks on resource registrations. Fixes serialization of secret unknowns in NodeJS, Python, and PCL, and a panic on custom resources with no ID.
Adds pulumi state promote to turn stateful snippets into Pulumi program code and changes deployment settings get --output=json to render environment variables as objects. Fixes Python typed object stack outputs now serializing with camelCase names, matching other SDKs.
Pulumi opened a research preview of Neo Security, an agent that finds exploitable flaws in existing cloud infrastructure by building a threat model and mapping attack paths across inventory, context graph, IaC intent, runtime state, and policy. Findings surface as actionable reports with proposed diffs and pull requests, with remediation the only write path.
The Pulumi Kubernetes provider can now extend itself with any CRD by pointing the new --extension flag at a manifest file, generating a typed SDK managed under a single provider instance — with full language support. Existing crd2pulumi users can migrate by swapping SDK package names with no stack-state changes. Includes resources for Kubernetes v1.37.0.
Pulumi Context API connects resources, stacks, and relationships into a single queryable graph, enabling impact, coverage, and cleanup analysis. Available in preview for Enterprise and Business Critical organizations.
Introduces PULUMI_DEFAULT_ORGANIZATION to set the default org, and interactive pulumi new now shows a single confirmation of project, stack, and config defaults. Also removes the Node.js Automation API output buffer limit and improves error reporting for failed logins and package schema validation.
Stored credentials can now be encrypted with an OS-protected key, enabled with PULUMI_CREDENTIAL_STORE. Interactive pulumi new now asks for cloud provider and language instead of listing every template, Go policy packs gain stack validation support, and preview --import-file no longer emits unknown values. Plus fixes for hyphenated schema modules, symlinked paths, and missing Python SDK arguments.
Pulumi has published compatibility testing for its HCL support, verifying that a program working with tofu apply also works with pulumi up. The framework pairs an HCL program's files with the providers it uses, and automated tests compare Pulumi's execution against OpenTofu's expected behavior.
An overview of the Kubernetes infrastructure as code landscape, covering three layers: cluster provisioning (Pulumi, Terraform), workload templating (Helm, Kustomize), and GitOps reconciliation (Argo CD, Flux). Highlights Pulumi's capabilities like Server-Side Apply as default, Helm chart options, and Kustomize support.
Adds pulumi state get to show individual resources, plus new pulumi do capabilities including auto-created project and stack fallback, auto-assigned stack resource identifiers, and stateful patch support. The DIY backend deprecation warning is now an error, and Go codegen fixes several node-naming and collision bugs.
Announces the Notification Center in the Pulumi console, surfacing organization activity such as teammate task completions and pending ESC change requests in real time. Users can keep an eye on what matters without leaving the console.
Pulumi v3.254.0 automatically logs every operation to encrypted files under $PULUMI_HOME/logs, rotated after 7 days or 500 MB. New pulumi logs share command re-encrypts logs for Pulumi support without exposing secrets; pulumi logs decrypt reads them locally.
The Kubernetes provider now generates directly from the Kubernetes OpenAPI v4.33.0 specs, keeping it current with the Kubernetes API surface automatically. For manifests and Kustomize, the versioned APIs — yaml/v2.ConfigFile, ConfigGroup, and kustomize/v2.Directory — are the recommended path over their unversioned predecessors. The article also explains how the OpenAPI-driven approach simplifies cluster+workload management compared to Terraform's two-stage applies and data-source plumbing.
Added --ignore-protect flag to delete protected resources without state changes, and a --server flag that skips package resolution. Fixed output-form invokes depending on pending remote components to resolve as unknown during previews.
Pulumi Cloud now supports storing Terraform state as a remote backend, including remote execution with human approvals. A Terraform module registry lets users publish and share modules across language boundaries, and the Pulumi engine natively supports HCL as an authoring language.
Pulumi Cloud is now GA as a Terraform state backend, enabling organizations to manage existing Terraform and OpenTofu estates with remote runs, manual approvals, and access controls. HCL is now a first-class IaC language in Pulumi, fully OpenTofu-compatible, and Terraform modules can be imported into Pulumi programs and hosted in the private registry.
An analysis of why prompt guardrails fail for autonomous coding agents, particularly in infrastructure contexts, and how Docker Sandboxes provide a practical alternative with a single command.
Pulumi Cloud now models AWS CloudFormation stacks and Azure Resource Manager deployments as stacks alongside Pulumi IaC stacks, with built-in migration tracking and zero-diff verification via Pulumi Neo or import commands.
Package commands now support an --extension flag for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install. Fixed a race condition where parallel pulumi install processes sharing a PULUMI_HOME could intermittently fail with a missing provider executable error.