February 2026 Summaries

Pulumi Cloud has developed a comprehensive scheduling system to manage various workflows, such as deployments, insights discovery scans, and policy evaluations, across both its own infrastructure and customer-managed environments. Initially designed for simple deployment tasks, the system evolved to accommodate more complex requirements, such as retries, failure handling, and dynamic routing, leading to the creation of the "background activity system." This system supports different execution modes—direct for Pulumi-hosted environments and remote for customer-managed setups—allowing it to function seamlessly in diverse network conditions. Instead of using off-the-shelf queue solutions, Pulumi opted to build its own system to minimize external dependencies and ensure compatibility with self-hosted installations. By employing a lease-based concurrency model, the system avoids double-execution and handles failures through lease expiration, enabling dynamic recovery without manual intervention. The architecture is designed to be extensible, ensuring that new workflow types can be integrated with full support for scheduling, retries, and observability, thus simplifying the operational complexity of distributed execution.

This detailed guide focuses on efficiently managing data-loading pipelines by encapsulating common patterns into reusable components, specifically for loading data into Snowflake using AWS services. It walks through the architecture of a direct ingestion pipeline that utilizes AWS Lambda for validating GitHub webhooks and Amazon Data Firehose to stream webhook payloads directly into Snowflake via the Snowpipe Streaming API. The guide also discusses setting up the infrastructure using Pulumi, highlighting the use of Pulumi ComponentResource for scalability and manageability, as well as using Pulumi ESC for managing dynamic credentials. By employing the DirectSnowflakeIngestion component, the setup minimizes latency and complexity by avoiding intermediate steps like S3 buffering, thereby enabling fast and reliable data ingestion. The post concludes by suggesting methods for sharing these components across teams, either through a Git-based approach or the Pulumi Cloud Private Registry, which helps in maintaining version control and facilitating cross-language usage.

Pulumi has enhanced its infrastructure as code (IaC) capabilities by introducing the onError hook, which allows users to manage failures in resource operations such as create, update, or delete. This feature is particularly useful for dealing with transient errors or situations where resources are not immediately ready, as it provides the ability to implement custom error-handling logic, such as retrying operations with backoff strategies or failing fast for specific error types. The onError hook can be programmed in various languages supported by Pulumi, including Node, Python, Go, and .NET, giving developers flexibility in handling errors according to the unique requirements of their cloud infrastructure. This development builds on last year's introduction of resource hooks, further empowering users to manage resource lifecycles more effectively and ensuring smoother and more resilient deployment processes.

Navigating the complexities of GitOps can initially seem overwhelming, akin to managing chaos in a rapidly changing environment, but with experience and the right practices, it becomes a powerful tool for managing Kubernetes at scale. Key principles of GitOps include maintaining Git as the single source of truth, favoring declarative over imperative configurations, and employing pull-based deployments for security and efficiency. Best practices suggest separating application code from deployment configurations, using directories instead of branches for environment management, and ensuring changes are validated before merging to prevent errors. Emphasizing the importance of tagging with commit SHAs over using mutable tags like "latest," the text also underscores automating drift detection and reconciliation to maintain consistency between the Git repository and the actual cluster state. Progressive delivery is recommended for safer rollouts, and policy-as-code is advocated as an automated safeguard against rule violations. Bridging Infrastructure as Code (IaC) with GitOps is crucial, using patterns like the gitops-bridge to seamlessly integrate cloud resource management with Kubernetes deployments. The text concludes by encouraging a pragmatic approach to GitOps, advising against dogmatic adherence to principles and suggesting iterative implementation of practices to address specific pain points while acknowledging that even large adopters like Intuit modify GitOps principles to suit their needs.

Many organizations that have extensively used Terraform for infrastructure management face challenges in integrating outputs like VPC IDs and database endpoints into other tools and workflows without resorting to manual methods or unstable code. The terraform-state provider for Pulumi ESC addresses this issue by enabling the direct reading of outputs from Terraform state files, making them accessible as first-class values in ESC environments without requiring scripts or duplication. Sensitive outputs are automatically secured as secrets, and the provider supports various backends, including S3 and Terraform Cloud, facilitating seamless integration with Pulumi. This allows for efficient utilization of Terraform-managed outputs in Pulumi programs, enhancing workflow integration and reducing manual intervention.

Managing database credentials in cloud infrastructure poses challenges such as secure storage, rotation, and access control, which can be mitigated through AWS IAM authentication for RDS, allowing applications to authenticate using short-lived tokens from IAM credentials instead of long-lived passwords. This approach enhances security by eliminating password rotation and integrates seamlessly with existing IAM policies. Pulumi simplifies setup by using reusable components, making IAM authentication a standard part of infrastructure. Traditional database authentication involves complexity and potential risks, while IAM authentication generates short-lived tokens on-demand, utilizing IAM policies for access control. The setup includes an RDS cluster with IAM authentication, IAM roles and policies, and a Kubernetes application connecting via IAM tokens. The process involves creating IAM-enabled database users and configuring IAM policies for database access, allowing Kubernetes applications to connect without storing AWS credentials. The authentication flow entails generating IAM tokens valid for 15 minutes, with applications generating new tokens for each connection. A demo application illustrates the setup, offering a practical example, while Pulumi's componentized approach ensures consistent and secure IAM authentication across environments.

Pulumi v3.220.0 introduces a new resource option called envVarMappings, which addresses the challenge of running multiple providers with different credentials in the same program by allowing users to remap provider environment variables to custom keys. This feature enables developers to set authentication values either as secrets in the Pulumi.yaml config or through terminal environment variables, facilitating seamless integration in CI environments without writing sensitive data to state. By allowing the remapping of environment variable keys on providers, users can now manage multiple providers targeting different accounts without the need for hard-coded environment variable names, thereby reducing the potential for noisy diffs during token rotations and enhancing flexibility in configuration management.

Platform teams now have enhanced visibility into package adoption across their organizations, allowing them to efficiently manage security advisories, deprecations, and version sprawl. Previously, users could see which stacks utilized specific packages via the "Used by" tab on individual package pages, but this method was not scalable for managing numerous packages across multiple stacks. The new organization-level view provides comprehensive adoption data for all packages, including real-time updates and the ability to filter by usage status, helping teams focus on critical packages. The package list features three usage columns—stacks on the latest version, stacks not on the latest version, and total stacks using any version—allowing for immediate visibility into package adoption. Filters for used, unused, and not on the latest packages can be combined with search functions to pinpoint packages requiring attention. Additionally, the new Registry tab in the Pulumi Cloud's Platform section offers a centralized view of both public and private packages, with the option to share specific views via URL, aiding in security responses, deprecation planning, version standardization, and adoption tracking.

Pulumi ESC environments now offer the ability to validate configuration values against JSON Schema using the new fn::validate built-in function, which ensures that any invalid configurations are immediately detected and cannot be saved until corrected. This proactive validation prevents misconfigurations from reaching deployment stages or, worse, being discovered in production. The function enables users to define validation rules within the environment, enforcing these rules at the time of saving. It works by comparing a given value against a defined JSON Schema, raising a validation error if there is a mismatch. The system also supports complex configurations by enforcing structures and required fields, and it facilitates the reuse of schemas across multiple environments, promoting consistent validation rules across teams and projects. If a value fails to conform to its schema, ESC provides a clear error message, preventing the environment from being saved until the issue is resolved. This feature is particularly useful for ensuring values meet specific type requirements, objects have necessary fields, numbers fall within valid ranges, and configurations shared across environments are consistently validated. The fn::validate function is readily available for use in all Pulumi ESC environments.

Pulumi's development of Platybot, an AI-powered analytics assistant, aimed to address the bottleneck in their #analytics Slack channel by enabling employees to query their Data Warehouse in natural language. To ensure accuracy and reliability, the team built a semantic layer using Cube before integrating AI, which allowed them to define business metrics and prevent errors common with naive AI implementations. Platybot operates as a web app, a Slack bot, and a Model Context Protocol (MCP) server, catering to various user needs from quick lookups to in-depth data analysis. The semantic layer, which organizes data into seven domains, proved crucial as it narrows AI's function to translating user intent into structured Cube queries, ensuring robust and accurate responses. Since its launch, Platybot has processed over 1,700 questions, significantly reducing the data team's workload and allowing them to focus on improving models and data quality. By offering multiple interfaces and transparent reasoning, Platybot has gained user trust and demonstrated the importance of a semantic layer over the AI model itself.

The text discusses the introduction and benefits of using "skills" in Claude Code, a language model, to enhance its coding capabilities, particularly for DevOps engineers working with Pulumi. Initially dismissed as complex prompts, skills are shown to encapsulate engineering expertise, allowing Claude to apply best practices and conventions automatically, thus bridging the gap between junior and senior level code-writing knowledge. By integrating skills, engineers can avoid repetitive corrections and improve the quality of infrastructure code, as skills teach Claude to follow patterns that prevent common mistakes. The text also highlights the distinction between skills and MCPs (Managed Code Processes), emphasizing that skills teach judgment while MCPs provide access to resources. Skills are portable, adhere to an open standard, and can be used across various platforms, offering significant advantages such as improved infrastructure management, security, monitoring, and incident response. However, the text warns of potential security risks when installing skills and suggests vetting them carefully before use.

Neo, an AI coding tool, now supports AGENTS.md files, an open standard designed to communicate project-specific conventions to AI tools, thereby aligning them with human developers' practices. AGENTS.md addresses the gap left by linters and formatters by capturing unique coding conventions such as naming patterns, test structures, and command sequences, which are typically conveyed to new team members. By committing an AGENTS.md file to a repository, teams can ensure consistent adherence to these conventions across various AI tools that support the format, including Cursor, Windsurf, GitHub Copilot, and Zed. Neo, upon accessing a repository, reads the AGENTS.md file and automatically integrates its instructions, allowing for seamless project-specific adaptations. The format, governed by the Agentic AI Foundation under the Linux Foundation, is already adopted in over 60,000 open-source projects, facilitating consistent coding practices with minimal additional configuration.

Pulumi has announced that its Cloud REST API is now described by an OpenAPI 3.0 specification, marking a significant enhancement in API management and integration. This transition to a single, machine-readable contract offers improved tooling, integration, and predictability, as the API code is now built from this specification. Users can fetch the specification directly from the API for purposes like client generation, validation, and documentation, ensuring a consistent and up-to-date API experience. The OpenAPI 3.0.3 document serves as the source of truth, automatically generated to reflect any changes in the API routes or models, thus maintaining stability and accuracy. This initiative is set to enhance Pulumi’s toolchain, including plans to synchronize the Pulumi CLI's API client with the OpenAPI spec and to update the Pulumi Service Provider and public REST API documentation in line with the specification. Pulumi encourages feedback and engagement through their Community Slack or GitHub repository as they continue to develop and refine their API offerings.

Neo has introduced a new task-sharing feature that allows users to share a read-only view of any Neo task within their organization, maintaining full context and security. Previously, users had to describe or screenshot conversations to seek input from teammates, but now they can generate a shareable link, which provides the complete context, including the original prompt, Neo's reasoning, actions taken, and outcomes. This feature preserves the original system's strict role-based access control (RBAC), ensuring that viewers can see conversations but cannot initiate actions, and any linked resources still respect existing permissions. This enhancement facilitates collaboration by allowing users to easily share tasks for feedback or demonstration without compromising security or detail.