Pulumi Blog: Derek Schaller

Pulumi + Gitlab: Better Than Ever

Meagan Cojocar — Fri, 14 Mar 2025 00:00:00 +0000

Pulumi’s integration with GitLab has reached new heights with enhancements designed to streamline your infrastructure as code workflows. Today, we’re excited to announce several significant improvements to our GitLab integration that make managing cloud infrastructure with Pulumi and GitLab more seamless than ever before: GitLab as a first-class VCS in Pulumi Cloud, enhanced merge request comments, organizational templates in GitLab, and later this year, Pulumi Deployments for GitLab.

Pulumi and GitLab have long enjoyed a productive partnership. From supporting GitLab sign-in to enabling GitLab CI/CD pipelines for infrastructure deployments, we’ve consistently worked to ensure GitLab users can leverage Pulumi’s powerful infrastructure as code capabilities within their existing workflows.

Our GitLab Merge Request integration allows teams to visualize infrastructure changes directly within merge requests, making code reviews more effective and infrastructure changes more transparent.

What’s New in Our GitLab Integration

Enhanced Merge Request Comments

We’ve revamped how Pulumi interacts with GitLab by building a Gitlab application to handle the authentication. Previously, only customers using Gitlab as an identity provider to Pulumi Cloud could leverage it. Now, Pulumi provides even more detailed and actionable comments on your merge requests, giving reviewers comprehensive insights into proposed infrastructure changes.

These comments include:

Streamlined discoverability of infrastructure changes
Resource-by-resource breakdown of changes
Direct links to the Pulumi Console for deeper analysis

To configure the GitLab integration:

Navigate to Organization Settings → Integrations in Pulumi Cloud
Select GitLab and enter your access token
Choose which projects or groups should receive Pulumi comments

GitLab as a First-Class VCS in Pulumi Cloud

Version control systems are a first-class, configurable concept in Pulumi Cloud. When you select GitLab as your VCS, the Pulumi Cloud interface adapts to show only relevant options and terminology, creating a more intuitive experience for GitLab users.

This integration enables:

Direct linking to GitLab repositories, branches, and commits
Automatic detection of Pulumi projects in GitLab repositories
Streamlined setup for GitLab-based CI/CD workflows, using the CI/CD wizard on a stack’s page

Organizational Templates in GitLab

Pulumi Cloud now fully supports organizational templates stored in GitLab repositories. This powerful feature allows platform teams to define standardized infrastructure templates that developers across the organization can easily discover and use to create new projects.

Once a GitLab repository is registered as a template source, Pulumi automatically detects pulumi.yaml files and surfaces them in the template gallery. These templates can be:

Public or private repositories
Subject to Pulumi’s role-based access control (RBAC)
Available in both the UI and CLI via pulumi new

This integration makes it easier than ever to standardize infrastructure patterns across your organization while leveraging GitLab for version control and collaboration.

Coming Soon: Pulumi Deployments for GitLab

Pulumi Deployments will also soon support GitLab, enabling fully automated infrastructure provisioning directly from your GitLab pipelines. This integration will provide:

Fully managed compute for running Pulumi operations
Click to deploy self service workflows in the Pulumi Cloud UI
Rich new out of the box functionality like Time to Live Stacks, Drift Detection, Click to Deploy, Git Push to Deploy, Review Stacks and Scheduled Deployments.

All this functionality is available today by specifying the raw git credentials, but we look forward to making the integration frictionless in the future. To learn more about Pulumi Deployments read our Pulumi Deployments documentation.

Getting Started

Ready to try these new GitLab integrations? Here’s how to get started:

If you’re new to Pulumi, sign up for a free account
For existing users, navigate to your organization settings to configure the GitLab integration
Check out our updated documentation for detailed setup instructions

Conclusion

With these enhancements, Pulumi’s GitLab integration is better than ever, providing a seamless experience for managing infrastructure as code within your GitLab workflows. Learn more in the Pulumi GitLab documentation. We’re committed to continuing to improve this integration based on your feedback.

Have questions or feedback? Join our Community Slack to connect with the Pulumi team and other users, or open an issue on our GitHub repository.

Introducing Pulumi ESC Projects and Environment Tags

Derek Schaller — Thu, 12 Sep 2024 13:00:00 -0400

We’re thrilled to unveil two new features that will empower you to organize your collection of Pulumi ESC Environments: Projects and Environment Tags. Projects offer a structured way to group related environments and Environment Tags allow you to add contextual information to each environment. Together, they offer a powerful way for you to manage, navigate, and collaborate on your secrets and configurations.

Overview of Pulumi ESC

Pulumi ESC is a developer-first platform designed to simplify the management of secrets and configurations into collections called environments. As a fully managed solution, it offers dynamic cloud provider credential resolution, a rich set of providers to retrieve secrets from external platforms, and the ability to use the secrets and configurations you have defined across any surface, including your applications and infrastructure via Multi-language SDKs, REST APIs, CLI, Pulumi-Service Provider, and Automation API. Like all Pulumi functionality, Pulumi ESC focuses on enhancing both agility and security in modern cloud development.

As developers have embraced Pulumi ESC to manage their collections of secrets and configurations across many teams and projects, the demand for more sophisticated organizational tools has increased. To address this growing need for more organized and efficient management of cloud environments, we are introducing Projects and Environment Tags in Pulumi ESC.

Introducing Projects

Projects offer a structured way to organize environments into logical groupings. Each Project has a distinct name, providing context for the environments within it, and can contain multiple environments with variations, each having a specific purpose. Additionally, Projects help large organizations simplify environment management by mitigating possible environment name conflicts and ensuring changes are made in isolation to the correct environments.

For example, your organization could have a project named “payments-app” containing dev, staging, and prod environments within it. Your organization could also have a project called “dev-credentials” which contains different environments used to provide temporary runtime access to credentials for developers while working.

We have two additional features as part of this launch:

Grouping and Search: You can group environments by either Project name or by Environment Tags, as well as search by them, making it simple to locate and manage your environments.
Environment Clone: Using the built-in cloning functionality, you can securely copy environments with sensitive information, preserving either the entire version history or just the latest environment state, depending on your needs.

To use Projects and Environment Tags, please update your Pulumi CLI and SDK to the latest.

Environments will now need to be referenced by specifying the project as part of the environment identifier. Any existing environments within your organization will be available in the default project. Projects are fully backward compatible - all your existing programs, imports and CLI commands will work without requiring any changes at the moment. Note that only environments within the default project will be backwards compatibly and resolve without a project prefix.

Users will be able to create new environments in the default project until Nov 30, 2024. Starting Dec 1, 2024, users will not be able to create new environments in the default project.

Starting Apr 1, 2025, users will not be able to edit their environments within the ‘default’ Project. We recommend customers migrate their existing environments to user-created projects at the earliest to take advantage of new Pulumi ESC capabilities.

Moving environments out of the default project is as easy as cloning the environment into a new project and updating any references to it. An example clone command that preserves all environment history, tags, and team access looks as follows

 $ pulumi env clone default/dev your-project/dev --preserve-history --preserve-env-tags --preserve-rev-tags --preserve-access

We offer numerous ways for you to get started with Projects via the Pulumi Web Console, SDK, REST API, CLI and Pulumi-Service Provider - choose what best fits your workflow. Here is one example using the Pulumi CLI to create and list environments within a project:

 $ pulumi env init cloud-pe/demo
 Environment created: dschaller/cloud-pe/demo

 $ pulumi env ls -p cloud-pe
 cloud-pe/demo
 pulumi/cloud-pe/demo

Breaking Changes

With the introduction of Projects, all existing environments part of the default project will continue to work without requiring any changes. However, when moving existing environments out of the default project you may notice some differences that we have outlined below.

If your environment was interpolating the context.currentEnvironment.name or context.rootEnvironment.name from Contextual information, this value will now include the project for any environments outside of the default project.
If you were using any of the secrets providers with OIDC, you will need to update both the subject and audience if a trust relationship has been set up. The subject will be either pulumi:environments:org:<organization name>:env:<project name>/<environment name> if no subjectAttributes are specified or if the currentEnvironment.name subject attribute is specified it will now resolve to currentEnvironment.name:<project name>/<environment name>. The audience will be the provider’s platform name (aws, azure, or gcp) followed by the org name of the environment (e.g. aws:pulumi).

Introducing Environment Tags

Using Environment Tags, teams can now assign any number of custom tags to each environment within Pulumi ESC. These tags serve as contextual identifiers that can streamline workflows by enabling you to group and search across environments based on specific criteria such as teams, project stages, deployment environments, compliance requirements, or geographic locations. This multi-dimensional approach provides unparalleled flexibility and control, ensuring your Pulumi ESC environments can scale seamlessly with your organizations evolving needs.

For example, suppose your organization has multiple environments across different geographic regions. You can use Environment Tags like ‘region: us-east’ or ‘region: eu-central-1’ to quickly filter environments by region. Similarly, for security audits, you might tag environments with ‘Compliance: SOC2’ or ‘Compliance: GDPR’ to easily find relevant environments and ensure they are compliant.

You can use the Pulumi Web Console and the CLI to create and manage Environment Tags. Here is an example of using the CLI to add and list Environment Tags.

$ pulumi env tag cloud-pe/demo region us-east-1
Name: region
Value: us-east-1
Last updated at 2024-09-10 11:03:05.708 -0700 PDT by Derek <dschaller>

$ pulumi env tag ls cloud-pe/demo
Name: region
Value: us-east-1
Last updated at 2024-09-10 11:03:05.708 -0700 PDT by Derek <dschaller>

Conclusion

Pulumi ESC Projects and Environment Tags are powerful additions that bring order and clarity to your secrets and configuration to even the most complex infrastructure landscapes. By enabling you to organize, group, and search for your environments with ease, we’re empowering you to scale your infrastructure with high confidence and flexibility.

We’re excited to see how you leverage these new capabilities. Check out the docs to learn more about Pulumi ESC Projects and Environment Tags and start organizing your environments today!

As always, please share your feedback on how we can further improve Pulumi ESC to suit your needs.