January 2026 Summaries

AI coding assistants have revolutionized software development, including infrastructure code, but often lack nuances in handling production-ready infrastructure. Neo offers Pulumi expertise combined with organizational context and deployment governance, and to enhance AI assistant capabilities, Pulumi Agent Skills have been introduced. These structured knowledge packages, compatible with multiple AI platforms like GitHub Copilot and Claude Code, provide detailed workflows and decision trees for infrastructure tasks. Skills are organized into migration and authoring plugin groups; migration skills facilitate transitions from tools like Terraform and CloudFormation to Pulumi, while authoring skills focus on code quality and reusability. Users can install these skills through various platforms, allowing assistants to offer more informed and contextual assistance in Pulumi-related tasks. Contributions to expand this skillset are encouraged, and the skills are available on GitHub for installation in various AI coding environments.

Pulumi Cloud v0.34.0, a service provider for Pulumi, is currently in preview and was published on January 23, 2026. It allows users to provision resources within Pulumi Cloud and requires configuration with credentials for deploying and updating resources. The documentation provides an example of how to create a webhook using Pulumi's various SDKs, including JavaScript, Python, Go, C#, and Java. The example demonstrates creating a webhook with attributes like active status, display name, organization name, and payload URL across different programming languages.

Clawdbot, an open-source AI assistant developed by Peter Steinberger, has rapidly gained popularity, amassing 9,000 GitHub stars in a day and prompting a surge in Mac Mini purchases by developers wanting to host it. Unlike cloud-hosted AI, Clawdbot runs on personal infrastructure such as a Mac Mini, Raspberry Pi, VPS, or laptop, and connects with various messaging platforms like WhatsApp and Slack, offering capabilities such as browser control and voice cloning. The setup guide emphasizes using infrastructure as code with Pulumi for deployment on AWS or Hetzner Cloud, with Tailscale ensuring secure, private access by creating a mesh VPN. The guide provides detailed instructions on deploying and managing Clawdbot, including handling sensitive credentials with Pulumi ESC and securing the setup with Tailscale. The document highlights the advantages of Hetzner Cloud's lower costs compared to AWS for hosting Clawdbot, while also stressing the importance of security to prevent unauthorized access to gateways.

Pulumi has introduced new resources in the Pulumi Service Provider to enhance cloud visibility and governance, addressing the common challenge organizations face in maintaining visibility across their cloud environments. These resources allow users to discover all cloud resources, enforce governance policies programmatically using infrastructure as code, and manage cloud infrastructure through automated governance workflows, enabling integration with GitOps and CI/CD. The new features include InsightsAccount for automated scanning and resource discovery across multiple cloud environments such as AWS, Azure, GCP, Kubernetes, and OCI, as well as PolicyGroup for organizing resources and applying compliance policies at scale. Users can configure policy groups in audit or preventative mode to either report or block policy violations, respectively. Additionally, the service includes data sources like getPolicyPacks and getPolicyPack to query available policy packs, supporting enhanced policy management and compliance across cloud accounts and Pulumi stacks.

In January 2026, the AI assistant previously known as Clawdbot was rebranded as Moltbot due to trademark issues, quickly gaining popularity with developers who likened it to the advanced assistant Siri promised to be. With a surge in demand, enthusiasts rushed to purchase hardware like Mac Minis, although Moltbot can run on various platforms, including VPS, laptops, and gaming PCs. To deploy Moltbot, users are guided to use Pulumi for infrastructure as code, ensuring easy replication and management across AWS or Hetzner Cloud. The guide emphasizes security, recommending Tailscale for a secure VPN setup to prevent exposure to the public internet and to manage sensitive data like API keys securely. Moltbot, created by Peter Steinberger, operates on user infrastructure, integrates with multiple messaging platforms, and can execute scheduled tasks while maintaining local conversation histories. Security considerations are crucial, with suggestions to use Tailscale and Pulumi ESC for managing secrets to minimize vulnerabilities. The guide offers a detailed walkthrough for deploying Moltbot on both AWS and Hetzner, highlighting cost comparisons, setup instructions, and security measures to ensure a private and robust deployment.

OpenClaw, an open-source AI assistant developed by Peter Steinberger, has gained significant traction with its ability to run on personal infrastructure, bypassing cloud-hosted options like Anthropic. Celebrated for its versatility, OpenClaw can operate on various devices from Mac Minis to Raspberry Pis, enabling users to manage tasks such as browser control, video generation, and messaging on platforms like Slack and WhatsApp. The assistant's growing popularity has led to a surge in dedicated hardware purchases, despite its ability to run on existing systems like VPS or laptops. OpenClaw's deployment can be optimized using Pulumi for infrastructure as code, with Tailscale ensuring secure, private access. This setup provides a robust framework for deploying OpenClaw on AWS or Hetzner Cloud, with Hetzner offering a cost-effective, ARM-based alternative for European data residency. The emphasis on security is paramount, with Tailscale's VPN reducing the risk of exposed ports and unauthorized access, thereby protecting sensitive credentials stored in Pulumi ESC.

Pulumi Infrastructure as Code (IaC) offers a declarative interface for managing updates, calculating the differences between current and proposed infrastructures to deploy only necessary changes. While this minimizes unnecessary work, Pulumi has introduced features like the replaceWith option and replacement triggers for more granular control. Replacement triggers allow users to specify conditions under which resources should be replaced, even if no other changes have occurred, by attaching metadata to resources. This is particularly useful for scenarios like cycling private keys monthly or replacing resources when an external version number changes. By representing conditions as date strings, Pulumi can automate replacements, reducing manual intervention and minimizing errors. This feature, supported across all Pulumi SDKs from version 3.215.0, simplifies complex maintenance tasks and enhances infrastructure management efficiency.

Neo offers a seamless solution for migrating existing infrastructure to Pulumi from tools like AWS CDK, Terraform, and Azure ARM templates, overcoming the traditional barriers associated with Infrastructure as Code (IaC) migrations. By leveraging the state knowledge of the source tools, Neo ensures automated, zero-downtime transitions without altering existing resources, thus maintaining continuous operation and eliminating risks. The process involves understanding the intricate mappings between logical and physical resource identities and handling complex dependencies, enabling precise and error-free migrations. Neo's architecture adapts to the unique characteristics of each IaC tool while providing a consistent migration experience that includes state conversion, code transformation, and comprehensive audit trails. This approach offers teams the flexibility to adopt Pulumi's modern platform without the disruptions typically associated with switching IaC tools, guaranteeing zero downtime, zero risk, and zero surprises during the migration process.

The text discusses the transition from using Playwright MCP to Vercel's agent-browser for AI-driven browser automation, highlighting the significance of browser automation in verifying AI-generated frontends. It emphasizes that with agent-browser, AI agents can autonomously validate their work by interacting with web components, significantly reducing the need for manual verification. The text contrasts the token-heavy output of Playwright MCP, which can overwhelm context windows, with the efficient, less verbose approach of agent-browser, which employs a snapshot and reference system for element interaction. This streamlined method reduces context usage by up to 82.5%, allowing more tests within the same context budget. Vercel's "less is more" philosophy, as applied to their D0 text-to-SQL agent, is mirrored in agent-browser's design, which simplifies interaction without verbose output, allowing AI agents to think more freely and execute tasks faster. The text concludes by suggesting that agent-browser is ideal for longer autonomous sessions with limited context budgets, while Playwright MCP remains preferable for complex browser automation tasks requiring advanced features like network interception and multi-tab workflows.

Pulumi ESC is a centralized solution within Pulumi Cloud for managing secrets and configuration across various vaults and cloud providers, promoting modern security practices like short-lived credentials with OIDC and automated secret rotation. It integrates with multiple cloud providers and secret managers, offering features such as composable environments and built-in functions, which range from value transformations to encoding files as Base64. The newly introduced Pulumi ESC Web Editor enhances usability by providing a unified editor experience that allows users to manage their configurations through various means, including CLI commands, a VS Code extension, and the Pulumi Cloud Console. Key improvements include a new Inspect tab for editing secrets and gaining insights into configurations, the ability to switch seamlessly between writing YAML and using UI elements, and features that simplify adding secrets, using providers and functions, and exporting configurations. The editor aims to combine the power of a YAML editor with the user-friendly nature of UI controls, offering a more intuitive and efficient way to manage secrets and configurations.

The article explores an innovative technique called "Ralph Wiggum," developed by Geoffrey Huntley, which involves continuously feeding prompts to AI coding assistants like Claude to automate infrastructure development tasks without requiring constant supervision. Named after the persistent character from The Simpsons, this technique allows Claude to iterate on tasks until completion by repeatedly providing it with the same instructions, thereby overcoming the common issue of AI assistants prematurely halting. The approach, which uses a simple bash loop, is particularly effective for infrastructure as code projects because of their clear success criteria, making tools like Pulumi an ideal match due to their objective feedback mechanisms. The experiment described involves building a serverless URL shortener on AWS, demonstrating how the Ralph loop enables autonomous AI development while emphasizing the importance of specific prompts, iteration limits, and testing. While this method shows potential for certain scenarios, it is not recommended for production environments or tasks involving sensitive data. The technique is compared to Pulumi Neo, which offers similar capabilities within Pulumi Cloud, highlighting an emerging trend in how developers might leverage AI for infrastructure tasks.

Pulumi has introduced Identity and Access Management (IAM) for self-hosted instances of Pulumi Cloud, extending the same enterprise-grade access management capabilities previously available in their SaaS offering to organizations managing their own infrastructure. This enhancement allows self-hosted customers to implement Zero Trust security principles and least privilege access controls through features like Custom Roles and Granular Access Tokens tailored to specific organizational needs. The update is particularly beneficial for self-hosted deployments with stringent security and compliance requirements, enabling precise, auditable control over programmatic access and reducing operational risks associated with compromised credentials. Users can navigate the familiar Pulumi Cloud interface to configure these IAM features, and detailed guides are available to assist with implementation. Pulumi continues to focus on providing robust security features across all deployment environments, inviting feedback through account representatives or their GitHub repository.

Deploying applications in Kubernetes using canary strategies with Argo Rollouts presents challenges due to the lack of native ConfigMap revision support, which can cause older pods to fail when ConfigMaps are deleted during updates. This issue is exacerbated on platforms like AWS Spot instances, where pods may be replaced unexpectedly. A solution was developed using Pulumi's ConfigMapPatch and Kubernetes owner references to implement a custom ConfigMap revision system. By leveraging Kubernetes' garbage collection and ReplicaSet owner references, this system ties ConfigMaps to ReplicaSets, enabling automatic cleanup and providing revision-like behavior. This approach ensures that older ConfigMaps remain accessible during canary deployments, enhancing resilience and minimizing the need for manual intervention. The solution is particularly beneficial for managing ConfigMap lifecycles in environments that require reliable configuration availability during deployment transitions.

Pulumi introduces the Stash resource, a built-in feature designed to store and preserve arbitrary values in a stack's state, making it easier to maintain consistency across deployments. This is particularly useful for scenarios such as capturing a random identifier, recording the initial deployer's identity, or saving timestamps from first deployments, without resorting to external storage or complex state manipulations. Stash takes an input value and retains it as an output property, ensuring the original value remains unchanged even if inputs are modified in future deployments. It supports multiple value types, respects secret annotations for encryption, and facilitates replacement when updates are necessary through options like the --target-replace flag, pulumi state taint command, or the replacementTrigger resource option. Available in Pulumi v3.208.0 and later, Stash supports various programming languages, and the Pulumi team invites feedback and use cases from users in their community.

Pulumi has introduced a journaling feature aimed at significantly enhancing the speed of cloud infrastructure operations by up to 20 times while maintaining data integrity. Traditionally, Pulumi operations involved creating and storing snapshots of the cloud infrastructure state, a process that was both resource-intensive and slow due to serialized uploads, especially for large stacks. The new journaling method circumvents this by sending incremental changes, or journal entries, to the backend, allowing for faster and parallel processing without compromising data integrity. Benchmarks demonstrated substantial time reductions in setting up complex infrastructure, exemplified by AWS and Pulumi app setups. This performance boost is presently accessible behind a feature flag, with Pulumi users invited to test by enabling the PULUMI_ENABLE_JOURNALING environment variable. The feature is expected to roll out broadly by January, marking a step towards optimizing Pulumi's default operational efficiency.

The impending retirement of ingress-nginx in early 2026 presents an opportunity for infrastructure teams to transition to the Gateway API, a more modern and standardized approach to traffic management. Unlike the Ingress API, which relied heavily on controller-specific annotations, the Gateway API offers a consistent and expressive framework that aligns with contemporary traffic patterns and organizational workflows. The Gateway API's role-oriented structure allows different teams to manage routing logic more independently, enhancing self-service capabilities. This transition is critical as ingress-nginx will no longer receive updates or support, primarily due to resource constraints and technical debt. The Gateway API supports advanced routing requirements and integrates with various protocols, addressing the limitations of its predecessor. Among the various implementations, kgateway stands out for its maturity and ability to efficiently handle both traditional microservices and AI traffic, making it a strong candidate for production workloads. While organizations can temporarily rely on Chainguard's maintained fork of ingress-nginx, the long-term solution lies in adopting the Gateway API to build a resilient and scalable networking foundation for future infrastructure challenges.