# General Published articles for General. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Libreboot Build System Audit 2 DevFeed: [Libreboot Build System Audit 2]() Original publisher: [Read original article]() Author: Leah Rowe Published: 2026-09-17T04:32:50.666044Z Content type: article Language: en Sources: [News about Libreboot releases and development]() Topics: [audit](), [Development](), [Shell](), [Code](), [Documentation]() Tags: [audit](), [bios](), [bugs](), [build](), [canoeboot](), [code](), [coreboot](), [development](), [documentation](), [error-handling](), [free-software](), [general](), [libre](), [libreboot](), [opensource](), [shell](), [uefi]() ### AI overview This article reports on a completed audit of Libreboot's build system, lbmk, as of 11 September 2023. It describes bug fixes, improved documentation and error handling, fewer scripts, unified logic, and a reduction in shell source lines from 3,388 to 2,644, or 22%. ### Source excerpt Article: Libreboot Build System Audit 2 Web link: https://libreboot.org/news/audit2.html ## Scheduling gRPC and GraphQL Requests with Postman Monitors (Beta) DevFeed: [Scheduling gRPC and GraphQL Requests with Postman Monitors (Beta)]() Original publisher: [Read original article]() Author: Harsh Vardhan Published: 2026-09-16T16:00:00Z Content type: tutorial Language: en Sources: [Postman Blog]() Topics: [gRPC](), [Postman](), [Monitoring](), [Authentication]() Tags: [beta](), [general](), [graphql](), [graphql-monitoring](), [how-to](), [monitor-grpc-streaming](), [monitoring](), [monitors](), [postman](), [postman-monitors-grpc-graphql](), [scheduling](), [test]() ### AI overview This tutorial explains how to schedule gRPC and GraphQL requests with Postman Monitors in beta. It covers supported request types, streaming caveats, response testing, authentication, and current feature limitations. ### Source excerpt Postman Monitors now run gRPC and GraphQL requests in beta. Learn how to schedule them, test responses, and send feedback. Start monitoring today. The post Scheduling gRPC and GraphQL Requests with Postman Monitors (Beta) appeared first on Postman Blog. ## Atomic macOS (AMOS) Stealer Activity DevFeed: [Atomic macOS (AMOS) Stealer Activity]() Original publisher: [Read original article]() Author: Bradley Duncan Published: 2026-09-16T10:00:06Z Content type: article Language: en Sources: [Unit 42]() Topics: [Malware](), [Aeternum](), [macOS](), [sensitive data](), [Zsh](), [ClickFix](), [cURL]() Tags: [ads](), [clickfix](), [credentials](), [cryptocurrency](), [curl](), [general](), [insights](), [macos](), [malware](), [sensitive-data](), [threat-intelligence](), [unit-42](), [zsh]() ### AI overview This article analyzes a laboratory-generated Atomic macOS (AMOS) stealer infection observed on Aug. 5, 2026. It describes a deceptive macOS toolkit installation page that led users to paste a command into Terminal, retrieving a Zsh script containing an encoded compressed payload and a follow-up script designed to run a Mach-O binary. AMOS targets macOS and can exfiltrate system information, login credentials, and sensitive data from applications including browsers and cryptocurrency wallets. ### Source excerpt Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42. ## Agent Gateway: The Next Evolution of the API Gateway DevFeed: [Agent Gateway: The Next Evolution of the API Gateway]() Original publisher: [Read original article]() Author: Gbadebo Bello Published: 2026-09-10T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [AI Agent](), [Architecture & Design](), [Artificial Intelligence](), [Routing (disambiguation)](), [Authentication](), [Authorization](), [observability]() Tags: [agent-gateway](), [ai](), [ai-agents](), [api](), [api-101](), [api-gateway](), [architecture](), [authorization](), [editor-s-picks](), [fabric-gateway](), [general](), [llm-gateway](), [mcp](), [mcp-gateway](), [observability](), [routing]() ### AI overview The article explains the emergence of the Agent Gateway as an architectural component for AI agents. It contrasts traditional API Gateways, which authenticate, govern, route, and deliver requests from clients that already know which API to call, with the needs of AI agents, which receive goals and may require broader governance across agentic workflows. ### Source excerpt API gateways are evolving for AI agents. Learn how the agent gateway governs identity, tools, memory, and policy across agentic workflows. Get early access. The post Agent Gateway: The Next Evolution of the API Gateway appeared first on Postman Blog. ## Loop engineering: stop prompting, start looping DevFeed: [Loop engineering: stop prompting, start looping]() Original publisher: [Read original article]() Author: Anthony Viard Published: 2026-09-08T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [Loop Engineering](), [AI Agent](), [AI-assisted coding](), [API]() Tags: [2026](), [agent](), [agentic](), [agents](), [ai](), [ai-agents](), [ai-coding](), [api](), [api-testing](), [blog](), [code](), [coding-agents](), [developer](), [engineering](), [general](), [guide](), [idea](), [loops](), [model](), [post](), [postman-cli](), [tool](), [verify](), [work]() ### AI overview This article explains loop engineering as a way to improve AI coding agent reliability. Instead of relying on a single prompt, the system repeatedly generates code, runs it against a real API or other source of truth, verifies the result, and decides whether to stop or continue. The article distinguishes this outer verification loop from the inner ReAct tool-use cycle and presents a reproducible setup for allowing an agent to correct its own mistakes. ### Source excerpt Stop prompting your AI agent, start looping. A guide to loop engineering: wire a real API call in as the oracle so generated code stops guessing. The post Loop engineering: stop prompting, start looping appeared first on Postman Blog. ## Catching Salesforce Custom Field Drift With the Postman AI Engineer DevFeed: [Catching Salesforce Custom Field Drift With the Postman AI Engineer]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-09-03T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [Postman](), [Claude](), [Automation](), [API](), [Front end](), [OpenAPI Specification](), [GitHub](), [Back end](), [Pull Request](), [payload](), [Slack]() Tags: [ai](), [ai-automation](), [api](), [api-drift](), [backend](), [code](), [frontend](), [general](), [github](), [payload](), [postman-agent-mode](), [pull-request](), [salesforce](), [slack]() ### AI overview This Postman Blog article explains how a Salesforce custom field caused drift between an API collection, frontend code, and an OpenAPI specification. It describes using the Postman AI Engineer to diagnose the failing request and Postman AI Automation to update the affected artifacts and add tests through a GitHub pull request. ### Source excerpt A Salesforce custom field broke my app. See how Postman Agent Mode found the drift and how a Skill kept it from happening again. The post Catching Salesforce Custom Field Drift With the Postman AI Engineer appeared first on Postman Blog. ## How AI Agents Discover and Integrate Public APIs DevFeed: [How AI Agents Discover and Integrate Public APIs]() Original publisher: [Read original article]() Author: Anthony Viard Published: 2026-09-02T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [AI Agent](), [API](), [Postman](), [MCP]() Tags: [ai-agent](), [ai-agents](), [api](), [api-discovery](), [apis](), [general](), [integration](), [mcp](), [model-context-protocol](), [orbit]() ### AI overview The article presents Orbit by Postman, which lets developers and AI agents discover public API endpoints by describing a desired workflow in plain language. Orbit evaluates endpoint capabilities, identifies gaps, and generates integration details such as authentication, URLs, parameters, response shapes, execution order, and implementation pitfalls. It can be accessed through search and integration endpoints or via the Model Context Protocol (MCP). ### Source excerpt I couldn't name the API my feature needed. Orbit found it in one search, then handed me the request bodies and the three bugs I'd have shipped. The post How AI Agents Discover and Integrate Public APIs appeared first on Postman Blog. ## An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation DevFeed: [An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation]() Original publisher: [Read original article]() Author: Renzon Cruz, Nicolas Bareil, Eric Semaan and Omar Jbari Published: 2026-09-02T10:00:46Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security Attacks](), [Large Language Model](), [CI/CD]() Tags: [agentic](), [agentic-ai](), [ai](), [ai-agents](), [attacks](), [autonomous](), [breach](), [ci-cd](), [enterprise](), [frontier-ai](), [general](), [insights](), [llm](), [secrets](), [security](), [threat-research]() ### AI overview An investigation of a ransom attack in which a human attacker used AI agents and frontier models to automate intrusion, reconnaissance, credential theft, and CI/CD pipeline abuse against an enterprise network. ### Source excerpt Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend against agentic attacks. The post An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation appeared first on Unit 42. ## Finding three-way API drift with the AI Engineer DevFeed: [Finding three-way API drift with the AI Engineer]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-09-01T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [Postman](), [OpenAPI Specification](), [Claude](), [Tooling](), [client](), [servers]() Tags: [ai-engineer](), [api](), [api-drift](), [apis](), [ci](), [fintech](), [general](), [openapi](), [postman-ai-engineer](), [production](), [qa]() ### AI overview The article explains how to detect three-way API drift by comparing an OpenAPI specification, the requests in Postman Collections, and the responses returned by a running server. It argues that pairwise checks can miss cases where all three sources disagree, and describes using Postman AI Engineer and the Context Graph to identify these inconsistencies. ### Source excerpt Find three-way API drift with Postman AI Engineer and the Context Graph. Compares your OpenAPI spec, collection requests, and live server responses. The post Finding three-way API drift with the AI Engineer appeared first on Postman Blog. ## MAST in the Age of Open Source Software |Guardsquare DevFeed: [MAST in the Age of Open Source Software |Guardsquare]() Original publisher: [Read original article]() Author: Simon Haven - Product Marketing Manager Published: 2026-09-01T10:59:01Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Open Source](), [Mobile Security](), [Application Security](), [Vulnerabilities](), [Social engineering](), [npm]() Tags: [app-security-testing](), [application-security](), [appsweep](), [general](), [malware](), [mobile](), [mobile-apps](), [npm](), [open-source](), [open-source-software](), [social-engineering](), [supply-chain](), [vulnerabilities]() ### AI overview This article explains why mobile application security testing is important when apps use free and open source software. It describes how vulnerable, deprecated, compromised, and transitive third-party dependencies can expand an app's attack surface, citing a September 2025 npm supply chain attack as an example. ### Source excerpt Building with free and open source software (FOSS) has become common practice for app developers. In 2022, it was estimated that between 70% and 90% of any given software codebase was made up of open source components. Leveraging open source projects presents many advantages: ## QE Platform Strategy: 3 Paths and Where Each Hides Its Cost DevFeed: [QE Platform Strategy: 3 Paths and Where Each Hides Its Cost]() Original publisher: [Read original article]() Author: Rick Crawford Published: 2026-08-31T17:37:05Z Content type: opinion Language: en Sources: [Postman Blog]() Topics: [Testing](), [Software Engineering](), [Development](), [Artificial Intelligence](), [Open Source]() Tags: [ai](), [api-testing](), [blog](), [development](), [general](), [open-source](), [qe-program](), [quality-engineering](), [sdlc](), [software-engineering](), [strategy](), [testing]() ### AI overview This opinion article compares three QE platform strategies: continuing with the current approach, building an internal platform, or integrating specialized tools. It explains the hidden costs of each path, including test maintenance, delayed releases, escaped defects, long-term platform maintenance, dependency updates, security patches, and the need to modernize for AI-assisted testing. ### Source excerpt In Part 1 I named the six structural problems compounding inside QE programs as AI accelerates development. In Part 2 I walked... The post QE Platform Strategy: 3 Paths and Where Each Hides Its Cost appeared first on Postman Blog. ## Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety DevFeed: [Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety]() Original publisher: [Read original article]() Author: Tony Li, Hongliang Liu and Yuhao Wu Published: 2026-08-28T22:00:07Z Content type: article Language: en Sources: [Unit 42]() Topics: [Large Language Model](), [ai safety](), [Machine Learning, Security Attacks](), [Security](), [Artificial Intelligence](), [Reinforcement learning](), [human feedback]() Tags: [ai](), [ai-safety](), [benchmark](), [benchmarks](), [external](), [general](), [insights](), [internals](), [jailbreak](), [llm](), [llms](), [model](), [optimization](), [research](), [safety](), [security]() ### AI overview The article presents perturbation probing, a low-cost method for identifying neurons causally responsible for targeted behaviors in aligned large language models. It reports that very small neuron subsets control refusal or false-agreement behaviors, suggesting that LLM safety can be fragile and concentrated rather than broadly distributed. ### Source excerpt New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security. The post Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety appeared first on Unit 42. ## Introducing Orbit: Turn Any Task Into the Right API Calls DevFeed: [Introducing Orbit: Turn Any Task Into the Right API Calls]() Original publisher: [Read original article]() Author: Abhinav Asthana Published: 2026-08-27T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [MCP Server](), [Artificial Intelligence](), [MCP](), [Postman](), [REST API](), [Claude Code]() Tags: [agents](), [ai](), [ai-agents](), [api-discovery](), [blog](), [free](), [general](), [mcp](), [mcp-server](), [model-context-protocol](), [orbit](), [post](), [rest-api]() ### AI overview Postman introduces Orbit, a free API discovery tool for AI agents. Agents can describe a task to find suitable public API endpoints, then select an endpoint and receive an integration brief covering authentication, URLs, request steps, parameters, response codes, dependencies, and common pitfalls. Orbit is available as an MCP server and a REST API, with no account, API key, or OAuth setup required. ### Source excerpt Orbit is a free API discovery tool for AI agents. Describe a task, get the endpoints that fit, then get a task brief to integrate them. No account, no auth. The post Introducing Orbit: Turn Any Task Into the Right API Calls appeared first on Postman Blog. ## Happy 20th Birthday, Amazon EC2 DevFeed: [Happy 20th Birthday, Amazon EC2]() Original publisher: [Read original article]() Author: Channy Yun (윤석찬) Published: 2026-08-25T16:11:02Z Content type: article Language: en Sources: [AWS News Blog]() Topics: [Amazon EC2](), [Inference Performance]() Tags: [ai-inference](), [amazon-cloudwatch](), [amazon-ec2](), [amazon-ec2-mac-instances](), [apple](), [aws](), [aws-inferentia](), [aws-local-zones](), [aws-outposts](), [aws-trainium](), [cloud](), [cloud-computing](), [general](), [generative-ai](), [graviton](), [infrastructure](), [intel](), [linux](), [news](), [nitro-system](), [performance]() ### AI overview AWS marks Amazon EC2's 20th anniversary by reviewing its evolution from a single Linux virtual-server instance to a global service with more than 1,200 instance types. The article highlights foundational services, expanded deployment options, and AWS-designed silicon for AI inference and training. ### Source excerpt On the 20th Anniversary, we recognize how AWS has continued to push the boundaries of what cloud computing can deliver, building custom silicon for general-purpose and AI workloads and expanding EC2 into new form factors and deployment models that our customers in 2006 could not have imagined. ## Why AI coding agents need context graphs DevFeed: [Why AI coding agents need context graphs]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-08-25T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [AI-assisted coding](), [Graphs](), [coding](), [API](), [internal developer platform](), [context window](), [long-context]() Tags: [ai-coding-agents](), [api-governance](), [apis](), [context-window](), [developer](), [developer-platform](), [engineering](), [general](), [graphs](), [knowledge-graphs]() ### AI overview The article argues that AI coding agents struggle in real codebases primarily because they lack access to a knowledge graph connecting code, APIs, services, ownership, dependencies, policies, and related organizational context. It describes service catalogs, API registries, ownership maps, dependency graphs, and internal developer platforms as different forms of the same underlying structure. It also argues that simply increasing the context window does not solve retrieval and context-quality problems. ### Source excerpt AI coding agents don't fail from small context windows. They fail without a knowledge graph of your code, APIs, and vendors. The post Why AI coding agents need context graphs appeared first on Postman Blog. ## How Postman Passport keeps API secrets inside your network DevFeed: [How Postman Passport keeps API secrets inside your network]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-08-24T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [Postman](), [API keys](), [Security](), [Architecture & Design](), [Network]() Tags: [api](), [api-keys](), [api-security](), [architecture](), [general](), [network](), [postman-passport](), [secret-store](), [secrets](), [secrets-management](), [security](), [token]() ### AI overview Postman Passport keeps real API secrets inside an organization's network by issuing credential references instead of exposing underlying keys. An internal proxy resolves the references, injects the credentials, and forwards requests while cryptographically binding references to their authorized holders. ### Source excerpt Postman Passport grants API access using credential references, keeping the real secret inside your network. Here's how the architecture works. The post How Postman Passport keeps API secrets inside your network appeared first on Postman Blog. ## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain]() Original publisher: [Read original article]() Author: Yaron Avital Published: 2026-08-21T23:00:21Z Content type: article Language: en Sources: [Unit 42]() Topics: [sdlc](), [Security](), [Application Security](), [CI/CD](), [GitHub Actions](), [npm](), [Bun](), [Python](), [Claude Code](), [vs-code](), [Claude](), [Ethereum]() Tags: [blockchain](), [c2](), [chaindrop](), [ci-cd](), [claude-code](), [general](), [github-actions](), [insights](), [malware](), [npm-packages](), [persistence](), [python](), [sdlc](), [security](), [software-supply-chain-attack](), [supply-chain](), [vs-code]() ### AI overview Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure. ### Source excerpt Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42. ## 5 QE Pipeline Metrics That Show Where Quality Is Leaking DevFeed: [5 QE Pipeline Metrics That Show Where Quality Is Leaking]() Original publisher: [Read original article]() Author: Rick Crawford Published: 2026-08-21T15:00:10Z Content type: article Language: en Sources: [Postman Blog]() Topics: [Development](), [Postman]() Tags: [api-testing](), [developer](), [development](), [false-positives](), [general](), [metrics](), [packages](), [policy](), [production](), [qe-program](), [quality-engineering](), [sdlc](), [shift-left](), [validation]() ### AI overview This developer article presents five quality-engineering pipeline metrics aligned with Design, Gate, Validate, Monitor, and Improve stages. The supplied text details package adoption, gate coverage and flake rate, and defect escape rate, explaining how they reveal uneven coverage, ineffective merge gates, false positives, and defects reaching production. ### Source excerpt In the last post I described six problems that compound when development outruns the QE infrastructure underneath it. Most leaders recognize all... The post 5 QE Pipeline Metrics That Show Where Quality Is Leaking appeared first on Postman Blog. ## The prompts only the Postman AI Engineer can answer DevFeed: [The prompts only the Postman AI Engineer can answer]() Original publisher: [Read original article]() Author: Talia Kohan Published: 2026-08-20T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [Claude](), [Postman](), [Graphs](), [API](), [OpenAPI Specification](), [monitor](), [React]() Tags: [ai](), [ai-agents](), [api](), [apis](), [general](), [monitor](), [openapi](), [postman-ai-engineer](), [react]() ### AI overview This Postman Blog article presents the Postman AI Engineer as a natural-language interface over the Postman Context Graph. It describes prompts that trace identifiers across APIs, collections, runtime monitor results, repositories, and React dashboards, as well as prompts that expose specification-versus-code drift and three-way discrepancies involving live server responses. ### Source excerpt The Postman AI Engineer prompts that trace an ID across your APIs, catch three-way drift, and auto-write a PR review from the graph. The post The prompts only the Postman AI Engineer can answer appeared first on Postman Blog. ## Develop and test MCP in Postman: jhipster-mcp in action DevFeed: [Develop and test MCP in Postman: jhipster-mcp in action]() Original publisher: [Read original article]() Author: Anthony Viard Published: 2026-08-19T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [Model Context Protocol](), [Postman](), [Spring Boot](), [Node.js](), [TypeScript](), [Angular](), [React](), [Vue.js](), [JSON](), [Remote Procedure Call (RPC)]() Tags: [ai-agents](), [angular](), [apache](), [cli](), [general](), [jhipster](), [json](), [mcp](), [node-js](), [open-source](), [post](), [react](), [rpc](), [spring-boot](), [typescript](), [vue]() ### AI overview This Postman developer article demonstrates jhipster-mcp, an open-source MCP server that exposes the JHipster generator to MCP clients. It uses Postman's MCP client to test tools, prompts, and resources for generating and evolving Spring Boot applications from JDL. ### Source excerpt Drive the jhipster-mcp server from Postman's MCP client to test tools, prompts, and resources before handing them to an AI agent. Try it today. The post Develop and test MCP in Postman: jhipster-mcp in action appeared first on Postman Blog. ## Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) DevFeed: [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-18T19:05:33Z Content type: article Language: en Sources: [Unit 42]() Topics: [Credential theft](), [password spraying](), [MFA](), [Microsoft](), [Incident response]() Tags: [credential-based-attacks](), [credential-theft](), [general](), [high-profile-threats](), [identity](), [incident](), [incident-response](), [mfa](), [microsoft](), [password-spraying](), [thehatman]() ### AI overview This threat brief examines large-scale credential attacks, including password spraying campaigns and claimed credential theft from Microsoft Entra tenants. It provides guidance for identifying suspicious login activity, auditing remote access logs, and hardening internet-exposed edge devices. ### Source excerpt In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42. ## Scratch a simple data model, find a complex one DevFeed: [Scratch a simple data model, find a complex one]() Original publisher: [Read original article]() Author: jonskeet Published: 2026-08-14T10:09:48Z Content type: opinion Language: en Sources: [Jon Skeet]() Topics: [data]() Tags: [complex](), [data](), [general](), [model](), [real-world]() ### AI overview The article examines how a data model that initially appears simple becomes more complex when it must represent the Bible across English translations, differing book sets, alternate book titles, chapters, and verses. ### Source excerpt I seem to have a knack for discovering corner cases - or in many situations being a corner case. One category of this is where I find myself using a data model which appears simple to start with - and then the real world interferes. I've always found this sort of thing interesting, and recently ... Continue reading Scratch a simple data model, find a complex one -> ## Best Kubernetes Infrastructure as Code Tools in 2026 DevFeed: [Best Kubernetes Infrastructure as Code Tools in 2026]() Original publisher: [Read original article]() Author: Pulumi Content Team Published: 2026-08-14T00:00:00Z Content type: comparison Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Kubernetes](), [Terraform](), [argo-cd](), [Helm charts](), [GitOps](), [flux](), [opentofu](), [Amazon EKS](), [AWS CloudFormation](), [VPC](), [AWS IAM]() Tags: [argo-cd](), [cloudformation](), [code](), [comparisons](), [devops](), [flux](), [general](), [gitops](), [helm](), [helm-charts](), [iam](), [infrastructure](), [infrastructure-as-code](), [kubernetes](), [opentofu](), [platform-engineering](), [terraform](), [vpc]() ### AI overview This comparison explains that Kubernetes infrastructure as code spans cluster and cloud provisioning, in-cluster workload definition, and continuous delivery and reconciliation. It presents Pulumi and Terraform or OpenTofu as general-purpose provisioning options, Helm and Kustomize for workload templating, and Argo CD and Flux for GitOps reconciliation. ### Source excerpt There is no single best Kubernetes infrastructure as code tool, because "Kubernetes IaC" actually spans three different jobs. For provisioning the cluster and its cloud dependencies, Pulumi and Terraform (or OpenTofu) are the strongest general-purpose options. For templating and packaging workloads, Helm and Kustomize dominate. For continuous reconciliation once things are running, Argo CD and Flux lead the GitOps category. The right stack usually combines one tool from each layer, not a single tool that claims to do all three. What counts as infrastructure as code for Kubernetes? Kubernetes infrastructure as code work splits into three layers that get conflated constantly, and the confusion is where most tool comparisons go wrong. The cluster and cloud layer provisions the things Kubernetes itself sits on top of: the managed control plane (EKS, GKE, AKS), node pools, the VPC and subnets, IAM roles, load balancers, and cluster add-ons. Terraform, Pulumi, and cloud-native tools like CloudFormation operate here. The in-cluster workload layer defines what runs on the cluster once it exists: Deployments, Services, ConfigMaps, CustomResourceDefinitions, and the Helm charts or Kustomize overlays that template them. This is where Helm, Kustomize, and Crossplane's custom resources live. The delivery and reconciliation layer keeps what's declared in Git in sync with what's actually running on the cluster, continuously, rather than as a one-shot apply. Argo CD and Flux own this layer, and they consume the output of the other two rather than replacing them. Most real Kubernetes platforms use tools from at least two of these layers together. A team might provision EKS with Terraform, package its application with Helm, and let Argo CD reconcile it continuously. Knowing which layer a tool actually addresses, rather than treating "Kubernetes IaC" as one shopping list, is the first decision that matters. Pulumi provisions the cluster and the workloads on it in the same language Pul ## Terraform and Kubernetes: A Practical Guide for 2026 DevFeed: [Terraform and Kubernetes: A Practical Guide for 2026]() Original publisher: [Read original article]() Author: Pulumi Content Team Published: 2026-08-07T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Kubernetes](), [Terraform](), [Provisioning](), [Testing](), [Artificial Intelligence]() Tags: [ai](), [ai-agents](), [deployment](), [general](), [guide](), [infrastructure-as-code](), [kubernetes](), [platform-engineering](), [provisioning](), [terraform](), [testing]() ### AI overview A practical guide to using Terraform with Kubernetes, covering the Kubernetes provider, provisioning workflows, testing, policy, deployment, and the role of AI agents. It explains limitations including provider ordering and the need for Kubernetes API access during planning. ### Source excerpt Yes, Terraform can manage Kubernetes: the official hashicorp/kubernetes provider lets you declare Deployments, Services, and other objects as HCL resources, and community providers like kubectl fill in the gaps. It works well for many teams. The friction shows up around two well-documented limits -- provider ordering and plan-time API access -- and around testing, where a general-purpose language changes what's possible. That friction matters more in 2026 than it did a few years ago. Kubernetes infrastructure now sits next to AI-driven engineering workflows: agents that propose changes, run previews, and open pull requests need infrastructure code they can read, test, and reason about with the same tools they use for application code. A cluster definition written in HCL and a workload definition written in YAML are both harder for an agent -- and a person -- to unit test, refactor, or type-check than the equivalent in TypeScript, Python, or Go. This guide is about the operating model for Kubernetes infrastructure: how the cluster, the platform layer, and the workloads on top of it get provisioned, tested, and shipped. It's a different question from "should I write my Kubernetes manifests in YAML, HCL, or a real language," which we cover in detail in YAML, Terraform, or Pulumi: what's the smart choice for deployment automation with Kubernetes? Read that post first if you're deciding how to author manifests; read this one for the wider workflow -- provisioning, testing, policy, and where AI agents fit. How does Terraform manage Kubernetes today? The hashicorp/kubernetes provider (current release v3.2.1, requiring Terraform 1.0.0 or later) is the primary path, and teams typically combine it with one or two others depending on what they're deploying: Approach What it's for Notes Typed resources (kubernetes_deployment_v1, kubernetes_service_v1, etc.) Core, well-known object types Full HCL validation and typed attributes for the objects the provider models explicitly kubernete [Next page]()