# IaC Published articles for IaC. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 9 things to consider before choosing an IaC platform in 2026 DevFeed: [9 things to consider before choosing an IaC platform in 2026]() Original publisher: [Read original article]() Author: Jonah Kowall Published: 2026-08-26T14:33:56Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Infrastructure as code](), [Architecture & Design](), [Provisioning](), [Cloud](), [Terraform]() Tags: [2026](), [ci](), [cloud](), [evaluation](), [iac](), [infrastructure](), [infrastructure-as-code](), [opentofu](), [policy](), [terraform](), [workflows]() ### AI overview This 2026 article presents nine considerations for evaluating an infrastructure as code platform. It emphasizes that mature IaC now involves coordinating changes, managing access, enforcing policies, reviewing infrastructure changes, and keeping environments synchronized--not only provisioning cloud resources. It recommends assessing whether a platform is necessary, examining its execution layer and scalability, testing it under concurrent workloads and failures, and ensuring that engineers beyond the platform builder can use it effectively. ### Source excerpt IaC platform evaluation in 2026: nine things to test, from execution and dependency handling to policy enforcement, support quality and AI workflows. ## Pulumi Context API: query your infrastructure as a graph DevFeed: [Pulumi Context API: query your infrastructure as a graph]() Original publisher: [Read original article]() Author: Levi Blackstone Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [API](), [Graphs](), [Cloud APIs](), [infrastructure as code (IAC)](), [Command-line interface](), [JSON](), [pulumi-neo]() Tags: [agent](), [ai-agents](), [api](), [cli](), [features](), [graph](), [iac](), [infrastructure-as-code-iac](), [json](), [product](), [pulumi](), [pulumi-cloud](), [pulumi-neo](), [rest-api]() ### AI overview Pulumi is launching the Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. Available in public preview for Enterprise and Business Critical organizations, it supports infrastructure-impact, coverage, and cleanup queries through the Pulumi CLI or REST API. Pulumi Neo uses it out of the box, and other authenticated agents can access its schema and query guidance. ### Source excerpt Every platform team fields the same questions: What is running? What breaks if we change this? What can we safely delete? The answers exist, but they're scattered across state files, cloud consoles, and the memories of whoever set things up. Today we're launching the Pulumi Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. It's designed agent-first: Pulumi Neo, our infrastructure agent, uses it out of the box, and other agents can fetch the current graph vocabulary and query guidance on demand. It's available in public preview for organizations on the Enterprise and Business Critical editions. Answers that follow infrastructure relationships Pulumi already records the resources your programs manage, their dependencies, how stacks consume each other's outputs, and the resources Pulumi Discovery finds outside infrastructure as code (IaC). The Context API connects this data so you can ask questions that depend on the relationships: Impact: Which stacks are affected if we upgrade this provider? If this stack changes, what consumes its outputs? Coverage: How much of our infrastructure lives outside IaC, and in which accounts? Cleanup: Which stacks have no dependents and are candidates for retirement? A query is a JSON document with a handful of clauses. anchor names the starting nodes, traverse follows relationships from there, and return chooses what comes back. You can run a query through the Pulumi CLI or REST API. Here's a selector that starts from AWS provider instances older than version 7.0.0 and follows incoming provided_by relationships back to the visible resources they manage: { "anchor": { "nodeType": "resource", "match": { "type": "pulumi:providers:aws", "fields": { "provider_version": { "op": "lt", "value": "7.0.0" } } } }, "traverse": [ { "edgeTypes": ["provided_by"], "direction": "in", "alias": "managed" } ], "return": { "select": ["anchor", "managed"] } } A response for one m ## Practical AI in Platform Engineering: lessons from Port's latest meetup DevFeed: [Practical AI in Platform Engineering: lessons from Port's latest meetup]() Original publisher: [Read original article]() Author: Matar Peles Published: 2026-08-10T11:42:45Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [Platform Engineering](), [Artificial Intelligence](), [AI-assisted coding](), [Code review](), [sdlc](), [Code generation](), [Incident response](), [Infrastructure as code](), [Security](), [vulnerability]() Tags: [agentic](), [ai](), [ai-coding](), [engineering](), [iac](), [ide](), [incident-response](), [platform-engineering](), [review](), [sdlc](), [security](), [testing]() ### AI overview Port's Tel Aviv meetup examined how engineering organizations are adopting AI in platform engineering. Speakers discussed agentic workflows for bug triage, platform requests, and the SDLC, while an anonymous survey measured AI maturity, production deployments, evaluation practices, human oversight, and concerns about autonomy. Most teams reported having a few SDLC agents but not scaling them broadly; code review and code generation were the most common production uses, while operational applications such as infrastructure, security, and incident response lagged behind. ### Source excerpt We hosted a meetup with engineering leaders working on AI inside their orgs and ran an anonymous survey. Here's what came out of it. ## Terraform Scalability: When IaC Outgrows Your Setup DevFeed: [Terraform Scalability: When IaC Outgrows Your Setup]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Terraform](), [Infrastructure as code](), [Scalability](), [iac-security]() Tags: [dynamodb](), [harness](), [iac](), [s3](), [scalability](), [security](), [terraform]() ### AI overview This article examines how Terraform scalability challenges emerge as infrastructure code and teams grow. It discusses bottlenecks involving state management, collaboration, governance, large state files, locking, plan times, module sprawl, and version drift, and introduces Harness IaCM as a management solution. ### Source excerpt Terraform scalability issues slow teams down. Learn how to overcome IaC bottlenecks with better management. See how Harness helps. | Blog ## Pulumi Cloud Adds Terraform Backend Support for Agentic Infrastructure DevFeed: [Pulumi Cloud Adds Terraform Backend Support for Agentic Infrastructure]() Original publisher: [Read original article]() Author: Daniel Perlovsky Published: 2026-08-04T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Terraform](), [Infrastructure as code](), [opentofu](), [Cloud](), [Deployment]() Tags: [agentic](), [agents](), [ai-agents](), [cloud](), [deployment](), [enterprise](), [hcl](), [iac](), [infrastructure-as-code](), [opentofu](), [platform](), [product](), [pulumi-cloud](), [terraform]() ### AI overview Pulumi announces general availability of Pulumi Cloud as a backend for Terraform state. The release supports existing Terraform deployment patterns while adding Pulumi Cloud capabilities such as remote runs, visibility, manual approvals, and scalable access management. ### Source excerpt At Pulumi, we are building the platform for agentic infrastructure. Pulumi Cloud provides the guardrails and enterprise readiness needed to safely move fast in this new era. While we are seeing extraordinary adoption -- over 40% of our users now manage infrastructure using AI agents -- we know many organizations are at different phases in their AI journey and have to balance building for the future with maintaining their existing infrastructure as code (IaC) solutions like Terraform. Today, we are launching three ways that Pulumi lets you avoid trading off building for the future against building for today. You don't have to rip out Terraform to enter the agentic era. Pulumi Cloud brings agentic infrastructure to the IaC estate you already have. What we're shipping today Last December, our CEO Joe Duffy laid out his vision to make Pulumi the platform for all of your infrastructure as code. The capabilities we are launching today make that promise a reality. Pulumi is now fully interoperable with Terraform and OpenTofu and enables organizations to build upon their existing IaC estate rather than starting from scratch as they work toward the agentic infrastructure future. Pulumi Cloud as a Terraform backend We are excited to announce the general availability of Pulumi Cloud as the backend to your Terraform state, enabling organizations to seamlessly lift and shift their existing Terraform estates. We recognize there is lots of infrastructure that works as is, and switching over to a new management paradigm may not always be possible. Pulumi Cloud support for the Terraform state backend lets organizations maintain their existing Terraform deployment patterns while also unlocking the power of Pulumi Cloud. The following common patterns for running Terraform are now supported: Plans and applies run remotely by default for new Terraform stacks, following the behavior of HCP Terraform and Terraform Enterprise. When you run a Terraform operation, it executes on a Pulumi-hoste ## Using Pulumi With an Internal Developer Portal | Port DevFeed: [Using Pulumi With an Internal Developer Portal | Port]() Original publisher: [Read original article]() Author: Mor Paz Published: 2026-07-30T10:17:19Z Content type: tutorial Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [internal developer portal](), [Infrastructure as code](), [Provisioning](), [GitOps](), [DevOps](), [Architecture & Design]() Tags: [building](), [catalog](), [developer](), [developer-portal](), [developers](), [devops](), [how-to](), [iac](), [infrastructure](), [infrastructure-as-code](), [internal-developer-portal](), [learn](), [platform](), [provisioning](), [resources](), [software](), [software-catalog]() ### AI overview This tutorial explains how internal developer portals can make infrastructure as code easier and safer for developers. It describes using a software catalog and reusable self-service actions to abstract IaC details and provision developer environments, with Pulumi and Port as the example. ### Source excerpt Internal developer portals can close the IaC and developer loop. Let's look at a live example of how to use Pulumi and internal developer portals. ## Migrate CloudFormation to Pulumi with Discovered Stacks DevFeed: [Migrate CloudFormation to Pulumi with Discovered Stacks]() Original publisher: [Read original article]() Author: Alejandro Cotroneo Published: 2026-07-30T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [AWS CloudFormation](), [migration](), [Amazon Web Services](), [VPC](), [Amazon S3](), [DynamoDB](), [AWS IAM]() Tags: [aws](), [cloudformation](), [dynamodb](), [git](), [iac](), [iam](), [import](), [insights](), [kms](), [migration](), [pulumi](), [pulumi-cloud](), [pulumi-neo](), [s3](), [tutorials](), [vpc]() ### AI overview A tutorial shows how to migrate a 61-resource AWS CloudFormation stack to Pulumi using Discovered Stacks in Pulumi Cloud. It explains how to find the stack, review migration status, start the migration, resolve unmatched resources, and verify the result with a zero-diff pulumi preview. ### Source excerpt With Discovered Stacks, Pulumi Cloud does the bookkeeping for a CloudFormation migration: every resource in the stack gets an explicit migration status, and the migration is done when the code provably matches the cloud. In this tutorial, we take one real CloudFormation stack from discovered to migrated and managed by Pulumi IaC, end to end. What we're migrating Our example is payments-api, a CloudFormation stack with 61 resources: a VPC, an Aurora ledger database behind an RDS Proxy, an assets S3 bucket, a DynamoDB ledger table, a Kinesis payment-events pipeline, and the IAM roles, KMS keys, and secrets that wire them together. The plan has five steps: Find the stack in Pulumi Cloud. Review the migration breakdown at a glance. Start the migration. Resolve the stragglers, so every resource is accounted for. Confirm the quality gate: a zero-diff pulumi preview. We'll use Pulumi Neo to do the heavy lifting, but nothing here depends on it. The same flow works with your own coding agent or entirely by hand, because migration status is derived from actual stack state -- however the work gets done, the console shows the same progress. Step 1: Find your stack in Pulumi Cloud Discovered Stacks builds on Discovery, so the only prerequisite is a scanned cloud account -- the AWS account holding your CloudFormation stacks. Once a scan has run, open the Stacks page and turn on Show Discovered Stacks. Your CloudFormation stacks appear alongside your Pulumi stacks. The project name comes from the CloudFormation stack (payments-api), and the stack name encodes the account and region it came from, so the same template deployed to two regions shows up as two distinct discovered stacks. Step 2: Plan the migration at a glance Open the discovered stack's Migration tab. It lays out all 61 resources of payments-api by status, so you can visualize the migration before touching anything: 54 Ready: mapped to a Pulumi type and confirmed to exist -- importable right now. 2 Not found: mapped, but ## Install Terraform: Secure & Scalable IaC Setup Guide DevFeed: [Install Terraform: Secure & Scalable IaC Setup Guide]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-07-24T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [Terraform](), [Infrastructure as code](), [iac-security](), [Scalability](), [Automation](), [Command-line interface]() Tags: [cli](), [guide](), [iac](), [infrastructure-as-code](), [install](), [scalability](), [security](), [terraform]() ### AI overview A guide to installing Terraform across platforms with security hardening and scalability in mind. It covers installation, configuration, state management, secret handling, version control, team workflows, and production-oriented infrastructure automation. ### Source excerpt Learn to install Terraform with security and scalability built in. Master IaC automation setup from start to finish. See how Harness helps. | Blog ## Call for Proposals (CfP) open: Speak at PlatformCon 2026! DevFeed: [Call for Proposals (CfP) open: Speak at PlatformCon 2026!]() Original publisher: [Read original article]() Author: Luca Galante Published: 2026-07-23T05:40:01Z Content type: news Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [GitOps](), [Infrastructure as code](), [Kubernetes](), [Tooling](), [Security]() Tags: [2026](), [conference](), [event](), [iac](), [kubernetes](), [platform-engineering](), [security]() ### AI overview PlatformCon 2026 has opened its Call for Proposals for virtual pre-recorded talks and live workshops focused on platform engineering. The event seeks practical experiences, architectural insights, platform tooling, and real-world technology combinations. ### Source excerpt The PlatformCon 2026 Call for Proposals (CfP) is open! Submit your talk or workshop proposal to share your platform engineering insights. ## Why defining infrastructure is the prerequisite for autonomous cloud operations DevFeed: [Why defining infrastructure is the prerequisite for autonomous cloud operations]() Original publisher: [Read original article]() Author: Oved Lourie Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Infrastructure as code](), [Cloud](), [Large Language Model](), [sdlc]() Tags: [autonomous](), [cloud](), [compliance](), [governance](), [here](), [iac](), [infrastructure](), [llms](), [operational](), [operations](), [platform-engineering](), [production](), [review](), [sdlc](), [workflows]() ### AI overview The article argues that autonomous cloud operations depend on clearly defined infrastructure. It describes the operational gap between infrastructure-as-code intent and deployed reality, including configuration drift, incomplete governance, compliance risk, and reliance on undocumented knowledge and manual processes. The article also explains that LLM-driven acceleration of the SDLC has increased infrastructure change faster than manual review can absorb. ### Source excerpt Autonomous cloud operations require legible infrastructure. Learn why defining your infrastructure ontology is the prerequisite for continuous governance and closing the Operational Gap between intent and reality ## 10 FinOps tools platform engineers should evaluate for 2026 DevFeed: [10 FinOps tools platform engineers should evaluate for 2026]() Original publisher: [Read original article]() Author: Ajay Chankramath Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [cloud cost management](), [finops](), [Platform Engineering](), [Kubernetes](), [GitOps](), [Infrastructure as code](), [Cloud](), [Provisioning]() Tags: [2026](), [cloud](), [cost](), [developer-experience](), [finops](), [iac](), [infrastructure](), [kubernetes](), [management](), [multi-cloud](), [optimization](), [platform](), [platform-engineering]() ### AI overview A guide to evaluating 10 FinOps platforms for platform engineering teams in 2026. It emphasizes Kubernetes-native cost attribution, API-first architecture, GitOps and IaC integration, developer experience, and the 4Rs framework: Report, Recommend, Remediate, and Retain. ### Source excerpt Evaluate 10 FinOps tools platform engineers need in 2026 for Kubernetes-native, multi-cloud cost optimization. Focus on API-first architecture, GitOps, and the 4Rs framework. ## Platform Product Management: AI-enabled vs. AI-native capability stacks DevFeed: [Platform Product Management: AI-enabled vs. AI-native capability stacks]() Original publisher: [Read original article]() Author: Poojitha Marreddy Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Product Management](), [code productivity](), [developer-productivity](), [Artificial Intelligence](), [Infrastructure as code](), [Terraform](), [DevSecOps](), [GitHub](), [Jenkins](), [Kubernetes]() Tags: [agents](), [ai](), [code](), [cognitive-load](), [configuration](), [developer](), [developer-productivity](), [devsecops](), [github](), [iac](), [jenkins](), [kubernetes](), [management](), [platform](), [product](), [productivity](), [terraform]() ### AI overview This article presents platform product management as a way to reduce developer cognitive load and improve delivery velocity. It contrasts AI-enabled capability stacks, which use AI to assist developers, with AI-native stacks, which run AI workloads; both depend on an internal developer platform but require different investments, governance, and success metrics. The article introduces the double diamond framework for discovering, defining, developing, and delivering platform capabilities. ### Source excerpt Platform PM framework: Shift from tool standardization to product thinking. Learn to build AI-enabled vs AI-native stacks to boost developer productivity ## Terraform vs OpenTofu: Which IaC tool fits your platform strategy? DevFeed: [Terraform vs OpenTofu: Which IaC tool fits your platform strategy?]() Original publisher: [Read original article]() Author: Mallory Haigh Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Infrastructure as code](), [Terraform](), [Platform Engineering](), [Provisioning](), [Open Source](), [configuration](), [Encryption]() Tags: [governance](), [hashicorp](), [iac](), [infrastructure-as-code](), [multi-cloud](), [open-source](), [opentofu](), [orchestration](), [platform-engineering](), [provisioning](), [strategy](), [terraform]() ### AI overview This guide compares Terraform and OpenTofu as infrastructure-as-code tools. It explains how HashiCorp's 2023 license change led to OpenTofu's creation as a Linux Foundation-governed fork, and frames the choice around platform engineering strategy, governance, licensing, state encryption, and long-term risk. ### Source excerpt HashiCorp's license change sparked the Terraform vs OpenTofu debate. Compare governance, licensing (BSL vs MPL 2.0), state encryption, and strategic fit for your platform engineering strategy. ## How to Troubleshoot and Debug Ansible Playbooks DevFeed: [How to Troubleshoot and Debug Ansible Playbooks]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-07-15T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [Ansible](), [debugging](), [Infrastructure as code](), [YAML]() Tags: [ansible](), [debugging](), [how-to](), [iac](), [infrastructure-as-code](), [troubleshooting](), [yaml]() ### AI overview This tutorial explains how to troubleshoot and debug Ansible playbooks. It covers structured and conditional debugging, verbosity controls, targeted variable inspection, reusable debugging roles, failure taxonomies, and CI/CD-friendly logging. It also describes common problems such as syntax errors, variable conflicts, connection errors, and inconsistent execution across hosts. ### Source excerpt Master how to debug Ansible with expert tips for troubleshooting playbooks. Learn structured debugging, reduce errors, and streamline Infrastructure Deployments | Blog ## Best Infrastructure as Code (IaC) Tools for 2026 DevFeed: [Best Infrastructure as Code (IaC) Tools for 2026]() Original publisher: [Read original article]() Author: Isaac Harris Published: 2026-07-05T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Provisioning](), [Terraform](), [opentofu](), [Software Engineering](), [Programming](), [AWS CloudFormation](), [Development]() Tags: [2026](), [aws](), [aws-cloudformation](), [azure](), [devops](), [general](), [google-cloud](), [iac](), [infrastructure-as-code](), [kubernetes](), [opentofu](), [programming](), [provisioning](), [pulumi](), [software-engineering](), [terraform]() ### AI overview A 2026 guide compares infrastructure as code tools including Pulumi, Terraform, OpenTofu, AWS CDK, AWS CloudFormation, Azure tools, Google Cloud Infrastructure Manager, Kubernetes YAML, and Crossplane. It discusses their approaches, licensing, pricing, AI-agent readiness, and tradeoffs, while explaining how IaC applies software engineering practices such as version control, testing, code review, and CI/CD to infrastructure management. ### Source excerpt The best infrastructure as code (IaC) tools in 2026 are Pulumi, Terraform, OpenTofu, AWS CDK, AWS CloudFormation, Azure ARM, Azure Bicep, Google Cloud Infrastructure Manager, Kubernetes YAML, and Crossplane. Each takes a different approach to defining and provisioning infrastructure, from general-purpose programming languages to declarative templates, and each carries distinct licensing, pricing, and AI-agent readiness tradeoffs worth weighing before you commit. Pulumi's own package registry lists hundreds of packages -- first-party providers, bridged Terraform providers, and community components -- illustrating how far multi-cloud coverage has expanded across the ecosystem. Since this post was published, Pulumi has added first-class support for HashiCorp Configuration Language (HCL). You can now write Pulumi programs in HCL directly, alongside general-purpose languages like TypeScript, Python, Go, and C#. To see how it works, see Pulumi HCL. As infrastructure complexity grows, teams increasingly seek approaches that provide the same developer productivity tools they use for application development. While template-based and domain-specific language approaches serve many use cases effectively, teams with complex requirements or programming backgrounds often find that general-purpose programming languages offer advantages in testing, abstraction, and collaboration. This comprehensive guide examines the most effective infrastructure as code tools available today, providing detailed analysis of core IaC platforms, complementary tools, and related technologies through the lens of software engineering best practices. Whether you're starting fresh with IaC or evaluating alternatives to overcome limitations in your current toolchain, we'll help you navigate this complex landscape and choose solutions that truly bring software engineering to infrastructure. Ready to try one of these approaches yourself? Get started with Pulumi for free and provision your first resource in minu ## How to Test Infrastructure as Code DevFeed: [How to Test Infrastructure as Code]() Original publisher: [Read original article]() Author: Alex Leventer Published: 2026-06-30T21:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Testing](), [Programming](), [Security]() Tags: [how-to](), [iac](), [infrastructure-as-code](), [pytest](), [security](), [testing]() ### AI overview This guide explains how to test infrastructure as code using unit tests with mocked cloud providers, integration tests against real resources, and policy checks. It shows how these testing layers can catch misconfigurations, security issues, drift, and regressions before infrastructure changes reach production. ### Source excerpt IaC testing means validating your infrastructure code the same way you test application software--unit tests with mocked cloud providers that run in milliseconds, integration tests that deploy and inspect real resources, and policy checks that enforce compliance rules on every preview and deploy. Together, these layers catch misconfigurations before they reach production. Untested infrastructure code is a liability. A missing tag in a security group rule, an S3 bucket with public read access, a misconfigured IAM policy--any of these can slip through code review and land in production. Infrastructure bugs are often harder to debug than application bugs, because the feedback loop is slow (deploy, observe, destroy) and the blast radius is large (an outage, a security incident, a surprise AWS bill). The good news: Pulumi is built on general-purpose programming languages, which means you can test infrastructure code with the exact same tools and frameworks you already use to test application code. No new language to learn. No separate toolchain. Just pytest, Mocha, or go test--pointing at your infrastructure program. This guide walks through all three testing layers with complete, runnable examples. Why should you test infrastructure as code? The case for testing application code is well-established. The case for testing IaC is just as strong--arguably stronger, because the consequences of an undetected bug are more severe. Catch misconfigurations before they deploy. A unit test that checks whether a security group allows SSH from 0.0.0.0/0 will catch that misconfiguration in milliseconds, before any cloud API call is made. The same test in CI catches it before the code is merged. Prevent drift and outages. Integration tests that deploy to a staging environment and validate runtime behavior--does the HTTP endpoint return 200? does the database accept connections?--give you confidence that an infrastructure change doesn't silently break a dependent service. Refactor safely. Wel ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## Azure Deployment Strategies & CI/CD Best Practices DevFeed: [Azure Deployment Strategies & CI/CD Best Practices]() Original publisher: [Read original article]() Author: Chinmay Gaikwad Published: 2026-06-09T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [Azure](), [Deployment](), [CI/CD](), [feature flags](), [GitOps](), [Infrastructure as code](), [observability]() Tags: [aks](), [azure](), [best-practices](), [ci](), [ci-cd](), [deployment](), [deployment-strategies](), [feature-flags](), [gitops](), [harness](), [iac](), [observability](), [progressive-delivery]() ### AI overview This guide explains Azure deployment strategies and CI/CD practices for safer software delivery. It covers canary, blue-green, and rolling deployments, feature flags, GitOps, infrastructure as code, pipeline controls, and observability-driven rollback, including examples involving AKS and other Azure workloads. ### Source excerpt Master Azure deployment with CI/CD, canary releases, feature flags, GitOps, and IaC. Learn how progressive delivery and Harness help teams ship faster, safer, and with fewer incidents. | Blog ## Future of IaC: Continuous Governance Through a Control Plane DevFeed: [Future of IaC: Continuous Governance Through a Control Plane]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Platform Engineering](), [Infrastructure as code](), [cloud-infrastructure](), [Provisioning](), [Terraform](), [GitOps](), [CI/CD]() Tags: [ci-cd](), [cloud](), [cloud-infrastructure](), [configuration](), [gitops](), [iac](), [infrastructure](), [platform-engineering](), [policy](), [provisioning](), [self-service](), [terraform]() ### AI overview This article explains why platform engineering teams are moving beyond point-in-time infrastructure provisioning toward continuous governance through infrastructure control planes. It focuses on reducing drift, enforcing policy, coordinating configuration and operational changes, and enabling safer self-service workflows. ### Source excerpt Learn how platform engineering teams use infrastructure control planes to reduce drift, enforce governance, and scale self-service safely. | Blog ## Generating a Pulumi Provider from an OpenAPI Spec DevFeed: [Generating a Pulumi Provider from an OpenAPI Spec]() Original publisher: [Read original article]() Author: Luke Ward Published: 2026-05-28T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [OpenAPI Specification](), [Infrastructure as code](), [API](), [SDKs]() Tags: [api](), [iac](), [infrastructure-as-code](), [openapi](), [product](), [pulumi](), [pulumi-cloud](), [release]() ### AI overview Pulumi announces version 1.0 of the Pulumi Service Provider, generated from the Pulumi Cloud OpenAPI specification. The release expands the provider's resource surface and adds infrastructure-as-code support for fine-grained RBAC, Pulumi IDP catalogs, and audit-log export. ### Source excerpt Today, we are announcing v1.0 of the Pulumi Service Provider: a major milestone in managing Pulumi Cloud with Pulumi itself. The provider is now generated directly from the Pulumi Cloud OpenAPI specification, unlocking a dramatically expanded pulumiservice:api/* resource surface and enabling Pulumi Cloud capabilities to become available in the provider faster than ever before. This release also brings several major new capabilities to infrastructure as code, including fine-grained RBAC as code, Pulumi IDP as code, and audit log export as IaC. Together, these changes make the Pulumi Service Provider the most powerful and extensible way yet to manage and automate your Pulumi Cloud infrastructure. Why this matters for users Historically, every new Pulumi Cloud feature implied a follow-up PR in the provider before that feature could be used from a Pulumi program. The provider was always slightly behind the API it wrapped, and entirely new capability areas could take months to land. The api/* surface changes both timelines. Because the schema is derived from the OpenAPI spec at runtime: Whole new resource families land in the provider the same release they reach Pulumi Cloud. New fields, features, and enum values on existing resources show up across all five language SDKs the soon after they appear in the spec. What's new in v1.0 v1.0 lifts whole capability areas of Pulumi Cloud into the api/* surface, not just incremental field additions. None of it required bespoke provider code. Fine-grained RBAC as code. Custom roles, organization membership, and team role assignments are now managed resources. For example, defining a read-only role and assigning it to a team: const readOnly = new ps.api.Role("readOnly", { orgName: "acme", name: "stack-reader", description: "Read-only access to stacks across the org.", uxPurpose: "role", details: { __type: "PermissionDescriptorAllow", permissions: ["stack:read", "stack:list"], }, }); new ps.api.teams.Role("readOnlyForPlatform", { org ## Technology Short Take 196 DevFeed: [Technology Short Take 196]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-22T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cybersecurity](), [Linux](), [Terraform](), [Artificial Intelligence](), [Ansible](), [Large Language Model](), [Cloud](), [cURL](), [npm]() Tags: [ai](), [ansible](), [article](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [curl](), [cybersecurity](), [data-center](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llms](), [networking](), [npm](), [oci](), [security](), [technologies](), [terraform]() ### AI overview Technology Short Take 196 is a curated list of articles about data center technologies, covering networking, servers and hardware, security, cloud management, operating systems, and applications. Topics include Ansible and IPSet, WireGuard and Headscale, a compromised Bitwarden CLI package on NPM, curl vulnerabilities, Terraform, AWS MCP Server, AI-assisted infrastructure as code, llama.cpp on Apple Silicon, Chrome's local AI model installation, Linux 7.0 and PostgreSQL, and Linux desktop voice typing. ### Source excerpt Welcome to Technology Short Take 196! Just in time for the US Memorial Day holiday, I am back with another list of articles related to various data center technologies like networking, security, operating systems, and applications. You will find articles on VPNs, Linux local privilege escalation (LPE) vulnerabilities, browser quirks and workarounds, the death of Terraform (again), and so much more. Enjoy your weekend reading! Networking Andrew Ward shares an Ansible role to block abusive subnets using IPSet. From this article on switching to WireGuard from Tailscale, I learned about Headscale (an open source implementation of the Tailscale control plane). Servers/Hardware Doug Dawson looks at some innovations that continue to improve computing power. Doug's article includes a few items I hadn't yet heard of. Security Bitwarden confirmed a compromise of its CLI package on NPM. First, we had CopyFail. Now we have Dirty Frag and Fragnesia. Daniel Stenberg talks about how Mythos found a single vulnerability--yes, just one--in curl. I don't really have words for this...security incident? That doesn't seem like the correct way to describe such a massive oversight, especially when you realize it happened to a cybersecurity agency. "Oops" doesn't even begin to describe it. Cloud Computing/Cloud Management Graham Gilbert insists Terraform is dead. I wonder what sorts of things the AWS MCP Server will make possible? William Collins argues in favor of AI through IaC rather than instead of it. I enjoyed this article. Collins indicates that while authoring IaC using LLMs is working rather well, managing infrastructure using LLMs is another story entirely. If you're at all interested in the intersection of LLMs and IaC, I'd add this to your reading list. Operating Systems/Applications Eric Sloof looks at using llama.cpp to run your own local, private AI stack on Apple Silicon. Mat Duggan examines his descent from artist to mercenary as a result of finding LLMs more useful than he exp ## Introducing pulumi do: Direct Resource Operations for Any Cloud DevFeed: [Introducing pulumi do: Direct Resource Operations for Any Cloud]() Original publisher: [Read original article]() Author: Christian Nunciato Published: 2026-05-22T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Command-line interface](), [Cloud](), [Provisioning](), [Amazon S3](), [Amazon Web Services]() Tags: [ai-agents](), [aws](), [cli](), [command-line](), [features](), [iac](), [infrastructure](), [infrastructure-as-code](), [product](), [product-launches](), [pulumi](), [pulumi-cli](), [s3]() ### AI overview Pulumi introduces pulumi do, a terminal command for direct cloud resource operations. It can create, read, update, delete, and query resources across Pulumi-supported providers without requiring a project, code, or state. The article also describes how pulumi do, Agent accounts, and Pulumi ESC can support ad-hoc infrastructure work and AI agent workflows. ### Source excerpt Infrastructure as code is the right model for production systems. State tracking, drift detection, and repeatable deployments all matter when you're managing real workloads. But sometimes, you also need a quick, one-off interaction with the cloud: create a bucket or a database, look up a VPC, delete a stray resource. Today we're introducing pulumi do, a new command for direct resource operations. With pulumi do, you can create, read, update, delete, and query any cloud resource from the terminal with a single command, across thousands of Pulumi-supported providers -- no project, code, or state required. The problem: Sometimes IaC is more than you need When you're managing production workloads, IaC is the proven solution. Code lets you declare complex systems, state tracking catches drift before it becomes a problem, dependency graphs sequence changes safely, and policy keeps everything in bounds. That full lifecycle, especially with the backing of a platform like Pulumi Cloud, is exactly what you want to build systems that scale. But when you (or your coding agent) need an ad-hoc Postgres database, the simplest path with IaC still takes several steps: make a directory, create a project, configure your credentials, write the code, preview, deploy. It works, but it's not always necessary for what should be a simple operation. pulumi do collapses all of those steps into one, using the same Pulumi providers, resource model, and ecosystem that powers the core Pulumi platform. Resource creation is also only part of the problem. As Joe laid out in The Agentic Infrastructure Era, the real challenge for AI agents isn't with code or CLI commands, it's with everything else: getting a cloud account, resolving credentials, wiring configuration across multiple services. Agent accounts, also released this week, simplify this by letting an agent provision its own ephemeral Pulumi Cloud account, and Pulumi ESC takes care of consolidating credentials across providers. Together, with p ## Technology Short Take 195 DevFeed: [Technology Short Take 195]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-05-08T14:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [Artificial Intelligence](), [Large Language Model](), [Security](), [API keys](), [Automation](), [Kubernetes](), [networking](), [Ollama](), [Local AI]() Tags: [ai](), [api-keys](), [article](), [aws](), [blog](), [cilium](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [llm](), [networking](), [oci](), [ollama](), [security]() ### AI overview Technology Short Take 195 is a curated roundup of technology articles and posts, with an unplanned emphasis on AI and large language models. It covers API-key storage, AI tools and assistants, AI workflow automation, AI-agent security, Kubernetes security, networking, Ollama and local LLM experiments, Terraform versus OpenTofu, and cloud management. ### Source excerpt Welcome to Technology Short Take #195! It wasn't planned this way, but it seems like this Tech Short Take is heavily slanted toward AI/LLM-related articles and posts. Topics like security concerns around improper storage of API keys, how developers are using AI tools, spyware getting installed with AI assistants, and how AI/LLMs might be creating barriers to entry for new IT profesionals are all on tap this time around. I hope this unintentional focus doesn't prevent you from finding something useful! Networking Ivan Pepelnjak takes readers through the process of generating partial devices configurations with netlab. It's an older blog post, but it checks out--have a look at this walkthrough of Containerlab and Netlab. (Hat tip to Ivan for the link. Also, bonus points if you understood the reference at the start of this paragraph.) Ah, MTU issues...they don't go away if you migrate to Kubernetes. Security Sean Gallagher and Omid Mirzaei from Cisco Talos discuss how threat actors are misusing AI workflow automation. Before this article on vulnerability triage, I'd never heard of "brocards." Kelby Ludwig reminds folks that you don't want long-lived keys. Davi Ottenheimer tackles the claims about risk from Anthropic's Mythos preview. (Hint: the words "missing", "failed", "fluffy bunny", and "FUD" are involved.) William Collins reminds readers that they still need to pay attention to where they're storing sensitive data like API keys. Copy Fail has been making the rounds on lots of articles and blogs. Clément Nussbaumer looks at Copy Fail from the perspective of going from unprivileged Pod to root on a Kubernetes Node. Here's another one on Copy Fail, this time looking at blocking Copy Fail with Tetragon. Security is an arms race, and trying to secure AI agents is no different. The latest round in the race is a Falco project called Prempti. Cloud Computing/Cloud Management It's a good thing I came across this article about why friends don't let friends use Ollama. I had in ## Technology Short Take 194 DevFeed: [Technology Short Take 194]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-04-17T13:00:00Z Content type: article Language: en Sources: [Scott's Weblog]() Topics: [datacenter](), [networking](), [Cryptography](), [Security](), [Vulnerabilities](), [eBPF](), [Kubernetes](), [Claude Code](), [TLS (Transport Layer Security)](), [ChaCha]() Tags: [article](), [aws](), [blog](), [cilium](), [claude-code](), [cli](), [cloud](), [cni](), [containers](), [cri-o](), [critical-infrastructure](), [cryptography](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [security](), [vulnerabilities]() ### AI overview Technology Short Take 194 curates data center technology links covering Reticulum, IPv6 networking, security exploits and vulnerabilities, TLS and QUIC diagrams, Kubernetes security, Claude Code advisories, AWS emulation, and developer tools. ### Source excerpt This is Technology Short Take #194, the latest in my semi-regular series of posts sharing data center technology-related links and articles from around the web. What have I gathered for readers this time? Key topics in Tech Short Take 194 include a new cryptography-based network stack, a look at why folks are revolting against AI, and an in-depth comparison of microVM technologies. On to the content! Networking This is cool. Longtime reader Todd Smith pointed me to Reticulum, a new cryptography-based network stack. Todd also spent some time messing around with Reticulum and shared his findings in two blog posts: first, an initial/introductory post, followed by a post sharing his experience with some Reticulum experiments. Scott Hogg examines building an IPv6 training and testing lab. Security eBPF is taking hold in security exploits, like the tool named "BPFdoor" that is penetrating critical infrastructure networks. Paul Meyer discusses reproducing and mitigating BadAML, an ACPI-based attack vector that can be used to potentially gain access to confidential VMs. Meyer admits that the model in the article assumes the attacker has full control over the host, at which point I would assume "game over" and move on. This site provides not only an illustrated TLS 1.2 connection diagram, but also offers diagrams for QUIC, DTLS, and TLS 1.3 (see the links in the upper right corner). Rory McCune continues his series on unpatchable Kubernetes vulnerabilities. David Chisnall posted a scathing analysis of Mythos on Mastodon (hat tip to Bruce Davie for boosting it into my timeline), and shared a link to an advisory on critical command injection vulnerabilities in Claude Code. Cloud Computing/Cloud Management I recently found this alternative to LocalStack for AWS emulation. How to hide regions and services in the AWS console is a useful thing to know about. Operating Systems/Applications Chris Down breaks down the differences between zswap and zram. Micah Kepe introduces his new [Next page]()