Pulumi Blog

The Pulumi NVIDIA AI Cluster Runtime provider deploys workload-specific training and inference endpoints using NVIDIA's pre-validated GPU infrastructure recipes across cloud GPU providers, with pulumi preview showing every component the recipe expands into and pulumi up deploying them as children of a single resource with full day-2 lifecycle. A Python ClusterStack resource takes kubeconfig, accelerator, service, intent, and node count.

Policy groups now support tag matching conditions, so any stack or cloud account whose tags match the condition joins the group and membership stays current as tags change. Tag rules work alongside individually added stacks and accounts and can be defined in Pulumi Cloud or via the Pulumi Service Provider's stackMatchRule and accountMatchRule.

A new fn::open::oidc provider lets a Pulumi ESC environment mint a short-lived OpenID Connect token for any service that accepts one, replacing long-lived stored API keys with credentials that expire within the hour. Tokens are signed by Pulumi, carry configurable audience and duration, and ESC stores nothing.

Pulumi AWS provider v7.45.0 and AWS Native v1.75.0 add accountaccess resources (aws.accountaccess.Application and aws.accountaccess.Entitlement) for managing AWS IAM account access manager as code, with SDKs for TypeScript, Python, Go, C#, Java, HCL, and YAML. The post walks through defining roles, applications, and entitlements, and notes that AAM roles must be created by you rather than provisioned automatically like permission sets.

Environments with approvals enabled can now have multiple open change requests at once, where previously only one was allowed and teammates were blocked. If another change request is applied first, a change request based on an older revision can be updated via a 3-way merge, with conflicts shown line-by-line in the console. Available in Pulumi Cloud on Pro and Enterprise editions.

Pulumi explains how Neo achieves workspace continuity for long-running agent tasks by replacing Git-based repository reconstruction with Kopia, an open source backup tool that creates encrypted, incremental, content-addressed snapshots on generic object storage. The design splits a control plane that authorizes recovery and mints task-scoped credentials from a data plane where the runtime restores and checkpoints its workspace directly, with per-task storage prefixes and repository passwords as the multi-tenant security boundary.

New component state migrations let Pulumi component authors ship an upgrade path with the component itself, translating the saved state of a component and its children before Pulumi works out which resources need to change, so components like AWSX VPC can change internal design without replacing running infrastructure. The state migrations API is experimental and may change.

The new pulumi env setup command brings Pulumi ESC's OIDC onboarding flow for AWS, Azure, and Google Cloud to the CLI, with interactive prompts or non-interactive flags for scripts and agents. It creates the identity provider, IAM role, and policy attachment per account, then creates an ESC environment per account with the aws-login provider configured.

Pulumi opened a research preview of Neo Security, an agent that finds exploitable flaws in existing cloud infrastructure by building a threat model and mapping attack paths across inventory, context graph, IaC intent, runtime state, and policy. Findings surface as actionable reports with proposed diffs and pull requests, with remediation the only write path.

The Pulumi Kubernetes provider can now extend itself with any CRD by pointing the new --extension flag at a manifest file, generating a typed SDK managed under a single provider instance — with full language support. Existing crd2pulumi users can migrate by swapping SDK package names with no stack-state changes. Includes resources for Kubernetes v1.37.0.

Pulumi Context API connects resources, stacks, and relationships into a single queryable graph, enabling impact, coverage, and cleanup analysis. Available in preview for Enterprise and Business Critical organizations.

Pulumi has published compatibility testing for its HCL support, verifying that a program working with tofu apply also works with pulumi up. The framework pairs an HCL program's files with the providers it uses, and automated tests compare Pulumi's execution against OpenTofu's expected behavior.

An overview of the Kubernetes infrastructure as code landscape, covering three layers: cluster provisioning (Pulumi, Terraform), workload templating (Helm, Kustomize), and GitOps reconciliation (Argo CD, Flux). Highlights Pulumi's capabilities like Server-Side Apply as default, Helm chart options, and Kustomize support.

Pulumi v3.254.0 automatically logs every operation to encrypted files under $PULUMI_HOME/logs, rotated after 7 days or 500 MB. New pulumi logs share command re-encrypts logs for Pulumi support without exposing secrets; pulumi logs decrypt reads them locally.

The Kubernetes provider now generates directly from the Kubernetes OpenAPI v4.33.0 specs, keeping it current with the Kubernetes API surface automatically. For manifests and Kustomize, the versioned APIs — yaml/v2.ConfigFile, ConfigGroup, and kustomize/v2.Directory — are the recommended path over their unversioned predecessors. The article also explains how the OpenAPI-driven approach simplifies cluster+workload management compared to Terraform's two-stage applies and data-source plumbing.