Tessera

Neo Security is our infrastructure security agent. It uses context about your full cloud estate—resources, semantics, code, reachability, runtime data, and more—to build a model of your estate and analyze it. Each finding is actionable thanks to IaC.

Neo Security: Securing Infrastructure in the Agentic Era

Pulumi Neo Security threat models and traces attack paths across your entire cloud estate. Find and fix problems before the bad actors do.

pulumi.com

A panel about leaving the hyperscalers — with Sarbjeet Johal on it arguing most companies shouldn't. Sep 3. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

We just launched the Pulumi Context API: everything Pulumi knows about your infrastructure as one queryable graph, built agent-first. Any agent can learn it in one request, and Neo uses it out of the box. Here's a brief tour.

Pulumi Context API: One Graph for All Your Infrastructure

The Pulumi Context API is now in preview: query IaC state, stack dependencies, and discovered cloud resources as one graph built for AI agents.

pulumi.com

Tomorrow: keep your Terraform estate, run it through Pulumi Cloud — no migration, no rewrite. Aug 26, 10 AM ET / 4 PM CEST 👇 https://www.pulumi.com/events/pulumi-for-all-your-iac-terraform-hcl/?utm_source=bluesky&utm_medium=social&utm_content=pulumi-for-all-your-iac-terraform-hcl#session-emea

Pulumi @pulumi.com · 4w ago

German enterprises' question has shifted: not "what does this cost?" but "could we move if we had to?" Waldemar Kindler, Sep 3. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

Jim Dowling moved Hopsworks to OVHcloud and cut the bill 62%. Sep 3, he shows his work. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-panel/?utm_source=bluesky&utm_medium=social&utm_content=beyond-the-hyperscalers-sovereignty-panel

Our tfcompat tests never say what Pulumi HCL should do. A test is just an HCL program and its providers; OpenTofu's behavior is the spec. That one choice lets LLMs hunt our bugs. We wrote up how.

Compatibility Testing Pulumi HCL

How we test that Pulumi HCL is an OpenTofu compatible HCL runtime.

pulumi.com

European regulations and rising cloud bills have CTOs asking a question that was unthinkable five years ago: do we need an exit plan from our cloud provider? Sep 3, a live panel on when that makes sense, and when it doesn't. https://www.pulumi.com/events/beyond-the-hyperscalers-sovereignty-pane...

Tomorrow: a free hour on configuring Claude Code and opencode for infrastructure as code. We set both up from scratch, then put them to work live on a real task, so Pulumi comes out correct, not plausible. Aug 12, 12 PM ET 👇 https://www.pulumi.com/events/getting-started-with-devops-ai-skills-2/...

Debugging a Pulumi error usually meant reproducing it by hand just to capture a log, then finding a safe way to share a file full of secrets. Pulumi v3.254.0 makes logs automatic and encrypted, safe to share even on a public GitHub issue. Here's what changed.

Automatic Logging for Faster, Secure Debugging

Pulumi now writes encrypted logs for every operation automatically

pulumi.com

Coding agents will write your infrastructure as code. Whether it's correct and consistent comes down to how you configure them. Aug 12, free workshop: set up Claude Code + opencode from scratch so they get Pulumi right. 👇 https://www.pulumi.com/events/getting-started-with-devops-ai-skills-2/?ut...

Teams running Terraform don't have to rip it out to move into the agentic infrastructure era. Pulumi Cloud is now GA as a Terraform state backend, HCL is GA as a native Pulumi language, and Terraform modules import without changes. Here's what shipped today.

Bring Your Terraform Estate Into the Agentic Era

Pulumi Cloud as a Terraform backend and HCL in Pulumi IaC are now GA, plus native Terraform module support — bring the IaC you already have.

pulumi.com

Every coding agent has a YOLO mode. You're probably running it daily, and prompt guardrails fail right when it matters. Engin Diri on sandboxing agents with Docker Sandboxes, plus an open-source kit preloaded with Pulumi, Terraform, and cloud CLIs for infra work.

YOLO Mode Is the Right Default. Your Laptop Is the Wrong Place for It.

Prompt guardrails fail right when coding agents get dangerous. How Docker Sandboxes make YOLO mode safe, plus a ready-made kit for infrastructure work.

pulumi.com

Tomorrow: a free hour on Pulumi ESC, from the basics up. What an environment is, how it pulls from the secret stores you already run, and how your IaC, CI/CD, and local dev consume it without scattered copies. 12 PM ET. https://www.pulumi.com/events/intro-to-pulumi-esc-managing-secrets/?utm_sou...

Your secrets are in environment variables, a CI system, two cloud secret stores, and a .env file on somebody's laptop. Aug 5, free intro workshop: pull them into one Pulumi ESC environment everything reads from. https://www.pulumi.com/events/intro-to-pulumi-esc-managing-secrets/?utm_source=blue...

Six months into a migration, can you say which of 800 resources actually made it to IaC — and which were quietly forgotten? The spreadsheet tracking it went stale the day it was written. The spreadsheet is retired for good.

Discovered Stacks: One Place for All Your Infrastructure

Discovered Stacks: Pulumi Cloud now models your CloudFormation and ARM deployments as Pulumi IaC stacks, with a built-in migration path.

pulumi.com

We migrated a 61-resource CloudFormation stack to Pulumi — payments API, database, the works — and never ran pulumi up once. A zero-diff preview proved every resource was in sync. The full step-by-step is up.

Migrate CloudFormation to Pulumi with Discovered Stacks

Migrate a CloudFormation stack to Pulumi with Discovered Stacks: verify every resource, import with a zero-diff preview, and track it all in Pulumi Cloud.

pulumi.com

An AI agent on Kubernetes isn't just another Deployment: GPUs, long-lived sessions, and a much bigger credential blast radius. Here's how to provision and govern that infrastructure with Pulumi, in TypeScript and Python.

How to Run AI Agents on Kubernetes with Pulumi

How to provision and govern Kubernetes infrastructure for AI agents with Pulumi, in TypeScript and Python, and where kagent, KServe, Kueue, and Neo fit in.

pulumi.com

Token rotation policies are easy to write and hard to enforce. Pulumi Cloud now enforces them for you: org admins can cap the max expiry of personal, organization, and team access tokens used against their organization, checked on every request.

Enforce Access Token Expiry Policies in Pulumi Cloud

Organization admins can now cap the maximum expiry of personal, organization, and team access tokens, so no credential outlives your rotation policy.

pulumi.com

esc v0.26.0 is the last standalone ESC CLI release. The repo is archived, and every command now lives under pulumi env in the Pulumi CLI. Swapping esc for pulumi env covers most of them. The ones it doesn't cover are the ones worth knowing. We documented all of them.

The Standalone ESC CLI Retired: Use pulumi env

The standalone esc CLI is archived as of v0.26.0. Every ESC command is available in the Pulumi CLI under pulumi env: one binary to install and upgrade.

pulumi.com

A container isn't much of a security boundary: every one on a host shares the same kernel. Kubernetes Agent Sandbox gives AI agents a kernel-isolated, disposable box instead. Adam Gordon Bell deployed it on GKE with Pulumi, one sandbox per developer. Here's how it's wired together.

Kubernetes Agent Sandbox: What It Is and How to Deploy It with Pulumi

Agent Sandbox gives AI agents kernel-isolated, disposable environments as Kubernetes resources. Here's what it is and how to deploy it on GKE with Pulumi.

pulumi.com

Daniel Ward - daninacan @danielwarddev.bsky.social · 2mo ago

Terraform alternatives in 2026 split into three camps: general-purpose-language platforms, HCL-compatible forks, and cloud-specific tools. The one that fits your team increasingly depends on something most comparisons skip: how well it works with an AI coding agent in the loop.

Best Terraform Alternatives in 2026

The best Terraform alternatives for 2026: Pulumi, OpenTofu, AWS CDK, Crossplane, and Bicep, compared on multi-cloud reach, governance, and AI-agent readiness.

pulumi.com

Next San Antonio/Austin DNUG is in 10 days! Learn to build your infrastructure in C# with Pulumi! #dotnet #azure 🎤What: Serverless Dad Jokes: What If Everything Was Just C#? 👨‍🏫Who: Adam Gordon Bell ⌚When: July 30 @ Noon CST 🌐Where: Zoom Signup: www.meetup.com/sadnug/event...

Your infra is code. Your on-call setup is forty clicks in a web UI, done once. Engin Diri wires PagerDuty + AWS in one Pulumi program: teams, schedules, escalation policies, and the alarm that pages you. Integration keys flow as dependencies, nothing gets forgotten.

Incident Response as Code: Managing PagerDuty with Pulumi

Manage PagerDuty teams, schedules, escalation policies, and services with Pulumi, and wire alerting to the AWS infrastructure in the same program.

pulumi.com

Connect your AWS, Azure, and Google Cloud accounts to Pulumi Insights in about three minutes. The same setup used to take hours to days of per-account OIDC and ESC configuration. We built a wizard that handles all of it. Here's how it works.

Connect Your Cloud Accounts to Pulumi in Minutes

Onboard your AWS, Azure, and Google Cloud accounts to Pulumi Insights in bulk with the new Connect cloud accounts wizard. OIDC-based, no long-lived secrets.

pulumi.com

Now Pulumi Neo supports monthly usage limits, putting your Neo spend under control so you can hand it more and more infrastructure work.

Introducing Usage Limits for Pulumi Neo

Set monthly organization or per-member Pulumi Neo dollar limits and get alerts via email.

pulumi.com

The LLM wiki everyone built after Karpathy's gist is a dialect only your own agent can read. Google's Open Knowledge Format pins it down: markdown, frontmatter, one required field. Knowledge as code.

Knowledge as Code: The Memory File Just Got a Spec

Google's Open Knowledge Format: a one-page spec for the LLM wiki. Markdown, one required field, git. Why knowledge as code is your agent loop's missing layer.

pulumi.com