March 2021 Summaries

Data breaches, often resulting from cyber-attacks or careless practices, involve the theft of sensitive information like credit card numbers and trade secrets, with Bitcoin miners being notable perpetrators. Protecting against these breaches involves understanding and safeguarding 'secrets,' such as passwords and API keys, by removing plaintext secrets from codebases and implementing detection in CI/CD pipelines. It's essential to manage secrets securely through encryption and secret servers, or by utilizing cloud providers' secret management services. Having a response plan for data breaches, including resetting credentials and monitoring systems, is crucial, as is integrating security measures early in the development process. Pulumi emphasizes security by default, offering built-in secret storage and supporting major cloud secret services.

Data science has made significant strides with tools like Jupyter Notebook, which simplify complex tasks by executing high-level code tailored to specific problems, thus enhancing productivity and encouraging experimentation. While data scientists often work locally, they leverage cloud resources for data storage and model analysis due to their scalability and cost-effectiveness. Despite the advantages of accessing cloud resources through SDKs like AWS's boto3, these require expertise in managing and architecting solutions. Pulumi's Automation API enhances this process by offering high-level abstractions that allow data scientists to focus more on their analyses and models without deep knowledge of cloud APIs. It simplifies infrastructure management by providing robust deployments, concurrency management, and state maintenance. An illustrative example within a Jupyter notebook demonstrates how to create and manage a static website using an S3 bucket through Pulumi's framework, showcasing the ease of automating infrastructure tasks alongside data science work. Pulumi allows data scientists to maintain their focus on analysis and model building in familiar environments by reducing the infrastructure management burden and facilitating seamless integration with existing workflows.

Pulumi has announced C# support for its Automation API, which allows .NET developers to automate infrastructure deployments and create complex orchestration workflows using the Pulumi engine. The Pulumi.Automation NuGet package provides tools such as LocalWorkspace and WorkspaceStack for managing Pulumi Stacks, enabling users to update, refresh, preview, and destroy cloud resources programmatically. The Automation API facilitates inline execution of Pulumi programs and supports integration with existing Pulumi projects, allowing for complex deployment workflows like blue-green deployment models. This enhancement offers .NET developers the ability to build custom operations tooling and cloud frameworks, with debugging and invocation capabilities akin to standard code execution. Pulumi encourages users to share their experiences with the Automation API on social media platforms like Twitter and Community Slack.

Policies play a crucial role in managing applications and infrastructure by setting guidelines for security, resource use, and compliance. Traditionally, policies were enforced through text documents or cloud provider GUIs, but these methods are prone to errors and inefficiencies in rapidly evolving environments. The concept of "Policy as Code" allows for the application of software engineering principles to policy management, offering benefits such as clarity, version control, testing, and automation. Policies defined as code are unambiguous, can be integrated into automated pipelines, and are easily managed with familiar development tools. Common applications include authorization control, infrastructure provisioning, Kubernetes management, and cost control. Tools like Pulumi and CrossGuard facilitate implementing policy as code, providing a framework for automated and efficient policy enforcement in complex infrastructures.

Pulumi has officially launched its new Azure-native provider, previously known as Pulumi Azure NextGen, as the default method for managing Azure resources, offering direct integration with the Azure Resource Manager API. This provider, now dubbed "Azure-Native," ensures same-day access to the entire Azure API surface and includes features such as version-less resources, auto-naming, and auto-location. The native provider supports 1,010 resource types and automatically stays updated with Azure API changes, generating SDKs directly from Microsoft's API specifications. It introduces the concept of "native providers," which map functionality directly from underlying APIs, and offers improved features over its predecessor, like top-level resources and enhanced auto-naming. The provider is open-source, available on GitHub, and supports a non-disruptive migration from the classic Pulumi-Azure provider. For newcomers, Pulumi offers a comprehensive guide to get started, with templates and extensive examples for various programming languages, ensuring streamlined deployment and management of Azure resources through infrastructure-as-code.

Simen A. W. Olsen, a Software Architect and Manager at Bjerk, discusses with Paul Stack the newly re-architected GitHub Action powered by the Pulumi Automation API. Initially launched as a Docker container action in 2018, this GitHub Action allowed users to run Pulumi commands within their workflows. However, the new version leverages JavaScript, offering a more streamlined and customizable experience by integrating Pulumi's Automation API, which enables infrastructure as code without needing a CLI. This transition not only simplifies the code but also enhances performance by eliminating the need for large Docker downloads and allowing for more control over the runtime environment and authentication with cloud providers. Users can now pin specific versions of NodeJS, Python, Go, .NET, or Pulumi and test their code against various runtime versions and operating systems. The new JavaScript-based Action offers faster performance, improved flexibility, and easier integration with existing CI/CD workflows, encouraging users to migrate and provide feedback to the Pulumi team.