April 2026 Summaries

Pulumi Neo introduces the Integration Catalog, a centralized hub designed to connect Neo with various tools commonly used by infrastructure teams, enhancing context management across platforms. At launch, the catalog features six integrations—Atlassian, Datadog, Honeycomb, Linear, PagerDuty, and Supabase—each utilizing the Model Context Protocol (MCP) to communicate with Neo. This setup allows Neo to aggregate data from these tools, facilitating streamlined workflows and enabling users to manage tasks like investigating latency spikes without switching between applications. Admins can configure credentials once, making the integrations readily available to teams without individual setups, while maintaining security through encrypted credentials. Future enhancements include CLI access, OAuth integrations, and per-integration access controls to tailor the tool's use to specific team needs. The catalog is available now, with ongoing development guided by user feedback.

Pulumi policy packs, which enforce rules across infrastructure, can now integrate with Pulumi ESC environments to manage centralized secrets and configuration, enhancing security and operational efficiency. Previously, credentials and environment-specific configurations had to be hardcoded or managed separately, posing security risks and operational burdens. With the new capability, policy packs can access environment-specific thresholds, API tokens, and other sensitive values at runtime, allowing for dynamic and environment-specific policy enforcement. This integration facilitates centralized credential rotation, role-based access controls, and audit trails, enabling differentiated configurations for various environments, such as staging and production. This advancement simplifies the management of policies that require external credentials or varied configurations, ensuring secure and efficient compliance and access control across different operational environments.

AI agents are becoming increasingly prevalent in enterprises, with 96% of companies running them in production, yet only 12% have a centralized management system, posing significant security challenges. Platform teams face the challenge of allowing developers to deploy these agents quickly while maintaining control and coherence of the infrastructure. As the proliferation of AI agents mirrors past sprawl issues like "Secrets Sprawl," the solution lies in integrating these AI agents into existing infrastructure-as-code (IaC) frameworks, which provide the necessary governance, audit trails, policy enforcement, and human oversight. By leveraging tools like Pulumi, platform engineers can ensure that AI agents inherit the same guardrails and governance structures as human-induced changes, thus maintaining security and compliance while enabling developers to work efficiently. This approach allows enterprises to harness the benefits of AI agents without compromising on security, governance, or operational control.

The Pulumi Cloud REST API reference now automatically syncs with the live OpenAPI specification, ensuring documentation accuracy and consistency with the API's functionalities. Previously, the API reference was manually maintained, leading to discrepancies that could confuse users and cause issues for AI agents interacting with the API. The updated system generates the reference from the OpenAPI spec at build time, reflecting any API changes instantly. This advancement enhances reliability for AI agents, improves user navigation with endpoints grouped by product area, and facilitates seamless interaction with linked response definitions. Despite the transition to a generated format, the reference maintains the same URL, ensuring continuity for existing bookmarks and links while accepting input for improvements through community feedback.

Pulumi Cloud has introduced first-class integration with Bitbucket Cloud, joining its existing support for GitHub, GitLab, and Azure DevOps, allowing users to deploy infrastructure automatically without the need for an external CI/CD pipeline. This integration enables the automatic deployment of infrastructure when changes are pushed to a configured branch, with features like path filters, environment variable management, and secrets handling directly in Pulumi Cloud. It also offers infrastructure previews for every pull request and AI-generated change summaries that simplify the review process. Users can connect their Bitbucket repositories through two authentication methods: Personal OAuth for all plans or workspace tokens for Premium plans, both of which automatically register webhooks. Additionally, a new project wizard streamlines the process of scaffolding and deploying new stacks, either by creating new repositories or using existing ones, directly within Pulumi Cloud. Organization admins can configure this integration under Management > Version Control, with more detailed setup instructions available in the Bitbucket integration documentation.

Pulumi Insights has expanded its account scanning capabilities to support all AWS partitions, including GovCloud, China, the European Sovereign Cloud, and various ISO intelligence-community clouds, providing these regions with the same resource discovery, cross-account search, and AI-assisted insights available to commercial accounts. Users can exclude specific regions from discovery, which is beneficial when certain regions are disabled by Service Control Policies (SCPs) or are outside an audit's scope. The discovery process is confined within each partition, with credential exchanges and API calls targeting the partition's regional endpoints to ensure that discovery traffic remains within the boundary. To set up, users must create an account in the Pulumi Cloud console, select AWS as the provider, choose the target partition, and provide credentials via a Pulumi ESC environment, with the OIDC trust policy adapting to the partition-specific ARN prefix.

Three community frameworks—Superpowers, GSD, and GSTACK—address the common pitfalls faced by AI coding agents in real projects by enforcing specific development disciplines and governance models. Superpowers, developed by Jesse Vincent, focuses on test-driven development (TDD) to ensure that no production code is written without a failing test, using a strict seven-phase workflow to guide the process. GSD, created by Lex Christopherson, aims to prevent context rot by using phase-based orchestration, ensuring each phase has a fresh context window, and employing XML-formatted instructions to maintain clarity. GSTACK, initiated by Garry Tan, models a 23-person team to provide role-based governance, ensuring each specialist focuses on their domain, minimizing scope creep, and enhancing product strategy through multi-perspective review. While Superpowers is optimal for solo developers needing test discipline, GSD excels in managing complex, multi-session projects, and GSTACK is best suited for projects with substantial product dimensions. These frameworks, compatible with various AI agents like Claude Code and Codex, complement skills from Pulumi Agent Skills to enhance AI agent orchestration in infrastructure and application development.

Pulumi has expanded its support for Bun, a JavaScript runtime that acts as an all-in-one toolkit, by making it a fully supported runtime for Pulumi programs, allowing developers to run TypeScript projects without Node.js. Bun offers native TypeScript support, faster package management, and aims for full Node.js compatibility, enabling existing npm packages to function seamlessly. To use Bun with Pulumi, developers can set the runtime to Bun in their Pulumi.yaml file and benefit from a streamlined single-tool experience. The transition to Bun involves updating project configurations such as tsconfig.json and adopting ECMAScript module syntax for efficient handling of async code. While Bun enhances package management speed and simplifies runtime configurations, it does not currently support callback functions and dynamic providers that rely on Node.js-specific function serialization. Pulumi version 3.227.0 supports this new Bun runtime, and developers are encouraged to provide feedback to continue improving the integration.

Microsoft Entra ID, formerly known as Azure Active Directory, is a critical component of Azure's identity and access management service, necessitating secure app registration and client secret management. App registrations require client secrets for authentication, which can lead to potential outages if not regularly rotated before expiration. Pulumi ESC's azure-app-secret rotator offers a solution by automating the rotation of these secrets, ensuring continuous access and mitigating the risk of expired credentials. To implement the rotator, certain prerequisites such as Azure App Registration and specific permissions must be met, and a rotation schedule should be established to maintain security. The rotator supports a seamless transition between secrets by maintaining both a current and previous secret to avoid downtime, with a recommended secret lifetime of less than 730 days to enhance security. This automation simplifies credential management and ensures that the latest credentials are always available in the ESC Environment.

Pulumi's new `pulumi policy analyze` command enables users to run policy packs against existing stack states without executing the Pulumi program or making provider calls, allowing for quick and repeatable policy validation. This command addresses the iterative process involved in policy authoring and updates by offering a lightweight alternative to the heavier `pulumi preview` or `pulumi up` commands, making it easier to validate policy logic against known states. Users can specify a policy pack path and an optional stack, and the command will exit non-zero if mandatory policy violations are found, reporting any remediation changes without modifying stack state. The command is particularly beneficial for developers as it provides a local feedback loop for testing policy packs and offers two output modes—human-readable diff and JSON for structured data—which are useful in AI-assisted policy workflows. These features enable agents to propose, test, and refine policy rules efficiently, ensuring compliance without triggering a full preview. The command is available in Pulumi v3.229.0, and users can upgrade their Pulumi version to access it, allowing them to validate policy behavior quickly before deployment.

Neo's read-only mode in Pulumi Cloud allows platform engineers to have the tool analyze infrastructure and suggest changes without directly applying them, maintaining a secure boundary by restricting Neo's permissions during task creation. This mode enables Neo to perform tasks such as reading infrastructure, running previews, refactoring code, and generating pull requests, but it cannot deploy, update, or destroy resources. Engineers can choose between full access and read-only permissions, with the latter ensuring that operations requiring write access fail and are reported. Read-only mode pairs effectively with auto-approve, allowing Neo to operate autonomously and produce pull requests without making production changes. Available to all Pulumi Cloud users, this feature encourages a seamless workflow by providing insights and suggested changes while ensuring oversight and control over infrastructure alterations.

KubeCon + CloudNativeCon EU 2026 in Amsterdam highlighted the growing focus on AI, particularly the challenges and developments surrounding AI workloads on Kubernetes. Despite 66% of organizations using Kubernetes for generative AI, only 7% manage daily production deployments, revealing a significant gap between experimentation and real-world application. The conference showcased several advancements, including NVIDIA's contributions to GPU infrastructure with projects like the DRA driver and KAI Scheduler, which enhance GPU management in Kubernetes. The introduction of llm-d, a collaboration between major tech companies, signifies a move towards an AI runtime for Kubernetes, addressing inference complexity. There was a strong emphasis on agentic AI, with projects like kagent and kagenti focusing on agent management and security. The conference also underscored the importance of sovereignty in infrastructure architecture due to regulatory pressures, with data residency and GPU multi-tenancy being key considerations. Overall, the event demonstrated that while significant progress is being made, there is still a considerable gap between current capabilities and the demands of production-level AI on Kubernetes.

Plan Mode is a new feature launched for Pulumi Cloud users that enhances the process of planning and executing complex infrastructure tasks by allowing collaboration with Neo before execution begins. This dedicated mode is particularly beneficial for complex multi-stack operations, unfamiliar infrastructure, and autonomous execution, where understanding dependencies and upfront discovery can significantly reduce churn and improve outcomes. Plan Mode involves a structured workflow where users can engage in discovery, synthesis, refinement, and approval stages, ensuring a seamless transition from planning to execution. Users can opt into this mode to benefit from Neo's ability to investigate environments, read relevant code, check dependencies, and produce a detailed plan that can be refined through user interaction. Once the plan is approved, execution proceeds smoothly with Neo carrying forward all the insights gathered during the planning phase, and this feature is available for all Pulumi Cloud organizations and is compatible with any task mode.

Tracing is a crucial component of observability in the command-line interface (CLI), and a recent update has transitioned from the deprecated OpenTracing to OpenTelemetry (OTel) for more robust and future-proof tracing capabilities. Originally, tracing was implemented with OpenTracing in 2017, but with its deprecation and the emergence of OTel as a more modern and actively maintained tool, the decision was made to adopt OTel to enhance performance and ease of use. The implementation involved creating an OTel collector within the CLI to facilitate trace collection across multiple plugins, ensuring compatibility with both OTel and legacy OpenTracing plugins by translating traces internally. This setup allows traces to be exported via gRPC to a collector or saved as JSON-encoded files for later analysis in various trace viewers such as Jaeger or OTel Desktop Viewer. Users can try out this new tracing feature using the `--otel-traces` flag in pulumi version v3.226 or newer, and feedback is encouraged through community channels.