April 2022 Summaries

Pulumi has introduced Organization Access Tokens to cater to the growing demand from enterprise clients for efficient management of automated workloads, such as CI/CD and Automation API, securely and collaboratively. Unlike Personal Access Tokens, which are tied to individual users and can cause issues when users leave an organization, these new tokens are linked to the organization itself and can be used without being associated with a specific user identity. This ensures continuity in automated processes and adheres to the principle of least privilege, reducing unnecessary access permissions. Organization Access Tokens offer write permissions to stacks and are particularly beneficial for enterprises using SSO/SAML/SCIM, as exemplified by the customer Fauna, who faced challenges with their previous user-based token system after integrating with Pulumi's SSO. The tokens, which can only be managed by Organization Admins, provide a one-time value upon creation and can be logged for security and auditing purposes, with detailed records of actions in the Audit Logs. This enhancement is available to Enterprise and Business Critical customers, as well as those on a trial version of Pulumi Service.

Joe Duffy, Founder & CEO of Pulumi, and James Governor, Co-founder of RedMonk, delve into the concept of developer-first infrastructure, which aims to empower developers to manage modern cloud applications and infrastructure using software engineering practices. They highlight the evolution of computing from assembly languages to higher-level abstractions and suggest that a similar transformation is needed in cloud computing. Duffy and Governor discuss how treating infrastructure as code, using APIs, and embracing modularity and polyglot programming can help manage cloud complexity and enhance development velocity. They emphasize principles such as continuous delivery, environment parity, and secure configuration as essential for building cloud-native applications. Their conversation underscores the importance of focusing on developer experience to drive innovation and efficiency in cloud infrastructure, proposing that companies that excel in this area become industry leaders.

Amazon Elastic Kubernetes Service (EKS) and its extension EKS Anywhere have significantly streamlined the management of Kubernetes clusters in the cloud, facilitating hybrid and on-premises deployments. This advancement has led to the development of Shared Services Platforms (SSPs), which enable application developers to self-service infrastructure environments and allow platform teams to standardize and automate resource provisioning. Pulumi's involvement in this ecosystem, through its multi-language components and the EKS Blueprints program, aims to simplify Kubernetes deployments by offering reusable components, secrets management, and centralized policy enforcement. The platform's new SSP SDK supports multiple programming languages and provides tools for managing environments, simplifying platform administration with addons, and onboarding teams via GitOps. Pulumi encourages community feedback to enhance these components and further streamline infrastructure management.

Pulumi has released a series of updates and new features, enhancing its cloud infrastructure management platform. Key highlights include the release of version 5.0.0 of the Pulumi AWS Provider, which integrates the full functionality of the Terraform AWS Provider and introduces several improvements and breaking changes. The updates also simplify the deployment of AWS Lambda functions by allowing Lambda Function URLs to be accessed directly, eliminating the need for an Amazon API Gateway. Additionally, Pulumi has improved its Command Line Interface (CLI) by displaying richer diffs for JSON and YAML objects, retaining secret values, and allowing users to clear pending operations more efficiently. Users can now install Pulumi using the Winget package manager and manage stack selections with new commands. Furthermore, the platform now supports downloading plugins from private GitHub releases using updated authentication methods, and the documentation search experience has been enhanced for better usability.

Pulumi is highlighted for its ability to simplify the management of containers and Kubernetes clusters, making it a preferred choice for cloud resource management across various stages of cloud journeys. The platform's capabilities are underscored by its role as a launch partner in the AWS Container Competency program, showcasing its comprehensive lifecycle management of container-based architectures, which includes provisioning, governance, security, and observability for services like Amazon EKS and ECS. Pulumi offers tools such as Crosswalk for Kubernetes and a Kubernetes Provider that facilitate multi-region, multi-account deployments, and full Kubernetes API support, enhancing features like multi-tenancy and resource provisioning. It integrates seamlessly with both open-source and leading industry tools for observability, supports authentication and authorization management through IAM roles and integration with identity platforms, and provides centralized governance via policy-as-code to ensure compliance. Pulumi also supports hybrid deployments, enabling workload management across AWS, on-prem, and other clouds, and aligns infrastructure and application development with CI/CD workflows, offering tools like the Pulumi Kubernetes Operator for GitOps-style deployments.

KubeCrash is a new event designed for those unable to attend KubeCon, offering live crash courses and sessions on cloud native technology led by maintainers of prominent open source projects. Organized by five open source companies, the event focuses on delivering high-quality content without vendor pitches, covering projects like Linkerd, cert-manager, CockroachDB, Pulumi, Polaris, and Goldilocks. With Kubernetes as a central tool for cloud-hosted application development, KubeCrash aims to enhance knowledge sharing among developers, reliability engineers, cloud security specialists, and platform engineers. The program includes workshops on implementing zero-trust environments using cert-manager, facilitating multi-cluster failover with Linkerd, optimizing Kubernetes workloads with Polaris and Goldilocks, delivering serverless services using Kubernetes, and cloud engineering with Pulumi across multiple cloud providers. The event promises actionable insights on topics such as scalable zero-trust, cloud-native security, and serverless multi-cloud deployments, ensuring attendees gain practical understanding and skills directly from the experts.

AWS Lambda has evolved from a basic 'functions as a service' model into a comprehensive serverless platform that allows users to execute code without managing infrastructure. Recent advancements include the integration of persistent storage via Amazon EFS, support for container-based functions, and the inclusion of AWS Graviton2 processors for enhanced performance. The latest feature, AWS Lambda Function URLs, provides direct HTTPS endpoint support for Lambda functions, streamlining the process compared to using Amazon API Gateway. This feature allows developers to invoke functions directly from various HTTP clients, and it leverages the AWS Cloud Control API for rapid feature support. Function URLs simplify monitoring and access control through integrations with AWS CloudTrail and IAM, while also offering options for throttling and Cross-Origin Resource Sharing (CORS). The setup process is straightforward and can be implemented using modern programming languages supported by infrastructure as code solutions like Pulumi, enhancing productivity and reducing deployment complexity.

Pulumi's 3.23.0 release introduces the ability to disable default providers, addressing a popular community request and enhancing control over cloud deployments. This update allows users to define explicit providers in their code, ensuring predictable and consistent resource deployments across different regions and accounts by avoiding unexpected behavior that may arise from default providers. The change is particularly beneficial for complex scenarios like multi-region deployments or when deploying to newly created Kubernetes clusters, where explicit providers are necessary. Users can disable default providers on a per-stack basis by specifying the relevant package names in the configuration file using the `pulumi:disable-default-providers` setting, effectively preventing unintentional reliance on default system configurations and improving deployment reliability.