November 2025 Summaries

The integration of the Pulumi Kubernetes Operator (PKO) with Kargo, a continuous promotion platform, offers a structured approach to managing infrastructure changes across multiple environments. By combining PKO, Kargo, and Argo CD, users gain enhanced change management capabilities such as controlled release timing, deployment visualization, automatic verification of changes, approval gates for human review, and comprehensive change tracking. Kargo facilitates the movement of infrastructure code through distinct lifecycle stages by packaging artifacts as "freight" and promoting them systematically. It ensures that infrastructure changes undergo rigorous processes, including previews, deployments, and verification steps, before promotion to the next stage. This setup reduces the risks associated with manual deployments and provides a transparent audit trail, making it particularly beneficial for teams overseeing complex, multi-environment infrastructures. Through automation and well-defined roles and policies, organizations can achieve greater consistency and reliability in their infrastructure rollout processes.

Pulumi has released version 2.3.0 of its Kubernetes Operator, introducing significant features that enhance GitOps workflows, namely the preview mode and structured configuration support. Preview mode allows users to validate infrastructure changes in a dry-run fashion before deployment, facilitating safer and more sophisticated management patterns, such as what-if analyses and branch validations. The structured configuration feature supports complex data types like objects and arrays, previously limited to string values, allowing for richer configuration management. This update addresses longstanding community requests while maintaining full backwards compatibility and includes several bug fixes to improve operational reliability. The release requires updates to Custom Resource Definitions (CRDs) for users employing Helm, with guidance provided for seamless upgrading, and emphasizes the need for Pulumi CLI version 3.202.0 or later to fully utilize structured configuration support.

Pulumi v3.208.0 introduces the ability to configure all CLI flags as environment variables, streamlining the process of using consistent CLI options across teams and alleviating the need to remember repetitive flags for multiple commands. This feature is especially beneficial in scenarios such as refreshing state before operations or skipping prompts in CI environments by using environment variables instead of flags. Users can set these variables by prefixing the flag name with PULUMI_OPTION_ and replacing dashes with underscores, with the environment variable taking precedence over command line flags. This enhancement is particularly useful when combined with direnv, allowing project-specific defaults to be set in a .envrc file for automatic application within a directory. This development aims to simplify configuration and management of operation defaults across various environments and invites users to provide feedback through GitHub, X, or Community Slack.

Tags are crucial for cloud governance in AWS, enabling essential functions like cost allocation and compliance reporting, yet they often present challenges due to inconsistency or absence. To address this, a new AWS Organizations Tag Policies policy pack has been introduced in collaboration with AWS, which integrates with Pulumi to enforce tag requirements consistently. This pack validates infrastructure against predefined tag policies, preventing deployments with missing tags by shifting governance earlier into the development workflow. Users can start in advisory mode to identify tagging issues without blocking deployments and then switch to mandatory mode to enforce compliance. The policy pack works with both AWS Classic and AWS Native Pulumi providers and simplifies governance by eliminating the need for separate policy configurations or custom code, ensuring all resources meet tagging requirements.

Kubernetes is evolving to support AI and ML systems across various environments, with increasing demands on DevOps engineers, SREs, and cloud teams to deliver scalable and secure infrastructure. By 2026, Kubernetes automation will leverage infrastructure as code, policy enforcement, and AI-driven orchestration to intelligently manage cloud environments. Pulumi's advancements, including the Pulumi Kubernetes Operator 2.0 and Pulumi Neo, provide a foundation for this new era by incorporating general-purpose programming languages and AI-assisted infrastructure management. As Kubernetes becomes a foundational technology for intelligent systems, Pulumi offers a unified platform that brings automation, security, and developer productivity together, enabling teams to manage complex systems efficiently. This transformation allows for AI-driven, context-aware, and self-healing infrastructure, with Pulumi Neo interpreting natural language requests to generate production-ready code. The platform supports multi-cloud environments and integrates with GitOps, providing consistent provisioning and policy enforcement while reducing reliance on static YAML files. Pulumi's approach unifies infrastructure as code, secrets management, policy governance, and AI automation, ensuring that Kubernetes remains a scalable and reliable control plane for modern cloud infrastructure.

Pulumi has introduced a new suite of pre-built compliance policy packs designed to streamline the process of achieving compliance with industry standards such as CIS Controls v8.1, NIST SP 800-53 Rev. 5, and PCI DSS v4.0. These packs aim to accelerate the compliance journey by allowing organizations to enforce security and compliance baselines across cloud infrastructures quickly, moving away from the traditional, time-consuming manual processes. The packs are integrated into an end-to-end governance lifecycle that includes auditing, remediation, and prevention of non-compliance, all managed through Pulumi's cloud operations. By scanning cloud resources and automatically generating fixes for compliance violations, Pulumi's policy packs help maintain a secure cloud environment. Authored and maintained by Pulumi experts, the packs provide a comprehensive toolkit for cloud governance, offering extensive coverage for widely adopted security frameworks and enabling organizations to proactively reduce risk by preventing non-compliant resources from being created.

Pulumi Cloud's Policy Findings hub addresses the challenge of overwhelming policy alerts by providing a structured, collaborative workspace that transforms these alerts into manageable tasks. It offers three distinct views tailored to different stakeholders: an Overview tab for leadership to assess overall compliance health and make data-driven decisions, a Compliance tab for auditors and infosec members to view findings in the context of specific security controls, and an Issues tab for platform and development teams to prioritize and manage issues. This hub integrates Pulumi Neo, an AI agent, to automate the remediation process by generating pull requests for code changes, thereby simplifying the resolution workflow and helping teams manage compliance more effectively. The system aims to reduce alert fatigue and facilitate continuous compliance through clear accountability and automated solutions, and is available for users to explore and implement in their cloud infrastructure management.

The rapid pace of AI-driven development has highlighted a governance challenge, where existing tools focus on detection but not on scalable remediation of policy violations. Pulumi addresses this with its next-generation governance solution, which introduces AI-powered remediation to bridge the gap between identifying and fixing issues. The solution includes a Policy Findings Hub for comprehensive visibility and Pulumi Neo to automate remediation, transforming unmanaged infrastructure into compliant code. It also emphasizes maintaining compliance with "Policy as Real Code," using general-purpose languages to establish guardrails that oversee both human and AI activities. This approach enables organizations to maintain development speed while ensuring security, turning governance from a constraint into a catalyst for innovation.

Audit Policy Scans for Pulumi Stacks introduces a new way to maintain continuous compliance monitoring by evaluating the last successful deployment state of infrastructure as code (IaC) stacks without interfering with existing CI/CD workflows. This feature complements existing audit scans for live cloud environments, offering a holistic view of security postures by identifying unmanaged resources and configuration drifts. The new evaluation mode facilitates frictionless policy rollouts by providing an instant compliance baseline for all managed infrastructure, thus enabling organizations to adopt policies at scale and enhance developer efficiency. By decoupling policy evaluation from deployment, the solution accelerates policy rollouts and ensures that the latest policies are continuously evaluated against the deployed infrastructure. Users can initiate these audit scans by adding IaC stacks to an Audit Policy Group in the Pulumi Cloud console, automatically triggering post-deployment evaluations reflected in a unified Policy Findings hub. This comprehensive governance approach offers a 360-degree view of cloud environments, balancing the need for rigorous compliance with the efficiency of the development process.

Pulumi has introduced a deletion protection setting for ESC environments to prevent accidental deletion, safeguarding configurations that support production workloads or are shared across multiple stacks. This feature ensures that any attempt to delete a protected environment is blocked unless the protection is explicitly disabled, applying to both the Pulumi Cloud console and the ESC CLI. Protected environments are marked with a shield icon, which links to the deletion protection settings, and only environment admins can modify these settings to ensure authorization. The functionality is beneficial for production environments, those shared across teams, or any containing critical configurations. Users can manage deletion protection via the Pulumi Cloud console or the ESC CLI, and the feature is available immediately for all ESC environments.