# Terraform Terraform is an infrastructure-as-code tool for building, changing, and versioning infrastructure. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Implementing GitOps from Infrastructure to DB Operators to Unify Ops for Kubernetes Databases DevFeed: [Implementing GitOps from Infrastructure to DB Operators to Unify Ops for Kubernetes Databases]() Original publisher: [Read original article]() Author: Sucahyo Ardy Prasetiyo Published: 2026-09-16T08:57:10Z Content type: tutorial Language: en Sources: [SeveralNines]() Topics: [GitOps](), [Kubernetes](), [Terraform](), [argo-cd](), [ClusterControl](), [Databases](), [opentofu]() Tags: [argo-cd](), [clustercontrol](), [databases](), [gitops](), [hybrid-operations](), [infrastructure](), [kubernetes](), [opentofu](), [sovereign-dbaas](), [terraform]() ### AI overview This article describes a layered GitOps approach for Kubernetes database platforms: manage infrastructure with Terraform or OpenTofu, manage Kubernetes deployments with Argo CD, and standardize operations for operator-managed databases with ClusterControl. It explains how declarative configuration and drift reconciliation differ between Terraform and Argo CD, and compares infrastructure automation options including Atlantis and Flux tf-controller. ### Source excerpt Most platform teams already use GitOps for their Kubernetes apps. The config lives in Git, Argo CD applies it, and deployments are predictable. But look one layer down and things get messy. Infrastructure setup is often still done by hand, running Terraform locally or through scattered scripts. Database operations, especially for databases running through Kubernetes [...] The post Implementing GitOps from Infrastructure to DB Operators to Unify Ops for Kubernetes Databases appeared first on Severalnines. ## Automate Docker Registry Creation with Harness and Terraform DevFeed: [Automate Docker Registry Creation with Harness and Terraform]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [docker registry](), [Kubernetes](), [Provisioning](), [Terraform](), [Infrastructure as code](), [CI/CD](), [Dockerfile]() Tags: [ci-cd](), [container-image](), [deployment](), [docker-registry](), [infrastructure-as-code](), [kubernetes](), [registry](), [terraform]() ### AI overview A tutorial shows how to use Harness Pipelines and the Harness Terraform Provider to provision a uniquely named Docker Registry, build and push a container image, and deploy it to Kubernetes. It covers Terraform execution in a CI step, passing output variables between stages, and rolling updates with automatic rollback. ### Source excerpt Provision a fresh Docker Registry with Terraform, build your container image into it, and deploy to Kubernetes in one | Blog ## Encore for Python DevFeed: [Encore for Python]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [Python](), [FastAPI](), [AWS IAM](), [Amazon Web Services](), [Cloud](), [PostgreSQL](), [Terraform](), [postgresql clusters]() Tags: [aws](), [cloud](), [coding-agents](), [configuration](), [git](), [iam](), [infrastructure](), [postgresql](), [python](), [terraform]() ### AI overview Encore is introducing Encore.py, an upcoming beta that brings Encore's type-safe infrastructure primitives to Python and works alongside frameworks such as FastAPI. The article describes how application-level resource declarations can drive infrastructure provisioning while platform teams retain control over environment-specific settings in AWS, GCP, Terraform, or existing infrastructure. It also highlights preview environments where coding agents can implement and verify features against infrastructure configured to resemble production. ### Source excerpt An early look at Encore for Python, entering beta soon. ## Terraform AWS Provider Continues Rapid Expansion as AWS Infrastructure Becomes More Complex DevFeed: [Terraform AWS Provider Continues Rapid Expansion as AWS Infrastructure Becomes More Complex]() Original publisher: [Read original article]() Author: Craig Risi Published: 2026-09-11T12:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Terraform](), [Infrastructure as code](), [cloud-infrastructure](), [AWS CloudFormation](), [Amazon Bedrock](), [DSQL]() Tags: [aws](), [cloudformation](), [devops](), [infrastructure-as-code](), [news](), [release](), [terraform](), [terraform-aws-provider-6-62]() ### AI overview Terraform AWS Provider v6.62.0 adds support for AWS services and resources. The article compares Terraform with Pulumi, CloudFormation/CDK, and OpenTofu, and advises teams to pin and test provider upgrades because of schema, state, and behavior risks. ### Source excerpt The Terraform AWS Provider continues its rapid evolution, with v6.62.0 adding support for new AWS capabilities while improving how Terraform understands and manages existing infrastructure. By Craig Risi ## Validating multi-Region DR for Terraform Enterprise with AWS FIS DevFeed: [Validating multi-Region DR for Terraform Enterprise with AWS FIS]() Original publisher: [Read original article]() Author: Frenil Randeria Published: 2026-09-09T21:05:02Z Content type: article Language: en Sources: [AWS Architecture Blog]() Topics: [Terraform](), [AWS Fault Injection Service (FIS)](), [Chaos Engineering](), [Amazon S3](), [Amazon EC2](), [Databases]() Tags: [advanced-300](), [amazon-aurora](), [amazon-ec2](), [amazon-s3](), [aws](), [aws-fault-injection-service-fis](), [disaster-recovery](), [postgresql](), [technical-how-to](), [terraform](), [validation]() ### AI overview This article explains how to validate customer-operated multi-Region disaster recovery for Terraform Enterprise on AWS using three-phase AWS FIS experiments. It covers failover and failback testing, hidden dependency discovery, and reported recovery times of 12-14 minutes. ### Source excerpt Learn how AWS, HashiCorp, and Athenahealth designed and chaos-tested a multi-Region disaster recovery strategy for Terraform Enterprise on AWS. This post walks through three-phase AWS Fault Injection Service experiments across Amazon EC2, Aurora, and Amazon S3, the 12-14 minute recovery times achieved, and the state file dependency pitfall to avoid. ## Security updates for Wednesday DevFeed: [Security updates for Wednesday]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-09T13:04:46Z Content type: news Language: en Sources: [LWN.net]() Topics: [Debian](), [cURL](), [Chromium](), [systemd](), [Terraform](), [.NET]() Tags: [chromium](), [cli](), [debian](), [google](), [intel](), [java](), [kernel](), [opentelemetry](), [python](), [redis](), [security](), [systemd](), [terraform](), [updates]() ### AI overview Security updates have been issued across AlmaLinux, Debian, Fedora, Mageia, Red Hat, SUSE, and Ubuntu for a broad set of packages, including kernels, systemd, Chromium, curl, Python, Java, Terraform provider components, and other system and developer tools. ### Source excerpt Security updates have been issued by AlmaLinux (expat, glib2, microcode_ctl, mrtg, pam, redis, thunderbird, and valkey), Debian (fort-validator, gst-plugins-base1.0, kernel, and slurm-wlm), Fedora (complyctl, libevent, openvpn, and tar), Mageia (dovecot and spice-vdagent), Red Hat (ignition, opentelemetry-collector, and osbuild-composer), SUSE (amazon-ssm-agent, aws-nitro-enclaves-cli, bzip2, cadvisor, chromium, curl, distribution-registry, emacs, freeciv, fuse-overlayfs, gh, google-guest-agent, GraphicsMagick, hauler, insighttoolkit-devel, java-17-openjdk, libidn, libusb-1_0, libvirt, libvncserver, libzypp, zypper, lkl, lxd, multipath-tools, NetworkManager, perl-Net-DNS, perl-URI, python, python-authlib, python-sqlparse, python-tornado, python3, rpcbind, supergfxctl, systemd, terraform-provider-null, ucode-intel, wget, wireshark, and xen), and Ubuntu (curl, ffmpeg, glibc, hsqldb1.8.0, imagemagick, perl, and vim). ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## Harness shipped 58 features in August 2026, including AI code review and agent security scanning DevFeed: [Harness shipped 58 features in August 2026, including AI code review and agent security scanning]() Original publisher: [Read original article]() Author: Chinmay Gaikwad Published: 2026-09-02T18:04:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [Artificial Intelligence](), [AI-assisted coding](), [AI Agent](), [Code review](), [prompt injection](), [Security](), [Terraform]() Tags: [2026](), [ai-code-review](), [code-review](), [coding-agents](), [opentofu](), [prompt-injection](), [security](), [terraform]() ### AI overview Harness describes 58 features released in August 2026, including an agent-scale code repository, AI Code Review, AI Risks scanning for prompt injection and tool poisoning in agent skills, and risk scoring for Terraform and OpenTofu changes. ### Source excerpt Harness shipped 58 features in August 2026: an agent-scale code repository, AI Code Review, AI Risks scanning, and the Blast Radius Agent. | Blog ## MySQL CDC connector for ClickPipes is now Generally Available DevFeed: [MySQL CDC connector for ClickPipes is now Generally Available]() Original publisher: [Read original article]() Author: Marta Paes Published: 2026-09-02T14:03:04Z Content type: release Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [MySQL](), [Infrastructure as code](), [Terraform]() Tags: [analytics](), [api](), [clickhouse](), [cloud](), [data](), [infrastructure-as-code](), [mysql](), [observability](), [release](), [terraform]() ### AI overview ClickHouse announces general availability of its MySQL CDC connector for ClickPipes, which replicates MySQL and MariaDB data into ClickHouse Cloud. The release adds automatic parallel snapshotting, reliability and observability improvements, and configuration through the Cloud API and Terraform. ### Source excerpt Replicate MySQL and MariaDB data into ClickHouse Cloud with the generally available MySQL CDC connector, featuring faster parallel snapshots, safer production defaults, improved observability, and infrastructure-as-code support. ## Deploying a RAG Chatbot with Shared State and Storage Across Replicas DevFeed: [Deploying a RAG Chatbot with Shared State and Storage Across Replicas]() Original publisher: [Read original article]() Author: Avi Chawla Published: 2026-09-01T21:11:23Z Content type: tutorial Language: en Sources: [Daily Dose of Data Science]() Topics: [Retrieval-Augmented Generation](), [Kubernetes](), [Terraform](), [FastAPI](), [LangChain](), [Python]() Tags: [fastapi](), [github](), [persistence](), [pgvector](), [python](), [rag](), [retrieval](), [terraform]() ### AI overview The article explains why a RAG chatbot that works locally can lose vector indexes, conversation history, and documents when deployed across multiple replicas. It recommends shared persistence for embeddings, checkpointed conversation state, and shared object storage, with examples using Postgres, pgvector, LangGraph, and object storage. ### Source excerpt + a popular LLM interview question. ## Announcing support for ClickStack in the ClickHouse Terraform provider DevFeed: [Announcing support for ClickStack in the ClickHouse Terraform provider]() Original publisher: [Read original article]() Author: Jordan Simonovski Published: 2026-08-14T16:03:36Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Terraform](), [observability](), [dashboards]() Tags: [clickhouse](), [dashboards](), [infrastructure](), [observability](), [open-source](), [production](), [review](), [self-hosted](), [terraform](), [workflow]() ### AI overview The ClickHouse Terraform provider adds beta support for managing ClickStack resources in self-hosted deployments and ClickHouse Cloud. Dashboards, alerts, sources, saved searches, connections, and webhooks can be stored in version control, reviewed, and applied through an infrastructure workflow. ### Source excerpt The ClickHouse Terraform provider now manages ClickStack dashboards, alerts, sources, and webhooks, putting observability config in version control. ## Best Kubernetes Infrastructure as Code Tools in 2026 DevFeed: [Best Kubernetes Infrastructure as Code Tools in 2026]() Original publisher: [Read original article]() Author: Pulumi Content Team Published: 2026-08-14T00:00:00Z Content type: comparison Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [Kubernetes](), [Terraform](), [argo-cd](), [Helm charts](), [GitOps](), [flux](), [opentofu](), [Amazon EKS](), [AWS CloudFormation](), [VPC](), [AWS IAM]() Tags: [argo-cd](), [cloudformation](), [code](), [comparisons](), [devops](), [flux](), [general](), [gitops](), [helm](), [helm-charts](), [iam](), [infrastructure](), [infrastructure-as-code](), [kubernetes](), [opentofu](), [platform-engineering](), [terraform](), [vpc]() ### AI overview This comparison explains that Kubernetes infrastructure as code spans cluster and cloud provisioning, in-cluster workload definition, and continuous delivery and reconciliation. It presents Pulumi and Terraform or OpenTofu as general-purpose provisioning options, Helm and Kustomize for workload templating, and Argo CD and Flux for GitOps reconciliation. ### Source excerpt There is no single best Kubernetes infrastructure as code tool, because "Kubernetes IaC" actually spans three different jobs. For provisioning the cluster and its cloud dependencies, Pulumi and Terraform (or OpenTofu) are the strongest general-purpose options. For templating and packaging workloads, Helm and Kustomize dominate. For continuous reconciliation once things are running, Argo CD and Flux lead the GitOps category. The right stack usually combines one tool from each layer, not a single tool that claims to do all three. What counts as infrastructure as code for Kubernetes? Kubernetes infrastructure as code work splits into three layers that get conflated constantly, and the confusion is where most tool comparisons go wrong. The cluster and cloud layer provisions the things Kubernetes itself sits on top of: the managed control plane (EKS, GKE, AKS), node pools, the VPC and subnets, IAM roles, load balancers, and cluster add-ons. Terraform, Pulumi, and cloud-native tools like CloudFormation operate here. The in-cluster workload layer defines what runs on the cluster once it exists: Deployments, Services, ConfigMaps, CustomResourceDefinitions, and the Helm charts or Kustomize overlays that template them. This is where Helm, Kustomize, and Crossplane's custom resources live. The delivery and reconciliation layer keeps what's declared in Git in sync with what's actually running on the cluster, continuously, rather than as a one-shot apply. Argo CD and Flux own this layer, and they consume the output of the other two rather than replacing them. Most real Kubernetes platforms use tools from at least two of these layers together. A team might provision EKS with Terraform, package its application with Helm, and let Argo CD reconcile it continuously. Knowing which layer a tool actually addresses, rather than treating "Kubernetes IaC" as one shopping list, is the first decision that matters. Pulumi provisions the cluster and the workloads on it in the same language Pul ## Avoid Azure secret rotation with secretless authentication DevFeed: [Avoid Azure secret rotation with secretless authentication]() Original publisher: [Read original article]() Author: Cody Murray-Bruce; Ben Johnson-Staub Published: 2026-08-12T00:00:00Z Content type: tutorial Language: en Sources: [Datadog | The Monitor blog]() Topics: [Azure](), [Authentication](), [Entra ID](), [OpenID connect (OIDC)](), [telemetry](), [Terraform](), [migration]() Tags: [authentication](), [azure](), [cli](), [entra-id](), [identity-and-access-management](), [infrastructure-monitoring](), [integration](), [microsoft](), [migration](), [oidc](), [secrets](), [telemetry](), [terraform]() ### AI overview This article explains how Datadog's secretless authentication for Azure replaces long-lived client secrets with federated identity using Microsoft Entra ID and OpenID Connect. It describes the short-lived token flow and configuration or migration options through Quickstart, Terraform, the Azure CLI, or the Azure portal. ### Source excerpt Learn how secretless authentication for Datadog's Azure integration helps prevent telemetry interruptions that result from expired client secrets. ## ScyllaDB Customer Experience Spotlight: Susie Solis DevFeed: [ScyllaDB Customer Experience Spotlight: Susie Solis]() Original publisher: [Read original article]() Author: Cynthia Dunlop Published: 2026-08-10T14:28:35Z Content type: article Language: en Sources: [ScyllaDB]() Topics: [Databases](), [distributed-systems](), [cloud-infrastructure](), [Kubernetes](), [Terraform](), [Latency](), [Linux]() Tags: [blog](), [cloud-infrastructure](), [community](), [customer](), [cx-profiles](), [database](), [distributed-systems](), [kubernetes](), [latency](), [linux](), [on-call](), [production](), [streaming](), [support](), [terraform]() ### AI overview Susie Solis, a ScyllaDB Technical Support Engineer, discusses her background in technical support, cloud infrastructure, and distributed systems, along with a Kubernetes and Terraform project built to reproduce environments and troubleshoot customer issues. She also describes ScyllaDB's ability to sustain high-throughput production workloads and low latency during major streaming events. ### Source excerpt Meet Susie Solis, a Technical Support Engineer on the Customer Experience team here at ScyllaDB. ## Developer Self-Service Forms Are Dead: Here's What Comes Next DevFeed: [Developer Self-Service Forms Are Dead: Here's What Comes Next]() Original publisher: [Read original article]() Author: Revital Ben Ami Published: 2026-08-10T11:32:54Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [Artificial Intelligence](), [Terraform](), [GitHub](), [Amazon EC2](), [Amazon EKS]() Tags: [agents](), [ai](), [ai-agents](), [developer](), [github](), [infrastructure](), [policy](), [terraform](), [workflows]() ### AI overview The article argues that static developer self-service forms create maintenance costs, fail to handle edge cases, and ask developers infrastructure questions they may not be able to answer. It proposes context-aware AI agents that can interview developers, inspect existing resources, apply organizational policies, and generate infrastructure outputs through Terraform modules and GitHub workflows. ### Source excerpt Static self-service forms can't reason. See how context-aware AI agents replace them with dynamic, policy-driven golden paths. ## Terraform Scalability: When IaC Outgrows Your Setup DevFeed: [Terraform Scalability: When IaC Outgrows Your Setup]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Terraform](), [Infrastructure as code](), [Scalability](), [iac-security]() Tags: [dynamodb](), [harness](), [iac](), [s3](), [scalability](), [security](), [terraform]() ### AI overview This article examines how Terraform scalability challenges emerge as infrastructure code and teams grow. It discusses bottlenecks involving state management, collaboration, governance, large state files, locking, plan times, module sprawl, and version drift, and introduces Harness IaCM as a management solution. ### Source excerpt Terraform scalability issues slow teams down. Learn how to overcome IaC bottlenecks with better management. See how Harness helps. | Blog ## Terraform and Kubernetes: A Practical Guide for 2026 DevFeed: [Terraform and Kubernetes: A Practical Guide for 2026]() Original publisher: [Read original article]() Author: Pulumi Content Team Published: 2026-08-07T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Kubernetes](), [Terraform](), [Provisioning](), [Testing](), [Artificial Intelligence]() Tags: [ai](), [ai-agents](), [deployment](), [general](), [guide](), [infrastructure-as-code](), [kubernetes](), [platform-engineering](), [provisioning](), [terraform](), [testing]() ### AI overview A practical guide to using Terraform with Kubernetes, covering the Kubernetes provider, provisioning workflows, testing, policy, deployment, and the role of AI agents. It explains limitations including provider ordering and the need for Kubernetes API access during planning. ### Source excerpt Yes, Terraform can manage Kubernetes: the official hashicorp/kubernetes provider lets you declare Deployments, Services, and other objects as HCL resources, and community providers like kubectl fill in the gaps. It works well for many teams. The friction shows up around two well-documented limits -- provider ordering and plan-time API access -- and around testing, where a general-purpose language changes what's possible. That friction matters more in 2026 than it did a few years ago. Kubernetes infrastructure now sits next to AI-driven engineering workflows: agents that propose changes, run previews, and open pull requests need infrastructure code they can read, test, and reason about with the same tools they use for application code. A cluster definition written in HCL and a workload definition written in YAML are both harder for an agent -- and a person -- to unit test, refactor, or type-check than the equivalent in TypeScript, Python, or Go. This guide is about the operating model for Kubernetes infrastructure: how the cluster, the platform layer, and the workloads on top of it get provisioned, tested, and shipped. It's a different question from "should I write my Kubernetes manifests in YAML, HCL, or a real language," which we cover in detail in YAML, Terraform, or Pulumi: what's the smart choice for deployment automation with Kubernetes? Read that post first if you're deciding how to author manifests; read this one for the wider workflow -- provisioning, testing, policy, and where AI agents fit. How does Terraform manage Kubernetes today? The hashicorp/kubernetes provider (current release v3.2.1, requiring Terraform 1.0.0 or later) is the primary path, and teams typically combine it with one or two others depending on what they're deploying: Approach What it's for Notes Typed resources (kubernetes_deployment_v1, kubernetes_service_v1, etc.) Core, well-known object types Full HCL validation and typed attributes for the objects the provider models explicitly kubernete ## Pulumi Cloud Adds Terraform Backend Support for Agentic Infrastructure DevFeed: [Pulumi Cloud Adds Terraform Backend Support for Agentic Infrastructure]() Original publisher: [Read original article]() Author: Daniel Perlovsky Published: 2026-08-04T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Terraform](), [Infrastructure as code](), [opentofu](), [Cloud](), [Deployment]() Tags: [agentic](), [agents](), [ai-agents](), [cloud](), [deployment](), [enterprise](), [hcl](), [iac](), [infrastructure-as-code](), [opentofu](), [platform](), [product](), [pulumi-cloud](), [terraform]() ### AI overview Pulumi announces general availability of Pulumi Cloud as a backend for Terraform state. The release supports existing Terraform deployment patterns while adding Pulumi Cloud capabilities such as remote runs, visibility, manual approvals, and scalable access management. ### Source excerpt At Pulumi, we are building the platform for agentic infrastructure. Pulumi Cloud provides the guardrails and enterprise readiness needed to safely move fast in this new era. While we are seeing extraordinary adoption -- over 40% of our users now manage infrastructure using AI agents -- we know many organizations are at different phases in their AI journey and have to balance building for the future with maintaining their existing infrastructure as code (IaC) solutions like Terraform. Today, we are launching three ways that Pulumi lets you avoid trading off building for the future against building for today. You don't have to rip out Terraform to enter the agentic era. Pulumi Cloud brings agentic infrastructure to the IaC estate you already have. What we're shipping today Last December, our CEO Joe Duffy laid out his vision to make Pulumi the platform for all of your infrastructure as code. The capabilities we are launching today make that promise a reality. Pulumi is now fully interoperable with Terraform and OpenTofu and enables organizations to build upon their existing IaC estate rather than starting from scratch as they work toward the agentic infrastructure future. Pulumi Cloud as a Terraform backend We are excited to announce the general availability of Pulumi Cloud as the backend to your Terraform state, enabling organizations to seamlessly lift and shift their existing Terraform estates. We recognize there is lots of infrastructure that works as is, and switching over to a new management paradigm may not always be possible. Pulumi Cloud support for the Terraform state backend lets organizations maintain their existing Terraform deployment patterns while also unlocking the power of Pulumi Cloud. The following common patterns for running Terraform are now supported: Plans and applies run remotely by default for new Terraform stacks, following the behavior of HCP Terraform and Terraform Enterprise. When you run a Terraform operation, it executes on a Pulumi-hoste ## Emulating Terraform on Pulumi's Engine DevFeed: [Emulating Terraform on Pulumi's Engine]() Original publisher: [Read original article]() Author: Ian Wahbe Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Pulumi]() Topics: [Terraform](), [opentofu](), [terraform provider](), [configuration]() Tags: [engineering](), [hcl](), [modules](), [opentofu](), [protocol](), [providers](), [pulumi](), [terraform](), [terraform-provider](), [translation]() ### AI overview This article explains how Pulumi's HCL interpreter maps Terraform configuration, resources, providers, and modules onto the Pulumi engine. It reports that the implementation works with 96% of Pulumi's top Terraform modules and describes how Pulumi's terraform-provider relays between Pulumi and Terraform provider protocols. ### Source excerpt The core promise of Pulumi's HCL support is that you can bring your existing Terraform configuration and modules, and pulumi will run them. If it works in OpenTofu and doesn't work in Pulumi, we would like to fix that. Given that goal, our HCL interpreter needs to take HCL as input and emit instructions to the Pulumi engine that semantically match how tofu would interpret the same input. This is made harder by the fact that Pulumi and OpenTofu have fundamentally different engine semantics and provider ecosystems. This blog post will explore how we have implemented that mapping well enough to get 96%1 of our top Terraform modules working on Pulumi. We'll briefly walk through how Pulumi's HCL interpreter handles Terraform's resource semantics, providers, and modules. It will also call out where Pulumi's HCL support lets you do things that Terraform and OpenTofu will not allow. Providers Both Pulumi and Terraform have providers, but they don't have the same providers. While there are providers that Terraform does not have, Pulumi can always resolve a Terraform provider using Pulumi's confusingly named terraform-provider provider.2 This is the same provider that lets you consume Any Terraform Provider in another Pulumi program with pulumi package add terraform-provider .... The terraform-provider provider acts as a relay: it speaks Pulumi's protocol to the Pulumi engine, and speaks Terraform's provider protocol to the Terraform provider it stands up. Because Pulumi HCL needs to work with all Pulumi providers and because terraform-provider lets Pulumi HCL speak to Terraform providers via the Pulumi protocol, Pulumi HCL actually only speaks Pulumi protocols directly: flowchart LR subgraph n2Entry[" "] n2["terraform-provider"] end subgraph providerBox["Pulumi Provider"] direction TD n2Entry n3["Terraform Provider"] end n0["Pulumi HCL"] <--> n1["Pulumi Engine"] n1 <--> n2Entry n2 <--> n3 n2@{ shape: rect} n3@{ shape: rect} n0@{ shape: rect} n1@{ shape: rect} style n2Entry f ## A guided tour of Terraform state, hosted modules, and HCL in Pulumi DevFeed: [A guided tour of Terraform state, hosted modules, and HCL in Pulumi]() Original publisher: [Read original article]() Author: Christian Nunciato Published: 2026-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [Terraform](), [opentofu](), [Amazon S3](), [Command-line interface](), [Cloud](), [GitHub](), [Template]() Tags: [amazon-s3](), [aws](), [cli](), [github](), [hcl](), [how-to](), [infrastructure-as-code](), [modules](), [opentofu](), [pulumi-cloud](), [registry](), [s3](), [terraform](), [tutorials]() ### AI overview A hands-on walkthrough shows how to move a Terraform project that provisions an Amazon S3 bucket into Pulumi Cloud. It covers Pulumi Cloud as a Terraform state backend, hosted Terraform modules, and HCL authoring support, with references to OpenTofu and AWS. ### Source excerpt Today's big release contains a whole new set of features designed for seamless interoperability with the Terraform and OpenTofu ecosystems, and there's a lot there -- so much that it can be tough to get your head around all of it. But it generally falls into three major categories: Support for Pulumi Cloud as a Terraform state backend, including remote execution with human approvals A Terraform module registry in Pulumi Cloud that lets you publish, document, and share your modules even across language boundaries First-class support for HCL as an authoring language in the Pulumi engine To make this release a little easier to appreciate holistically, I've put together a quick end-to-end walkthrough that doesn't quite cover everything, but does cover the big stuff, and should give you a sense of how it all comes together. We'll start with a simple Terraform project that you'll deploy to AWS, and then one step at a time, bring it into Pulumi Cloud and kick the tires on each of these new features as we go. It'll take a bit, but all you'll need are a free Pulumi account and the ability to deploy an S3 bucket to AWS. We've got a bunch to cover, so let's jump right in. Start with a Terraform project Our tour begins with a tiny Terraform project that provisions a single Amazon S3 bucket using a locally defined module that we'll publish later. The project is available on GitHub as a template, and the easiest way to use it is with the GitHub CLI: $ gh repo create my-tf-project \ --template cnunciato/simple-tf-template \ --public \ --clone && cd my-tf-project We'll use the local Terraform backend to start. Set your AWS credentials (preferably with environment variables), then deploy the project with Terraform or OpenTofu. (This walkthrough uses the terraform CLI, but you can swap in tofu if that's your preference.) $ terraform init && terraform apply ... Apply complete! Resources: 2 added, 0 changed, 0 destroyed. Outputs: bucket_arn = "arn:aws:s3:::my-tf-project-bucket-14d19ece" ## Managing Environment Variables and Secrets in DevOps DevFeed: [Managing Environment Variables and Secrets in DevOps]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-01T13:00:47Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [DevOps](), [configuration](), [GitGuardian](), [GitHub](), [Terraform](), [Kubernetes]() Tags: [ci-cd-secrets-management](), [cloud](), [collaboration](), [collaboration-tools](), [configuration](), [container](), [crash](), [devops](), [devsecops](), [dynamic-secrets](), [env-file-security](), [environment-variables](), [gitguardian](), [github](), [hardcoded-credentials](), [hashicorp-vault](), [jira](), [kubernetes](), [kubernetes-secrets](), [leak](), [managing-environment-variables-and-secrets](), [rotation](), [safety](), [sealed-secrets](), [secret-rotation](), [secret-scanning](), [secrets](), [secrets-management-best-practices](), [security](), [storage](), [terraform](), [vault]() ### AI overview A guide to managing environment variables and secrets in DevOps. It explains how secrets escape through repositories, processes, crash reports, containers, collaboration tools, Kubernetes Secrets, and Terraform state, and discusses storage, access controls, lifecycles, and rotation. ### Source excerpt Nearly 29 million secrets were pushed to public GitHub in a single year, and most teams still discover their own leaks by accident. Here is how environment variables actually escape, and what to use instead at each stage. ## The Economic Benefit of Refactoring DevFeed: [The Economic Benefit of Refactoring]() Original publisher: [Read original article]() Author: Martin Fowler (martin@martinfowler.com) Published: 2026-07-30T13:04:00Z Content type: article Language: en Sources: [Martin Fowler]() Topics: [Refactoring](), [Rust](), [AI Development](), [TypeScript](), [Terraform](), [Terminal]() Tags: [agentic](), [cursor](), [engineering](), [refactoring](), [rust](), [terminal](), [terraform](), [tokens](), [typescript]() ### AI overview An experiment examines whether refactoring an agent-written codebase can reduce the token cost of implementing future features. The application contains about 150,000 lines of primarily Rust code, with TypeScript and Terraform, and includes a 17,155-line data access module that became a target for systematic refactoring. Fresh sub-agents repeat the same representative change after each refactoring step so token consumption can be compared without learning effects. ### Source excerpt Giles Edwards-Alexander does an experiment to see if decomposing a large function helps reduce token costs, suggesting that is may now be possible to measure the economic benefit of refactoring more... ## Set Up Developer Self-service in Your Internal Developer Portal | Port DevFeed: [Set Up Developer Self-service in Your Internal Developer Portal | Port]() Original publisher: [Read original article]() Author: Yonatan Boguslavski Published: 2026-07-30T10:17:19Z Content type: tutorial Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [internal developer portal](), [Platform Engineering](), [Provisioning](), [Terraform](), [AWS Lambda](), [Jenkins](), [REST API](), [GitHub](), [Amazon S3](), [Microservice]() Tags: [api](), [aws](), [aws-lambda](), [catalog](), [cognitive-load](), [configuration](), [developer](), [developer-portal](), [github](), [infrastructure](), [internal-developer-portal](), [jenkins](), [platform-engineering](), [provisioning](), [rest-api](), [s3](), [terraform](), [tooling]() ### AI overview This article explains how to implement developer self-service actions in Port's internal developer portal. It covers provisioning, updating, and deleting software catalog entities and cloud resources, while describing webhook-based execution through tools such as AWS Lambda and REST APIs. ### Source excerpt Port supports many variations of implementing developer self service actions, including allowing for self-service RBAC, TTL and manual approvals. ## Why Integrations Are the Core of Platform Engineer Onboarding DevFeed: [Why Integrations Are the Core of Platform Engineer Onboarding]() Original publisher: [Read original article]() Author: Liza Sokol Published: 2026-07-30T10:13:18Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [Platform Engineering](), [internal developer portal](), [Orchestration](), [Provisioning](), [GitHub](), [Kubernetes](), [Terraform](), [observability]() Tags: [engineering](), [github](), [integrations](), [internal-developer-portal](), [kubernetes](), [observability](), [onboarding](), [platform](), [platform-engineering](), [provisioning](), [terraform]() ### AI overview The article explains that integrations are the foundation of platform engineering onboarding in Port. Connecting systems such as GitHub, Jira, Kubernetes, Datadog, and Terraform supplies the data needed for software catalogs, self-service workflows, scorecards, standards, observability, and engineering insights. ### Source excerpt Learn why integrations are the foundation of platform engineering onboarding -- and how Port helps teams automate, standardize, and accelerate platform setup. [Next page]()