July 2022 Summaries

The blog post discusses the enhancements in Pulumi's Kubernetes provider with the introduction of Server-Side Apply (SSA), a feature that allows safer and more effective management of shared Kubernetes resources. Since its initial release in 2018, the Pulumi Kubernetes provider has evolved, and the integration of SSA now enables the API Server to handle diffs and resolve conflicts, thereby supporting new use cases and enriching the Kubernetes ecosystem. The post highlights several new capabilities such as Patch resource types for every Kubernetes resource kind, "Upsert" support, and the elimination of dependency on the last-applied-configuration annotation for diffs. Practical examples are provided to demonstrate adding labels to existing namespaces, changing default StorageClass settings, and managing shared ConfigMap resources using SSA, showcasing the provider's flexibility and ease of use in managing shared resources. Users are encouraged to explore the how-to guide for SSA to leverage these improvements and engage with the community for support.

Pulumi has integrated .NET 6, the latest Long-Term Support version of .NET, as the default across its ecosystem, enhancing the simplicity and functionality of Pulumi C# projects. The .NET templates have been updated to target net6.0, streamlining program structure by removing the need for MyStack classes in C# and VB.NET while maintaining the existing approach for F#. The updated template framework allows for using modern C# 10 features, such as top-level statements that simplify entry points and asynchronous function calls without traditional main functions or classes. The Deployment.RunAsync function now supports flexible resource definition and output handling, allowing developers to utilize target-typed new expressions for instantiation. Despite these updates, the main Pulumi SDK and cloud provider packages remain backward-compatible with netcoreapp3.1. Pulumi's code generation tools have also been updated to leverage .NET 6 features, offering improved translation of infrastructure as code (IaC) languages into Pulumi-supported languages, including C#, through tools like pulumi convert, arm2pulumi, and kube2pulumi.

AWS has enhanced its Lambda Functions platform by introducing Attribute-Based Access Control (ABAC), which allows for more granular permissions management based on tags associated with IAM roles and Lambda functions. This feature builds on traditional Role-Based Access Control (RBAC) principles, enabling organizations to enforce the principle of least privilege without needing to update permissions for each new user or resource. By using attributes, or tags, organizations can delineate access between different teams, ensuring that, for example, developer team members cannot access operations team resources. The implementation process involves setting up IAM roles and policies with specific conditions and tags, which are then attached to Lambda functions to control access. This update aims to simplify governance, standardize roles, and maintain security boundaries, with a common application being the restriction or enabling of function invocation based on team tags.

When using Pulumi with C# to define infrastructure, a developer experienced runtime errors due to missing required properties that the compiler and IDE failed to detect. The issue arose because the property initializers used in Pulumi's generated .NET API did not enforce the inclusion of necessary parameters, leading to potential runtime exceptions. To address this, PulumiCSharpAnalyzer, a Roslyn-based code analyzer, was developed to provide compile-time checks for missing properties in Pulumi projects, integrating with IDEs and build pipelines to report errors. However, the analyzer has limitations, as it may produce false-positive warnings when property setters are used instead of initializers. Despite these limitations, it enhances static code analysis and helps developers identify issues earlier in their development process.

The AWS Static Website component streamlines the process of deploying a static website on AWS S3, with the option to add a CloudFront CDN, making it accessible through a simple interface using YAML or JSON. Designed to simplify infrastructure management, it requires only basic knowledge of YAML or JSON, an AWS account, and a static website understanding, while leveraging Pulumi to handle complex tasks. Users can quickly set up a complete website by configuring minimal parameters, and the component manages resources like an Amazon S3 bucket, optional CloudFront CDN, Route 53 DNS records, and SSL/TLS certificates. Pulumi also facilitates easy updates and modifications, tracking changes and applying them with subsequent deployments, while offering a preview of resource modifications before confirming deployment or deletion, ensuring efficient resource management and cost control.

Pulumi's latest updates introduce a variety of enhancements across its platform, including improvements to its cloud providers, Pulumi CLI, and core technologies. Significant updates include the addition of 412 new resources to the AWS, Google, and Azure Native providers, the release of Pulumi YAML v0.5.2 with bug fixes and new functionalities like a type checker and support for Fn::ReadFile, and the introduction of local Policy Packs to the Automation API. The pulumi about command now allows users to specify stacks without selection, and a logout confirmation message was added for clarity. Users of self-managed state backends can now enable compression, thanks to a community contribution. The Go SDK's new CompositeInvoke function simplifies working with invoke bundles, and Java support has been added to pulumi convert. Pulumi Service's Stack READMEs now dynamically update based on stack outputs, enhancing documentation capabilities. Additionally, there have been improvements to the SAML/SCIM experience, facilitating smoother user provisioning and deprovisioning within organizations.

At PulumiUP 2022, Tomas Jansson, a software architect at Elkjøp Nordic, showcased how Pulumi's Automation API was employed to develop a self-service infrastructure platform aimed at empowering developers to efficiently provision cloud resources while adhering to security and compliance standards. Elkjøp Nordic, a major consumer electronics retailer in the Nordics, sought to enhance development velocity by allowing teams to innovate within a "walled garden," ensuring that any potential risks from untested code were contained. The platform facilitated the creation of environments such as Azure resource groups and Kubernetes namespaces through a user-friendly interface, enabling developers to manage access levels and define development stages. By utilizing Pulumi and its Automation API, the infrastructure was seamlessly automated, allowing developers to use familiar programming languages and tools to define resources, with native support for Azure and Kubernetes. This approach balanced agility with governance, ensuring developers could work independently while maintaining oversight and security, demonstrating the effectiveness of infrastructure as code in modernizing IT strategies.

Version 3.0 of the Pulumi EKS Provider is designed to simplify the management of hybrid and multi-cloud deployments by supporting Kubernetes, a key component in these environments. With the introduction of Amazon EKS Anywhere Bare Metal, teams can now run EKS Anywhere without VMWare vSphere, allowing for automated provisioning of the EKS-A control plane and worker nodes on bare metal servers. This process involves PXE booting and OS provisioning through the Tinkerbell Infrastructure Services Stack, with AWS Bottlerocket or Ubuntu OS 20.04 as options. Pulumi offers automation components to streamline this setup, especially for companies like Pulumi that lack a physical data center, using Equinix Metal for hosting. The setup process includes several steps, such as configuring Equinix Metal and generating hardware and cluster configurations, with Pulumi components aiding in automating these tasks. Pulumi encourages users to try their example repository for implementation and offers support through their Community Slack channel.