Pulumi

Two Pulumi talks at KubeCon NA, Tue Nov 10: 🎮 Engin Diri on hardware-level GPU sharing with DRA, 4:40 PM MT 🏃 Adam Gordon Bell on the AI running coach he built with kagent, 2:50 PM MT Then come say hi at booth 200.

You can hand a coding agent real infrastructure work once its limits sit somewhere it can't negotiate with them. Engin Diri recaps the Neo in a Docker Sandbox workshop with Adam Gordon Bell and Docker's Mike Coleman: the Pulumi controls, the sandbox boundaries, and what changed since August.

AGNTCon + MCPCon starts tomorrow in San Jose. Find Pulumi at booth 50. Agents already write most application code. Infrastructure teams want that same velocity, but they have to move safely too: infrastructure in code, inside guardrails you set.

Your platform doesn't stop at the cluster edge. Databases, networking, IAM, DNS, queues: most teams manage that half in one tool and Kubernetes in another, with YAML stretched across the seam. Pulumi does both in one program, one PR, one review. Booth 200 at KubeCon NA.

Pulumi policy groups can now find their own members, so new stacks get the right policies without anyone editing the group. The same works for cloud accounts in audit groups. Here's how it works.

Pulumi ESC can now sign a short-lived OIDC token for any audience you choose. Anthropic, Cloudsmith, and JFrog can each exchange it for their own credential, so the stored API key goes away. One rule: pin the subject in the trust policy.

Coding agents need better memory than local text files. On Oct 20, @ediri.de and I will show how to use the open-source agent-memory project with Elasticsearch to give your AI a shared, searchable brain. We'll deploy it live with Pulumi. 🚀 www.pulumi.com/events/give-...

Managing AWS access has meant picking one: centralized permission sets that make every account identical, or per-account IAM roles that fragment everything. AWS's account access manager drops that tradeoff, and you can run it as code with Pulumi. Here's how.

Agents already write most application code. Infrastructure teams want that same velocity, but they have to move safely too. That takes infrastructure expressed in code, inside guardrails you set: access controls, audit logging, policy. Come talk it through at the Pulumi booth.

Tomorrow: Engin Diri (@ediri.de), Adam Gordon Bell, and Mike Coleman from Docker run Pulumi Neo in a Docker Sandbox. Free, Oct 14, 10 AM CEST 👇 https://www.pulumi.com/events/neo-in-a-docker-sandbox/?utm_source=bluesky&utm_medium=social&utm_content=neo-in-a-docker-sandbox#session-emea

Pulumi ESC environments no longer have a single-change-request bottleneck. Multiple teammates can now propose changes to the same environment at once. Each gets its own review, and you can rebase onto the latest revision in one click.

Oct 14, free workshop with Docker: Pulumi Neo in a Docker Sandbox, turning plain English into real cloud infra. 10 AM CEST 👇 https://www.pulumi.com/events/neo-in-a-docker-sandbox/?utm_source=bluesky&utm_medium=social&utm_content=neo-in-a-docker-sandbox#session-emea

We're guests at Elastic's (@elastic.co) NYC meetup tomorrow, hosted at their office. Engin Diri (@ediri.de) on agent memory (and yes, there will be Typesafe Jev), Ines Potier on Elastic's move to stateless Serverless. Oct 6, 6 PM. Pizza after. https://luma.com/ai-agents-nyc

Fun catching up with @ediri.de at AWS Summit Tel Aviv, and discussing open source, and how we can collaborate around #Pulumi, #OpenSearch and more. #selfie #AWSSummit @pulumi.com @opensearch.org

We paired TypeSafe's Jev with the Pulumi Automation API to build GeoDeploy: confidence-gated AI picks the best AWS, Azure, or Google Cloud region for your users, and Pulumi provisions the Kubernetes. Open source today.

Not every Claude Code message needs Opus. Engin Diri built jev-router to try Jev, TypeSafe's System One model. It asks Jev which Claude model each message needs, in a few hundred milliseconds and for a fraction of a cent. How it works, and how to try it:

Ten coding agent tips, each checked against the research. The most expensive habit on the list: escalating to a bigger model mid-task. In an AWS study on SWE-bench, restarting Opus from scratch cost less and solved more than handing it Haiku's transcript.

We've arrived at AWS Summit Tel Aviv 📍 Booth B10 The boxes made it. So did the hats. Engin and the crew are there all day.

Tomorrow: does your team need an exit plan from its cloud provider? Waldemar Kindler, Jim Dowling and Sarbjeet Johal, who thinks most companies shouldn't bother. Live, with Q&A.

Neo Security is our infrastructure security agent. It uses context about your full cloud estate—resources, semantics, code, reachability, runtime data, and more—to build a model of your estate and analyze it. Each finding is actionable thanks to IaC.

A panel about leaving the hyperscalers — with Sarbjeet Johal on it arguing most companies shouldn't. Sep 3. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

We just launched the Pulumi Context API: everything Pulumi knows about your infrastructure as one queryable graph, built agent-first. Any agent can learn it in one request, and Neo uses it out of the box. Here's a brief tour.

Tomorrow: keep your Terraform estate, run it through Pulumi Cloud — no migration, no rewrite. Aug 26, 10 AM ET / 4 PM CEST 👇 https://www.pulumi.com/events/pulumi-for-all-your-iac-terraform-hcl/?utm_source=bluesky&utm_medium=social&utm_content=pulumi-for-all-your-iac-terraform-hcl#session-emea

German enterprises' question has shifted: not "what does this cost?" but "could we move if we had to?" Waldemar Kindler, Sep 3. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

Jim Dowling moved Hopsworks to OVHcloud and cut the bill 62%. Sep 3, he shows his work. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

Our tfcompat tests never say what Pulumi HCL should do. A test is just an HCL program and its providers; OpenTofu's behavior is the spec. That one choice lets LLMs hunt our bugs. We wrote up how.

European regulations and rising cloud bills have CTOs asking a question that was unthinkable five years ago: do we need an exit plan from our cloud provider? Sep 3, a live panel on when that makes sense, and when it doesn't. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-pane...

Tomorrow: a free hour on configuring Claude Code and opencode for infrastructure as code. We set both up from scratch, then put them to work live on a real task, so Pulumi comes out correct, not plausible. Aug 12, 12 PM ET 👇 https://www.pulumi.com/events/getting-started-with-devops-ai-skills-2/...

Debugging a Pulumi error usually meant reproducing it by hand just to capture a log, then finding a safe way to share a file full of secrets. Pulumi v3.254.0 makes logs automatic and encrypted, safe to share even on a public GitHub issue. Here's what changed.

Coding agents will write your infrastructure as code. Whether it's correct and consistent comes down to how you configure them. Aug 12, free workshop: set up Claude Code + opencode from scratch so they get Pulumi right. 👇 https://www.pulumi.com/events/getting-started-with-devops-ai-skills-2/?ut...

Teams running Terraform don't have to rip it out to move into the agentic infrastructure era. Pulumi Cloud is now GA as a Terraform state backend, HCL is GA as a native Pulumi language, and Terraform modules import without changes. Here's what shipped today.

Every coding agent has a YOLO mode. You're probably running it daily, and prompt guardrails fail right when it matters. Engin Diri on sandboxing agents with Docker Sandboxes, plus an open-source kit preloaded with Pulumi, Terraform, and cloud CLIs for infra work.

Tomorrow: a free hour on Pulumi ESC, from the basics up. What an environment is, how it pulls from the secret stores you already run, and how your IaC, CI/CD, and local dev consume it without scattered copies. 12 PM ET. https://www.pulumi.com/events/intro-to-pulumi-esc-managing-secrets/?utm_sou...

Your secrets are in environment variables, a CI system, two cloud secret stores, and a .env file on somebody's laptop. Aug 5, free intro workshop: pull them into one Pulumi ESC environment everything reads from. https://www.pulumi.com/events/intro-to-pulumi-esc-managing-secrets/?utm_source=blue...

Six months into a migration, can you say which of 800 resources actually made it to IaC — and which were quietly forgotten? The spreadsheet tracking it went stale the day it was written. The spreadsheet is retired for good.

We migrated a 61-resource CloudFormation stack to Pulumi — payments API, database, the works — and never ran pulumi up once. A zero-diff preview proved every resource was in sync. The full step-by-step is up.

An AI agent on Kubernetes isn't just another Deployment: GPUs, long-lived sessions, and a much bigger credential blast radius. Here's how to provision and govern that infrastructure with Pulumi, in TypeScript and Python.

Token rotation policies are easy to write and hard to enforce. Pulumi Cloud now enforces them for you: org admins can cap the max expiry of personal, organization, and team access tokens used against their organization, checked on every request.

esc v0.26.0 is the last standalone ESC CLI release. The repo is archived, and every command now lives under pulumi env in the Pulumi CLI. Swapping esc for pulumi env covers most of them. The ones it doesn't cover are the ones worth knowing. We documented all of them.

A container isn't much of a security boundary: every one on a host shares the same kernel. Kubernetes Agent Sandbox gives AI agents a kernel-isolated, disposable box instead. Adam Gordon Bell deployed it on GKE with Pulumi, one sandbox per developer. Here's how it's wired together.

Terraform alternatives in 2026 split into three camps: general-purpose-language platforms, HCL-compatible forks, and cloud-specific tools. The one that fits your team increasingly depends on something most comparisons skip: how well it works with an AI coding agent in the loop.

Next San Antonio/Austin DNUG is in 10 days! Learn to build your infrastructure in C# with Pulumi! #dotnet #azure 🎤What: Serverless Dad Jokes: What If Everything Was Just C#? 👨‍🏫Who: Adam Gordon Bell ⌚When: July 30 @ Noon CST 🌐Where: Zoom Signup: www.meetup.com/sadnug/event...

Your infra is code. Your on-call setup is forty clicks in a web UI, done once. Engin Diri wires PagerDuty + AWS in one Pulumi program: teams, schedules, escalation policies, and the alarm that pages you. Integration keys flow as dependencies, nothing gets forgotten.

Connect your AWS, Azure, and Google Cloud accounts to Pulumi Insights in about three minutes. The same setup used to take hours to days of per-account OIDC and ESC configuration. We built a wizard that handles all of it. Here's how it works.

Now Pulumi Neo supports monthly usage limits, putting your Neo spend under control so you can hand it more and more infrastructure work.

The LLM wiki everyone built after Karpathy's gist is a dialect only your own agent can read. Google's Open Knowledge Format pins it down: markdown, frontmatter, one required field. Knowledge as code.

Phishing kits replicate the page. They cannot replicate the origin a passkey is bound to. Passkey sign-in is now live in Pulumi Cloud for users who sign in with email and password. Phishing-resistant, synced across devices. Here's how to enroll.

Roey Zalta gave an AI agent its own Mac mini and full system access. His pitch: "give it an environment, tools, autonomy — and see what it builds." His warning: "it's 100% not secure." So how do you run an AI employee safely? Live panel, Jul 14

For a while, running an older Pulumi release meant the docs on the site described a newer one. We closed that gap. You no longer have to guess which parts of the reference still apply to your version. Here's what we shipped.

ISO 27001 compliance on AWS has meant months of mapping governance controls to actual cloud resources, interpreting each one for S3, RDS, CloudTrail. We built 238 policies to handle that mapping. Live today in Pulumi Cloud.