January 2023 Summaries

Introducing infrastructure as code (IaC) with Pulumi into organizations that have manually created cloud resources can significantly streamline and modernize their cloud management processes, even if they have already deployed extensive production workloads. Pulumi offers a compelling solution by allowing these resources to be brought under management with minimal effort while providing substantial benefits such as version control, automation, and enhanced security. The pulumi import command facilitates this transition by importing manually created resources into Pulumi's management framework, allowing for batch imports via specially formatted JSON files. This approach not only simplifies infrastructure management but also enables automated quality assurance, drift detection, and correction, making it possible to move away from the slow and error-prone practice of manual management. Pulumi further enhances this process by supporting various backends for state and secrets management and offering integrations with CI/CD pipelines to ensure consistent and compliant infrastructure deployment. This transition to IaC, even for organizations with legacy resources, is made seamless by Pulumi's tools and capabilities, emphasizing that it's never too late to adopt a code-centric approach to managing cloud infrastructure.

Over the past six months, Pulumi's Platform Team has been working on a project called "Amazing Performance" to enhance the throughput and latency of the Pulumi CLI for all users. This initiative involved identifying both significant and minor improvements, with a detailed tracking issue on GitHub. The blog post introduces the tools developed for performance monitoring, such as an analytics dashboard with benchmarks and OpenTracing support, which help identify performance bottlenecks and set service-level objectives (SLOs). Two quick performance wins are highlighted: dynamically importing TypeScript only when necessary, reducing boot time by 300ms, and optimizing lease renewal for the Service backend, saving an additional 120ms. These adjustments aim to make the Pulumi CLI more responsive and efficient, with further posts in the series promising to detail more significant performance advancements.

The updated Pulumi Provider Boilerplate, now incorporating the new Pulumi Go Provider SDK, simplifies the implementation of custom providers by reducing the complexity involved in defining a provider's schema, CRUD operations, and SDK code generation. This update does not affect existing providers using older versions of the repository. The streamlined process allows developers to focus on defining provider metadata, resources, and functions in Go, with the Pulumi CLI handling SDK code generation through a single command. The boilerplate provides a concise entry point and detailed resource implementation examples, emphasizing the ease of the new authoring experience, which is expected to appeal even to those who previously found provider creation challenging. Additionally, an example of a command provider rewritten using the Pulumi Go Provider library demonstrates the improvements and is available for comparison on GitHub.

.NET support for custom resource providers has been introduced in a preview release, allowing developers to create custom providers using .NET languages such as C#, F#, and VB.NET. This initial release is feature complete but comes with minimal documentation, as the team seeks early feedback to improve the API before a production-quality release. To access the new APIs, developers need to use version 3.52.0, which can be added to projects via the .NET package manager. An example of the provider interface is available in the dotnet integration tests directory, replacing the previous Go-based test provider. Developers are encouraged to provide feedback and engage in discussions on GitHub or the Community Slack's #dotnet channel.

Pulumi has introduced an integration with OpenID Connect (OIDC) for its Deployments, enhancing security by allowing the use of temporary credentials and enabling granular access controls. This integration, requested by a GitHub user, builds on the OAuth 2.0 framework and uses JSON web tokens (JWTs) to verify user identity and obtain profile information. The key benefits include the ability to generate temporary credentials for each deployment, reducing the need to store sensitive credentials and enabling scoped access based on specific deployment parameters. Pulumi Deployments can automatically exchange OIDC tokens for temporary credentials with major cloud providers like AWS, Azure, and GCP, allowing for more secure and principle-based access management. Users can also manually exchange tokens for credentials with other cloud providers. To utilize features like Git Push to Deploy, users must enable OIDC in the Pulumi Console, which requires administrative access. Pulumi Deployments is currently available in preview, with free access during this period and usage-based pricing expected in the future.