July 2026 Summaries

Pulumi Cloud facilitates the migration of a CloudFormation stack to an infrastructure-as-code (IaC) setup using its Discovered Stacks feature, which systematically tracks the migration status of each resource, ensuring a match between code and cloud state. In the tutorial, a real-world example, a CloudFormation stack called payments-api with 61 resources, is migrated to Pulumi IaC. The migration process involves several steps: identifying the stack in Pulumi Cloud, planning the migration by reviewing resources and their statuses, initiating the migration with Pulumi Neo, resolving discrepancies, and confirming the migration through a zero-diff pulumi preview, which ensures the code accurately reflects the live cloud state. The migration process is designed to be flexible, allowing for partial migrations and progressive integration without disrupting existing cloud resources. This approach is applicable not only to AWS CloudFormation stacks but also to Azure Resource Manager deployments and Pulumi-hosted Terraform stacks, providing a unified migration experience across different platforms.

Pulumi has introduced Discovered Stacks, a feature in Pulumi Cloud that models AWS CloudFormation stacks and Azure Resource Manager deployments alongside Pulumi Infrastructure as Code (IaC) stacks, facilitating seamless migration under unified management. This initiative addresses the common challenge of fragmented cloud estates, where different tools like AWS CloudFormation, Azure ARM templates, and Terraform, often hamper migration efforts due to their isolated states and management consoles. Discovered Stacks ensure that every resource is tracked accurately, with explicit migration statuses such as ready to migrate, requiring review, or already migrated, derived from live states of both Pulumi and the source tools. This approach eliminates the reliance on outdated spreadsheets and enhances confidence in migration plans by providing a comprehensive view of all resources and their statuses. Pulumi Neo aids in the migration process by importing resources, reconciling generated programs, and facilitating reviews through pull requests, while local development is also supported. Additionally, Terraform stacks stored in Pulumi Cloud receive similar treatment, with migration statuses derived from their Terraform state. Users can explore this feature by enabling Discovered Stacks in Pulumi Cloud and accessing tutorials and documentation to guide their migration journey.

Kubernetes has become the primary platform for hosting generative AI models, with 66% of organizations using it to manage AI inference workloads, as revealed by the CNCF's 2026 survey. The infrastructure supporting agentic AI workloads on Kubernetes requires deliberate design, differing significantly from typical stateless web services, as it involves long-lived sessions, GPU scheduling, and complex governance profiles. While Kubernetes is suitable for agent workloads due to its scheduler, autoscaling, and RBAC capabilities, provisioning involves more than merely reusing deployment templates. Pulumi is a tool that helps provision and govern Kubernetes infrastructure for AI agents, using TypeScript and Python, by creating a stack that integrates agent runtimes, secrets management, and policy enforcement. Pulumi's Neo further enhances management by proposing infrastructure changes and handling maintenance tasks. The ecosystem supporting agentic workloads includes several CNCF projects like kagent, KServe, and Kueue, which provide frameworks and tools for managing AI agents on Kubernetes.

Pulumi Cloud has introduced a new feature that allows organization administrators to enforce a maximum expiry on access tokens used within their organizations, enhancing security by ensuring compliance with credential rotation policies. This policy allows admins to set a maximum token lifetime in days, ensuring that tokens have an expiration date and comply with the specified lifespan cap. The feature addresses the security risk of never-expiring or overly long-lived tokens by rejecting them and providing users with guidance on how to regain access. The enforcement applies immediately to both new and existing tokens, with different compliance mechanisms for personal, organization, and team tokens. While personal tokens are not blocked at creation, they are rejected if non-compliant when used, and all policy changes are recorded in audit logs. The rollout process includes a preview of affected tokens to mitigate disruptions, especially for CI credentials, and ensures that users are informed about the changes and how to comply with the new requirements.

Pulumi ESC simplifies configuration and secret management for Pulumi programs, with a new feature called Approvals for ESC allowing for review and approval of changes before their implementation. The introduction of the --override-env flag in the Pulumi CLI enhances this process by permitting users to preview environment changes, including unapproved drafts, to assess their impact before they are applied to the stack. This flag can be used across various Pulumi operations such as preview, up, refresh, and destroy, providing flexibility to override multiple environments simultaneously. It also supports overriding environments imported from the ESC environment in stack configurations, enabling thorough validation and debugging. The feature aids in confidently reviewing draft configurations and testing different environments, ensuring that teams can prevent undesirable changes from affecting critical infrastructure. The --override-env flag and draft references are now available in the latest Pulumi CLI release, offering users expanded capabilities for configuration management and validation.

Pulumi has announced that the standalone Pulumi ESC CLI v0.26.0 is the final release, encouraging users to transition to the Pulumi CLI for a more unified experience. The ESC repository has been archived, and its code is now integrated into the Pulumi framework to enhance consistency and simplify user experience by providing a single interface for managing configurations and secrets across Pulumi programs. This change aims to streamline operations for both human users and AI agents by consolidating functionalities into one CLI, reducing complexity, and facilitating easier account management and feature upgrades. The transition involves minor command adjustments, and while the underlying code remains unchanged, users relying on the ESC CLI are advised to switch to the Pulumi CLI to access the latest features and improvements, ensuring seamless integration with Pulumi's cloud services.

Agent Sandbox is a Kubernetes project designed to provide AI agents with isolated, disposable environments using Kubernetes resources, specifically leveraging gVisor or Kata Containers for kernel-level isolation. This system aims to balance autonomy and security by creating a sandbox environment where agents can operate without risking the host system, as demonstrated by the use of Pulumi Neo and Kubernetes in deploying these sandboxes. Unlike traditional containers, which share a kernel with the host and thus have a broader attack surface, Agent Sandbox employs a userspace kernel to minimize potential vulnerabilities. The project supports two usage patterns: mapping each coding agent session to its own pod or using it to build a productized agent harness. The deployment on Google Kubernetes Engine (GKE) with gVisor ensures enhanced security by filtering syscalls, while Kata Containers offer a more robust option for I/O-heavy tasks due to their native syscall handling. The system also addresses startup time challenges by using warm pools and snapshot-restore techniques to maintain quick responsiveness. Overall, Agent Sandbox provides a secure and efficient method for deploying AI agents on Kubernetes, ensuring both isolation and performance.

The text discusses the integration of PagerDuty incident management with Pulumi's infrastructure as code capabilities, aiming to streamline and automate the management of on-call schedules, teams, escalation policies, and monitoring alerts. It highlights the benefits of using a single TypeScript program to manage both the infrastructure and the incident response setup, thereby reducing the risk of communication gaps between systems and ensuring consistency. By using Pulumi's integration with PagerDuty, developers can automate the creation and management of resources, such as teams, schedules, and services, and handle alerts from platforms like AWS, Google Cloud, and Azure. This approach minimizes human error and drift by having code manage resources instead of relying on manual configurations through user interfaces. The text emphasizes the advantage of having all elements in one program, which prevents forgotten configurations and ensures that the on-call setup is maintained accurately over time. It also encourages the use of Pulumi's reusable components to standardize service setups and suggests importing existing PagerDuty configurations into Pulumi for a seamless transition.

In 2026, teams are reconsidering Terraform as their default infrastructure-as-code (IaC) tool due to licensing changes, the limitations of its domain-specific language (HCL), and the rise of AI coding agents. Alternatives fall into three categories: general-purpose-language platforms like Pulumi and AWS CDK, HCL-compatible forks like OpenTofu, and cloud-specific tools like AWS CloudFormation, Azure Bicep, and Crossplane. The shift from Terraform's open-source license to the Business Source License and its acquisition by IBM have raised governance concerns, prompting some to explore options like OpenTofu, a community-driven fork. Moreover, the limitations of HCL in abstraction, testing, and composability are becoming apparent, as modern engineering demands more flexibility, which general-purpose languages offer. Pulumi and AWS CDK allow infrastructure to be defined using languages like Python and TypeScript, facilitating AI agent integration, which is increasingly important as AI tools become integral to development workflows. CloudFormation and Azure Bicep cater to teams committed to specific clouds, while Crossplane suits Kubernetes-centric environments but requires Kubernetes adoption. Ultimately, the choice of an IaC tool in 2026 hinges on factors like cloud strategy, governance needs, and integration with AI-driven workflows.

Pulumi Insights introduces a new Connect cloud accounts wizard designed to streamline the process of linking multiple cloud accounts across AWS, Azure, and Google Cloud, significantly reducing the setup time from hours to just about three minutes. This wizard automates the onboarding lifecycle by discovering all accessible accounts within a cloud organization, configuring them with short-lived credentials through OpenID Connect (OIDC), and creating Pulumi ESC environments that adhere to best practices, eliminating the need for manual configuration. The tool offers two access levels—Build & Manage and Discovery & Policy—to cater to varying security requirements, enabling organizations to decide on the degree of access per account. The setup process includes automatic application of discovery scans and policy packs to ensure compliance from the outset, with a detailed summary provided upon completion to facilitate transparency and troubleshooting. The wizard is now available to all Pulumi Cloud organizations, offering a comprehensive guide for connecting and managing cloud accounts efficiently.

Five weeks ago, a discussion highlighted the importance of memory in agent loops, specifically how a memory file outside the context window aids in tracking what has been done, what is next, and what was learned. This concept evolved when Andrej Karpathy's LLM wiki pattern, which creates interlinked markdown pages for agents to maintain current knowledge, gained traction. Subsequently, Google introduced the Open Knowledge Format (OKF) as a standardized method for structuring such knowledge bases using simple markdown files, promoting a system where knowledge changes are reviewed like code changes. OKF’s minimalistic approach, based on markdown, frontmatter, and git, allows for easy migration and emphasizes the importance of maintaining structured, reviewable knowledge repositories that agents can utilize effectively. This initiative aims to address the problem of fragmented knowledge across proprietary systems by providing a framework that ensures knowledge is both accessible and transferable, aligning with practices already familiar to platform engineers.

Pulumi Neo is an AI agent designed to manage real infrastructure tasks, and organizations can set monthly usage limits to control expenses and manage its deployment. These limits are established through the Pulumi Cloud console under the Neo token usage settings, enabling organizations to set a single monthly dollar cap for all Neo activities. Once the limit is reached, Neo pauses its operations until the next billing cycle, although an Admin or Billing Manager can increase the limit to resume services earlier. Tasks in progress will complete their current step before the pause, potentially leading to minor overages. Additionally, individual member limits can be set, with the smaller of the member or organization limit taking precedence. Email notifications can be activated to alert billing admins at various thresholds, ensuring they are aware when limits are approaching. Usage limits are available for organizations on a paid plan, and more details can be found in the Neo usage limits documentation or by engaging with the community on Slack.

Pulumi Cloud has introduced support for passkeys, enhancing the security for users signing in with email and password by utilizing public-key credentials stored on personal devices, such as phones, laptops, and hardware keys. The system operates on the WebAuthn standard, ensuring compatibility across major browsers and operating systems. Passkeys provide a phishing-resistant and easily discoverable authentication method that does not require memorization, as they are stored and synced across devices using credential managers like Apple iCloud Keychain and Google Password Manager. While passkeys offer an additional sign-in option, they do not replace existing passwords or multi-factor authentication (MFA) setups, maintaining the security boundaries of current account configurations. Users can easily set up and manage passkeys through their account settings and can continue to use their passwords alongside passkey authentication.

Pulumi has introduced a version selector feature in its CLI command reference and SDK API documentation, allowing users to access documentation that corresponds to the version they are using. This feature, which includes a dropdown menu near the top of the documentation pages, enables users to select and view the exact version of the documentation they need, with options available from the latest release back to version v3.150.0. The documentation covers the CLI command reference and SDKs for Node.js, Python, .NET, and Java, with Go SDK documentation available on pkg.go.dev. Once a version is selected, it remains active for subsequent navigation, enhancing user experience by ensuring that users consistently access the appropriate version without needing to reselect it. Feedback on this feature can be shared via Pulumi Community Slack or GitHub.