June 2026 Summaries

The process of deploying AI inference servers using Pulumi on cloud platforms like AWS, Azure, and Google Cloud is streamlined by treating infrastructure as code, allowing for reproducibility, version control, and easy teardown with a single command. Inspired by an Akamai project, the approach involves deploying a GPU instance with Ollama model serving, which maintains the model in GPU memory to optimize performance. By utilizing OpenID Connect (OIDC) for authentication, long-lived cloud keys are replaced with short-lived credentials, enhancing security. The deployment process is consistent across clouds, involving setting up a GPU virtual machine, a firewall, and a cloud-init script, while addressing cloud-specific nuances. The model is served via an HTTP API, and Pulumi's approach to cloud infrastructure management simplifies the setup, reducing reliance on static tokens and improving deployment efficiency. The emphasis is on ensuring the AI endpoint is secure and cost-effective, with best practices including scoping firewall rules and leveraging TLS or private networking for production environments.

ISO/IEC 27001 is a critical international standard for information security management, and achieving compliance often requires extensive effort to map its abstract controls to specific cloud configurations. Pulumi has introduced a solution by launching a pre-built ISO/IEC 27001:2022 policy pack for AWS, named iso-27001-aws, which includes 238 ready-to-run policies designed to align AWS environments with ISO 27001 quickly. This policy pack simplifies the compliance process by translating the standard's governance and risk management language into actionable policies for AWS resources, allowing companies to achieve and maintain compliance efficiently. The pack can be used both for auditing existing AWS infrastructures to establish a compliance baseline and as a preventative measure to ensure new resources meet the standard before being created. This new offering is part of Pulumi's expanding library of pre-built policy packs for AWS, which includes support for other compliance frameworks, facilitating a consistent and up-to-date compliance strategy across multiple standards.

Infrastructure as Code (IaC) testing involves validating infrastructure code similarly to application software, using unit tests with mocked cloud providers, integration tests for real resources, and policy checks for compliance. Pulumi facilitates this by allowing infrastructure code to be tested using the same tools and languages as application code, eliminating the need for separate toolchains or languages. Unit tests quickly identify misconfigurations like open SSH ports or missing tags before any cloud API call, while integration tests ensure infrastructure changes do not disrupt dependent services. Policy as code enforces security and compliance rules, running checks on every preview and deployment. Pulumi's approach to IaC testing offers seamless integration with CI/CD processes, enhancing the speed and safety of shipping infrastructure changes. Unlike Terraform, which requires separate languages for testing, Pulumi enables developers to write and test infrastructure in the same language, improving productivity and cohesion. The guide emphasizes the importance of testing IaC to prevent costly misconfigurations and outages, advocating for a layered testing strategy that combines unit tests, integration tests, and policy checks.

Pulumi ESC offers centralized management of secrets and configuration, including automatic secret rotation to prevent credentials from becoming outdated. To ensure systems are aware of these rotations, ESC introduces secret rotation webhooks, which notify users immediately when a secret is rotated. These webhooks can trigger actions based on the success or failure of a rotation, such as notifying teams via Slack, updating services with new credentials, or addressing failed rotations to prevent outages. Users can configure these webhooks through the Pulumi Cloud Console or the Pulumi CLI, using specific commands to set up notifications for both successful and failed rotations. Secret rotation webhooks are now available for all Pulumi ESC environments, with detailed setup instructions provided in the webhooks documentation and a platform for feedback on GitHub.

Platform teams managing Databricks face challenges with inconsistent cluster policies, high costs, and security gaps due to manual configurations, which lead to fragmented environments that are difficult to govern. To address these issues, standardizing Databricks environments with Pulumi can provide a unified, governed workspace, enabling faster data team operations without sacrificing governance. The article outlines how to provision a standardized Databricks workspace using Pulumi, creating cluster policies, secret scopes, permissions, and automated jobs. It emphasizes understanding the boundary between account-level and workspace-level resources, configuring credentials securely with Pulumi ESC, and managing resources within a Databricks workspace. By employing Pulumi for infrastructure as code, teams can ensure consistent deployment of cluster policies, permissions, and other resources across multiple environments, aligning development and production while maintaining environment-specific configurations. The approach facilitates integrating Databricks management with CI/CD pipelines, enhancing the governance and efficiency of data operations.

In 2026, the rise of personal AI agents like Hermes, an open-source runtime from Nous Research, has transformed how developers deploy AI assistants, emphasizing self-hosting over static, cloud-hosted solutions. Unlike its predecessor OpenClaw, Hermes learns dynamically, creating its own skills and running code independently in sandboxed environments to mitigate security risks. The text outlines a detailed procedure for deploying a private Hermes agent using Pulumi, Render, Modal, and Tailscale, emphasizing security by avoiding public internet exposure and utilizing encrypted environments. This setup allows the agent to maintain memory and execute tasks autonomously across various platforms like Telegram, Discord, Slack, or Signal, while adhering to infrastructure-as-code practices for reproducibility, version control, and easy teardown. The deployment costs around $50 per month, with additional costs depending on usage, and the architecture ensures that sensitive operations remain isolated and secure.

Platform teams managing multi-cloud applications often face significant challenges due to visibility gaps between tightly controlled origin infrastructure and the manually adjusted configurations at the network edge. Such discrepancies can lead to application vulnerabilities and routing failures that often go unnoticed until users report issues. Given that the edge serves as a critical layer for enforcing security and traffic policies across multiple clouds, the text highlights the risks of relying on manual adjustments, which can introduce security holes and performance bottlenecks. It proposes the use of a standardized Cloudflare edge baseline, implemented with Pulumi, to define DNS records, custom WAF rules, edge logic canaries, and Zero Trust Access policies, ensuring a version-controlled, reliable, and secure edge environment that aligns with application code. The text also provides detailed instructions for setting up and validating this baseline, emphasizing the importance of maintaining security consistency and reducing manual configuration drift.

Pulumi has introduced Neo code reviews, now available in public preview, which provide detailed feedback on pull request changes by leveraging the knowledge of Pulumi Cloud about the current state of the running infrastructure. Unlike traditional code review agents, Neo can access critical aspects such as the pulumi preview output and the complete cloud context, including stack relationships and dependencies, to better anticipate the impact of infrastructure-as-code changes. Neo can automatically review every pull request or only those that mention @pulumi-neo, excluding drafts and bot-created requests by default, and it integrates with existing governance structures, including RBAC and audit logging. Currently available on GitHub, Neo code reviews require the Pulumi Neo feature to be enabled, the Pulumi GitHub App to be installed on the repository, and a one-time grant from each organization user. During the public preview, these reviews are free, but starting July 1, 2026, they will contribute to an organization's Neo token usage at the same rate as other Neo tasks. Users are encouraged to try the feature and provide feedback via the Pulumi Community Slack.

In a live workshop on June 10th, the presenters, Engin and the author, faced challenges while building an Azure Kubernetes Service (AKS) cluster, an Azure Container Registry, and a random-cat web app using C#, due to Docker Hub rate limits and regional capacity constraints. The workshop emphasized six recommendations for working with Kubernetes on Azure, including choosing familiar programming languages like C# for infrastructure coding with Pulumi, using Cilium for better networking on AKS, and employing stack-aware assistants like Pulumi Neo for real-time troubleshooting. The session highlighted the importance of separating infrastructure from workloads to allow independent deployment, and explored the advantages of integrating GitOps for Kubernetes management. Despite the live demo setbacks, the workshop successfully demonstrated key practices and tools for managing Kubernetes on Azure, and underscored the value of maintaining cloud-hosted images to avoid future rate-limit issues. The session code and steps are available for replication, with further stages encouraging participants to apply GitOps practices for managing Kubernetes applications.

Over the past two years, the process of working with coding agents has evolved from manual prompting to a more automated approach known as loop engineering, a concept highlighted by Addy Osmani from Google Cloud. Instead of manually generating prompts, engineers now design loops that automate the prompting process, allowing systems to run independently and continuously iterate towards a set goal. This shift in approach is echoed by industry professionals like Peter Steinberger and Boris Cherny, who emphasize the importance of designing these loops to manage tasks such as issue tracking and project management. The essence of loop engineering involves several components, including automations, discovery and triage, worktrees, skills, connectors, and memory, which together facilitate continuous project iteration without direct human intervention. However, the success of these loops depends on effective verification processes, often requiring a separate model or system to validate outcomes against predefined goals. While loops can streamline and accelerate workflows, they require careful design and oversight to ensure that automated processes do not lead to errors or misunderstandings, especially when applied to critical areas like infrastructure management. The ultimate goal is to leverage loop engineering to enhance productivity without relinquishing human judgment and oversight.

Pulumi Deployments now support tag-based triggers, allowing teams to automatically initiate deployments by pushing a version tag, such as v1.2.0, without the need for additional pipeline configurations. This feature is particularly beneficial for teams who traditionally use git tags as part of their release process, as it seamlessly integrates tagging with infrastructure deployment. It differentiates from the continuous delivery model, which is suited for shared development and QA environments, by catering to the more deliberate promotion to production phases. The system operates using two main settings: enabling updates for pushed tags and configuring tag filters to specify which tags trigger deployments. These filters can include patterns like v* for version tags or exclusions like !*-rc* to skip release candidates. The feature is compatible with multiple version control systems, including GitHub, GitLab, Bitbucket, and Azure DevOps, and can be managed through the Pulumi Cloud console, REST API, or as code.

Deloitte's transition to a virtual cluster model on Amazon EKS, as highlighted in an AWS Architecture Blog case study, resulted in a dramatic 89% reduction in the time required to provision testing environments and saved approximately 500 QA hours annually. By consolidating numerous clusters into a single host cluster with over 50 virtual cluster (vCluster) instances, Deloitte implemented an "Environment Factory" pattern that enables on-demand, isolated, ephemeral Kubernetes environments without the costs and delays of full cluster provisioning. The architecture involves a single, reliable host cluster managed with EKS Auto Mode, which automates infrastructure management, and tenant environments that run as pods within host namespaces, allowing for separation and management of resources while maintaining cost-efficiency and fast startup times. The solution integrates Pulumi to orchestrate the EKS Auto Mode and vCluster, and includes setup for namespaces, resource quotas, and role-based access controls to ensure secure and efficient resource management. By leveraging Pulumi with EKS Auto Mode and vCluster, organizations can create scalable and cost-effective development environments that provide necessary isolation for developers while maintaining overall platform efficiency.

The text details a comprehensive guide on running the Gemma 4 12 B open-weight model locally on a modern Mac using llama.cpp for host-native inference, leveraging Apple Metal acceleration, and integrating with Kubernetes and Pulumi for infrastructure management. It highlights the benefits of local execution, such as keeping data within the local network, offline functionality, and zero token cost, contrasting it with common trade-offs associated with cloud-based AI services. The setup involves using tools like brew, docker, pulumi, and tailscale, with specific configuration steps for installing and running the model, including setting up a local Kubernetes cluster and deploying a chat interface using Open WebUI. It also explores how to expose the web interface securely via Tailscale, and provides instructions for configuring a local coding agent to interact with the model. The guide concludes with advanced options for Linux users with dedicated GPU resources and cleanup instructions for dismantling the setup.

AI coding can operate in two modes: the 2x mode, which involves sequential work where a human interacts with a single agent, and the 10x mode, which leverages parallel processing with multiple agents working concurrently on different tasks. The 10x approach involves a more complex setup, using a playbook with five key patterns to facilitate the coordination of multiple agents without conflict, focusing on infrastructure as well as application code. These patterns include using issues as specifications, a plan/build/validate loop, parallel git worktrees, fresh-session reviews, and a self-healing layer. The infrastructure adaptation, exemplified by Pulumi, requires special considerations such as stack-based isolation instead of worktree-based, deterministic validation through tools like pulumi preview, and policies that are written as actionable instructions for self-healing. The goal is to achieve efficient parallel processing that minimizes human bottlenecks and infrastructure conflicts, ultimately allowing for multiple tasks to be reviewed and integrated smoothly in a single session.

Pulumi offers an alternative to Terraform for managing infrastructure as code, allowing teams to use general-purpose programming languages such as TypeScript, Python, Go, C#, and Java, which integrate with familiar development workflows and software engineering practices. Pulumi provides advanced features like first-class workflows for refactoring, secret management, lifecycle controls, and explicit provider configurations, making it advantageous for teams needing application-like behavior in their infrastructure code. While it doesn't eliminate challenges like cloud API eventual consistency, provider bugs, or drift, Pulumi enhances the developer experience with stronger programming models and interoperability paths, including incremental migration from Terraform. This makes Pulumi a compelling choice for teams looking to leverage existing programming expertise to manage cloud infrastructure, while still requiring engineering discipline to handle complex scenarios and maintain infrastructure integrity.