Pulumi

Pulumi opened a research preview of Neo Security, an agent that finds exploitable flaws in existing cloud infrastructure by building a threat model and mapping attack paths across inventory, context graph, IaC intent, runtime state, and policy. Findings surface as actionable reports with proposed diffs and pull requests, with remediation the only write path.

The Pulumi Kubernetes provider can now extend itself with any CRD by pointing the new --extension flag at a manifest file, generating a typed SDK managed under a single provider instance — with full language support. Existing crd2pulumi users can migrate by swapping SDK package names with no stack-state changes. Includes resources for Kubernetes v1.37.0.

Pulumi Context API connects resources, stacks, and relationships into a single queryable graph, enabling impact, coverage, and cleanup analysis. Available in preview for Enterprise and Business Critical organizations.

Pulumi has published compatibility testing for its HCL support, verifying that a program working with tofu apply also works with pulumi up. The framework pairs an HCL program's files with the providers it uses, and automated tests compare Pulumi's execution against OpenTofu's expected behavior.

An overview of the Kubernetes infrastructure as code landscape, covering three layers: cluster provisioning (Pulumi, Terraform), workload templating (Helm, Kustomize), and GitOps reconciliation (Argo CD, Flux). Highlights Pulumi's capabilities like Server-Side Apply as default, Helm chart options, and Kustomize support.

Pulumi v3.254.0 automatically logs every operation to encrypted files under $PULUMI_HOME/logs, rotated after 7 days or 500 MB. New pulumi logs share command re-encrypts logs for Pulumi support without exposing secrets; pulumi logs decrypt reads them locally.

The Kubernetes provider now generates directly from the Kubernetes OpenAPI v4.33.0 specs, keeping it current with the Kubernetes API surface automatically. For manifests and Kustomize, the versioned APIs — yaml/v2.ConfigFile, ConfigGroup, and kustomize/v2.Directory — are the recommended path over their unversioned predecessors. The article also explains how the OpenAPI-driven approach simplifies cluster+workload management compared to Terraform's two-stage applies and data-source plumbing.

Pulumi Cloud now supports storing Terraform state as a remote backend, including remote execution with human approvals. A Terraform module registry lets users publish and share modules across language boundaries, and the Pulumi engine natively supports HCL as an authoring language.

Pulumi Cloud is now GA as a Terraform state backend, enabling organizations to manage existing Terraform and OpenTofu estates with remote runs, manual approvals, and access controls. HCL is now a first-class IaC language in Pulumi, fully OpenTofu-compatible, and Terraform modules can be imported into Pulumi programs and hosted in the private registry.

Pulumi Cloud now models AWS CloudFormation stacks and Azure Resource Manager deployments as stacks alongside Pulumi IaC stacks, with built-in migration tracking and zero-diff verification via Pulumi Neo or import commands.