October 2025 Summaries

Platform teams utilizing the Pulumi Private Registry now benefit from enhanced visibility into component usage, addressing the challenge of tracking which teams have adopted new versions. This visibility is crucial for managing security vulnerabilities, planning deprecations, and controlling version sprawl. The registry's new usage tracking feature allows teams to see which stacks are using specific components, the versions in use, and the last update time, all accessible through the "Used By" tab, respecting existing access controls. This centralized insight transforms previously slow and cumbersome conversations by enabling quick identification of affected stacks in security incidents, coordinating deprecation timelines, and understanding version distribution across the organization. The registry serves not only as a distribution hub but also as a source of truth for component usage, encouraging teams to publish components and leverage these insights for improved management.

Pulumi Neo is a specialized AI tool designed to manage and optimize infrastructure by being deeply integrated with an organization's specific infrastructure context, unlike generic large language models (LLMs) that offer broad advice based on internet patterns. Neo is trained on the actual state of an infrastructure, including programs, resource relationships, and deployment history, allowing it to generate precise fix plans and explanations grounded in reality rather than assumptions. This capability stems from its use of a "context lake," a structured repository that aggregates domain-specific knowledge, which enables Neo to understand and reason about infrastructure more effectively than traditional AI tools. While Neo enhances decision-making and observability in DevOps by automating the understanding of infrastructure states and dependencies, it complements rather than replaces human engineering judgment, creating a more efficient feedback loop between human expertise and AI understanding. This approach allows engineers to focus more on strategic reasoning and less on repetitive configuration tasks, thereby changing the nature of engineering work in the DevOps landscape.

Infrastructure drift detection and remediation are crucial components of maintaining alignment between actual infrastructure and its intended configuration, especially in the dynamic, post-deployment phase known as day 2 operations. Despite robust preventative measures like code reviews, automated testing, and policy as code, real-world operations often necessitate emergency changes that bypass these controls, leading to drift. Pulumi offers a comprehensive workflow for managing drift, involving a three-step process of detection, reconciliation, and remediation using commands like `pulumi refresh` and `pulumi up`. By automating drift detection, teams can transform infrastructure management from a reactive to a proactive process, improving security, reducing costs by catching orphaned resources, and enhancing operational efficiency. This approach not only aids in swiftly resolving incidents and maintaining compliance but also empowers teams to scale operations effectively without increasing headcount, thus providing a competitive advantage in managing complex infrastructure environments.

Neo has been significantly enhanced with three major updates: Operating Modes, full ecosystem tool access, and the integration of Claude Sonnet 4.5, which improve its performance on complex infrastructure tasks. The new Operating Modes offer flexible control over tasks, allowing users to choose between Review Mode for full oversight, Balanced Mode for controlled approval of significant changes, and Auto Mode for speed and trust in outcomes. Neo now also has expanded access to the Pulumi CLI and includes essential ecosystem tools such as kubectl, Helm, AWS CLI, GCP, and Oracle Cloud CLI, enabling it to manage Kubernetes deployments, cloud-specific operations, and more without leaving the workflow. Additionally, Neo can search private registries to leverage existing team components, and it now operates on Anthropic’s Sonnet 4.5, enhancing its ability to handle complex, multi-step tasks. These updates aim to provide users with greater autonomy, efficiency, and integration within their infrastructure management workflows.

Pulumi ESC (Environments, Secrets, and Configuration) enhances infrastructure and application management by offering centralized secrets management and configuration orchestration, featuring a newly redesigned onboarding experience and automated setup as an OpenID Connect (OIDC) provider. This update simplifies the process of managing configurations for Pulumi programs and handling secret rotation, while also centralizing secrets across multiple providers. Pulumi ESC can issue short-lived, signed tokens for temporary cloud credentials, improving security by eliminating the need for hard-coded credentials. The onboarding now includes an automated OIDC setup for AWS, Azure, and Google Cloud, allowing users to log in with cloud credentials and let Pulumi Cloud manage the setup process, streamlining the creation of ESC environments. This initiative is part of ongoing efforts to simplify the setup and onboarding process, making it easier for teams to configure, secure, and manage environments effectively.

Pulumi ESC has introduced a new feature called Open Approvals, aimed at enhancing governance and security by requiring review and sign-off before an environment is activated or exposed, thus preventing accidental exposure of sensitive data or systems. This feature builds on the previous Approvals for updates, allowing organizations to implement Just in Time (JIT) access control and more robust guardrails for environment activation. Users can configure approval requirements, such as the number of required reviewers and whether self-approval is allowed, through the Approval Rulesets in the settings. Open Approvals ensures that every environment activation is intentional and governed, aligning with Pulumi ESC's mission to maintain compliance and security without hindering team efficiency. The feature also supports creating open requests via the CLI, offering flexibility in how access is managed and approved.

The Pulumi Remote MCP Server is a newly launched hosted service designed to integrate AI-assisted infrastructure management with any AI assistant supporting the Model Context Protocol, enabling seamless connection to Pulumi Cloud infrastructure. It provides universal access without the need for local installations, allowing users to manage and automate complex infrastructure tasks effortlessly. By centralizing authentication and credential management through OAuth-based protocols, it enhances security and simplifies setup. This remote server offers real-time access to cloud resources and facilitates autonomous infrastructure automation through Pulumi Neo, an AI agent that generates infrastructure code, tests changes, and manages pull requests autonomously. Its features include exploring deployed resources, querying infrastructure, and ensuring policy compliance, all while reducing local resource consumption and maintaining human oversight for critical changes.

Pulumi Neo, a recently launched AI tool, is being creatively utilized by platform teams to streamline infrastructure management and enhance efficiency. It enables users to execute various tasks, such as explaining infrastructure in layman's terms or diagrams, generating infrastructure code from natural language, and assisting in the migration from Terraform to Pulumi. Neo automates the creation of CI/CD pipelines, identifies inefficient infrastructure patterns, manages Kubernetes upgrades, and responds to security vulnerabilities. It also remediates policy violations, updates Lambda runtimes across multiple accounts, and enforces multi-account policy compliance. By deeply understanding infrastructure, Neo reduces manual operational efforts, allowing teams to focus on strategic architecture and policy development, thus balancing speed and safety in platform engineering.