August 2019 Summaries

This post explores ten practical "pearls" or code snippets demonstrating the use of Pulumi to construct serverless applications with Azure Functions and infrastructure as code, categorized into function app deployment, HTTP functions as callbacks, cloud event handling, and data flows with function bindings. It highlights the flexibility of deploying Azure Functions using Pulumi in different languages and hosting plans, such as the Elastic Premium Plan, and the ability to create strongly-typed, serverless HTTP endpoints by mixing JavaScript or TypeScript with infrastructure definitions. The post further examines how to process events from Azure Event Hubs, subscribe to Azure Event Grid, and manage data flows using function bindings, showcasing Pulumi's capabilities in managing relationships between cloud services and infrastructure with minimal configuration. This approach allows developers to efficiently handle tasks like REST API implementation, function "warming" to prevent cold starts, and automation through resource-level event handling, making Pulumi a powerful tool for integrating cloud infrastructure with serverless computing.

Pulumi has partnered with GitHub to enhance the security of Pulumi Access Tokens by integrating with GitHub's Token Scanning service, which examines commits to public repositories for these sensitive tokens. The tokens, crucial for authenticating with Pulumi's cloud infrastructure management service, should never be shared publicly or committed to source control, as they allow non-interactive login to the CLI and access to stack configurations, including other secrets. GitHub's service identifies potential token matches and verifies them with Pulumi, which then notifies users via email but does not automatically revoke the token, emphasizing the importance of keeping email addresses updated. To mitigate risks, it is recommended to avoid committing tokens and instead utilize CI/CD environment variables to manage these secrets securely, with Pulumi providing various integration guides for different CI/CD systems and encouraging community contributions for additional platforms.

Migrating from Terraform to Pulumi involves effectively managing existing cloud infrastructure with Pulumi's robust infrastructure provisioning solutions. Pulumi enables seamless adoption and management of existing resources, whether they were originally deployed manually, through Terraform, or other infrastructure-as-code tools like CloudFormation. By offering tools such as the `.get` methods and StackReference, Pulumi allows for easy referencing of existing resources, while the import resource option facilitates the adoption of these resources into Pulumi-managed infrastructure without creating new duplicates. This flexibility extends to automating entire migration processes and managing resources at scale through importing resource identifiers from configurations or files. The process includes deploying existing infrastructure, creating a Pulumi program to describe it, adding import IDs for adoption, and managing the resources incrementally through Pulumi, ultimately allowing users to leverage Pulumi's features for future infrastructure management.

The blog post discusses the complexities involved in provisioning and deploying applications across Kubernetes clusters managed by AWS Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE), as well as self-managed clusters. It highlights how Pulumi, an open-source infrastructure-as-code tool, can simplify these processes by using its various SDKs to create and manage clusters and deploy applications like the kuard app across different environments, leveraging TypeScript for development benefits such as code linting and type checking. The post emphasizes Pulumi's ability to abstract away provider-specific details, enabling developers to focus on application performance across different cloud contexts while adhering to best practices and offering extensive customization options. Pulumi's compatibility with the official Kubernetes client-go library ensures its functionality across any environment where kubectl works, providing a versatile solution for multi-cloud Kubernetes management.