Pulumi

Recently shipped the Context API, a queryable graph of all infrastructure, and made the Kubernetes provider extensible with any CRD.

The Context API gives agents one graph over the whole estate. Preview for Enterprise and Business Critical orgs, it connects resources, dependencies, stack outputs, and runtime data into a single queryable surface. Pulumi Neo uses it out of the box, and the API is designed to teach any agent what it needs to get started.

Kubernetes provider v4.34.0 accepts CRDs as extensions. Pass any Custom Resource Definition manifest via the new --extension flag and the provider generates typed resources for it. The release also tracks Kubernetes v1.37.0 resources.

Neo Security brings agent-led infrastructure auditing. The new offering analyzes the full context graph — resources, connections, dependencies, and logs — to surface exploitable flaws that static code analysis alone cannot find.

Terraform and OpenTofu interoperability is now first-class. Pulumi Cloud acts as a Terraform state backend with remote execution and human approvals; a module registry publishes modules across language boundaries; HCL is a supported authoring language. The HCL interpreter maps Terraform semantics well enough to run 96% of top Terraform modules. pulumi stack migrate moves a stack from another backend, re-encrypting secrets.

Discovered Stacks brings non-Pulumi infrastructure into Pulumi Cloud. CloudFormation stacks and ARM deployments model as stacks alongside Pulumi IaC, with built-in migration tracking resources until code matches the cloud.

Security and access hardening. Org admins enforce maximum access token expiry; credentials can be stored encrypted with an OS-protected key via PULUMI_CREDENTIAL_STORE. The standalone ESC CLI is retired — use pulumi env; the ESC repo is archived.

CLI productivity tools. pulumi state get shows individual resources, and pulumi do auto-assigns identifiers and patches in stateful mode. Interactive pulumi new asks for provider and language instead of listing every template. Also added --ignore-protect, pulumi logs share, and --override-env for previewing ESC drafts.