Pulumi Blog: Java

Pulumi Java is Now Generally Available

Mark Huber — Mon, 10 Feb 2025 16:15:00 -0800

One of Pulumi’s core Infrastructure as Code (IaC) features is the ability to model infrastructure using well-traveled, familiar general-purpose programming languages. Today, we’re thrilled to announce that Java, one of the world’s most popular programming languages, is now generally available in Pulumi. This release joins our existing first-class support for TypeScript, Python, Go, YAML, and C#, enabling Java developers to manage cloud infrastructure using the language they know and trust.

We’ve grown our Java support based on feedback from the expanding set of companies that have adopted Pulumi Java in production workloads. Let’s look at some examples of using Java to power your Pulumi programs.

Familiar Composability

Using Java with Pulumi lets you model your infrastructure using familiar patterns. Paired with rich abstractions, you can efficiently build Pulumi programs. It only seems appropriate that we take a look at a Java example using Oracle Cloud:

We start our program by grabbing our configuration values that describe which distro and AD to use.

var config = ctx.config();
var compartmentId = config.require("compartmentId");
var availabilityDomain = config.require("availabilityDomain");
var ubuntuId = config.require("ubuntuId");

Next, we create a set of abstractions to describe the networking and OS.

var vcn = new VirtualNetwork("virtualNetworkResource", VirtualNetworkArgs.builder()
 .compartmentId(compartmentId)
 .cidrBlock("10.0.0.0/16")
 .build());

var subnet = new Subnet("testSubnet", SubnetArgs.builder()
 .cidrBlock("10.0.0.0/24")
 .compartmentId(compartmentId)
 .vcnId(vcn.id())
 .availabilityDomain(availabilityDomain)
 .build());

var vnicDetails = InstanceCreateVnicDetailsArgs.builder()
 .subnetId(subnet.id())
 .assignPublicIp("true")
 .build();

var sourceDetails = InstanceSourceDetailsArgs.builder()
 .sourceType("image")
 .sourceId(ubuntuId)
 .build();

Finally, we compose our instance.

var instance = new Instance("instanceResource", InstanceArgs.builder()
 .availabilityDomain(availabilityDomain)
 .compartmentId(compartmentId)
 .shape("VM.Standard.E2.1.Micro")
 .preserveBootVolume(false)
 .createVnicDetails(vnicDetails)
 .sourceDetails(sourceDetails)
 .build());

With just a few lines of code (especially by Java standards), we composed a set of strongly typed, easy-to-reason about resources using the builder pattern (a Java favorite) and without introducing any new language paradigms.

New: Java Automation API

With the general availability of our Java language support, we’re also excited to announce that the Automation API is now supported in Java. The Automation API is a fully typed SDK that allows you to interact with Pulumi programs outside the Pulumi CLI. You can directly access and orchestrate your Pulumi projects and stacks with the SDK, allowing you to supercharge your Infrastructure as Code.

In our Automation API examples repo, we have an example demonstrating how you could construct a Pulumi program with the Automation API to perform a database migration. Let’s take a look at a few of the interesting aspects:

Like regular Pulumi programs, we’re able to obtain the current operating context and use the details to construct new resources, inline with the rest of the Automation API program.

Consumer<Context> program = ctx -> {
 ...

 var subnetGroup = new SubnetGroup("db-subnet", ...);

 // Make a public security group for our cluster for the migration
 var securityGroup = new SecurityGroup("public-security-group", ...);

 // Example values for our db
 var dbName = "hellosql";
 var dbUser = "hellosql";
 var dbPassword = "hellosql";

 // Provision our db
 var cluster = new Cluster("db", ClusterArgs.builder()
 .engine(EngineType.AuroraMysql)
 .engineVersion("8.0.mysql_aurora.3.08.0")
 .databaseName(dbName)
 .masterUsername(dbUser)
 .masterPassword(dbPassword)
 .skipFinalSnapshot(true)
 .dbSubnetGroupName(subnetGroup.name())
 .vpcSecurityGroupIds(securityGroup.id().applyValue(List::of))
 .build());

 var clusterInstance = new ClusterInstance("db-instance", ClusterInstanceArgs.builder()
 .clusterIdentifier(cluster.clusterIdentifier())
 .instanceClass("db.t3.medium")
 .engine(EngineType.AuroraMysql.getValue())
 .engineVersion("8.0.mysql_aurora.3.08.0")
 .publiclyAccessible(true)
 .dbSubnetGroupName(subnetGroup.name())
 .build());

 ctx.export("host", cluster.endpoint());
 ctx.export("db_name", dbName);
 ctx.export("db_user", dbUser);
 ctx.export("db_pass", dbPassword);
};

With the Automation API, however, we’re also able to directly interact with project and stack objects, giving us the opportunity to orchestrate workflows. This could include scaffolding projects, working across stacks, or in our case, completing a one-time workflow to migrate a database.

var projectName = "database_migration_project";
var stackName = "dev";

try (var stack = LocalWorkspace.createOrSelectStack(projectName, stackName, program)) {
 ...

 stack.workspace().installPlugin("aws", "v6.68.0");

 stack.setConfig("aws:region", new ConfigValue("us-west-2"));

 System.out.println("updating stack...");
 var result = stack.up(UpOptions.builder()
 .onStandardOutput(System.out::println)
 .build());

 var changes = result.summary().resourceChanges();
 if (!changes.isEmpty()) {
 System.out.println("update summary:");
 changes.forEach((key, value) -> {
 System.out.printf(" %s: %d%n", key, value);
 });
 }

 System.out.printf("db host url: %s%n", result.outputs().get("host").value());
 configureDatabase(
 ...
 );
}

The full example, along with others, is available in our Automation API examples repo. We’re excited to bring the Automation API to the Java SDK for the first time and we’re looking forward to your feedback.

Get Started with Pulumi Java

To learn more about and to get started with Pulumi Java, you can check out the following resources:

Java SDK Repo: The Java SDK is fully open-source, and we’re excited to get your feedback or review any pull requests.
Examples Repo: The Pulumi examples repo has many examples of Pulumi Java programs to help you get up and running with Pulumi Java.
Pulumi Java Converter: The Pulumi converter tool efficiently migrates existing IaC applications, such as Terraform, ARM, and Bicep, to Pulumi Java.

New: Helm Chart v4 resource with new features and languages

Eron Wright — Thu, 13 Jun 2024 00:00:00 -0700

Today we’re happy to announce a new “v4” version of the Chart resource, available now in v4.13 of the Pulumi Kubernetes provider. The new kubernetes.helm.sh/v4.Chart resource is provided side-by-side with the existing kubernetes.helm.sh/v3.Chart resource. We expect to deprecate v3 in the future.

When you need to install a third-party application into your Kubernetes cluster, you’re likely to find a Helm chart for that in Artifact Hub or other registry. Pulumi provides two ways to apply a Helm chart, as outlined in Choosing the Right Helm Resource For Your Use Case. The Chart resource offers deeper integration with Pulumi and better drift remediation. v4 brings a host of new features, including enhanced SDK support across all Pulumi SDKs, full OCI registry support, improved handling of chart values, better connectivity for cluster interactions, and improved resource ordering. Let’s dig in.

What’s new

Let’s look at what’s new with Chart v4.

New language support - Java SDK & YAML SDK

The Chart v4 resource is a Pulumi Component that works consistently across all Pulumi SDKs. Earlier versions were implemented separately for each SDK, leading to various inconsistencies and limited SDK support.

Here, for example, is a simple deployment of cert-manager, a well-known Kubernetes add-on:

import * as pulumi from "@pulumi/pulumi";
import * as kubernetes from "@pulumi/kubernetes";

const certman = new kubernetes.helm.v4.Chart("cert-manager", {
 namespace: "cert-manager",
 chart: "oci://registry-1.docker.io/bitnamicharts/cert-manager",
 version: "1.3.1",
});

import pulumi
import pulumi_kubernetes as kubernetes

certman = kubernetes.helm.v4.Chart("cert-manager",
 namespace="cert-manager",
 chart="oci://registry-1.docker.io/bitnamicharts/cert-manager",
 version="1.3.1")

package main

import (
 helmv4 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/helm/v4"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 _, err := helmv4.NewChart(ctx, "cert-manager", &helmv4.ChartArgs{
 Namespace: pulumi.String("cert-manager"),
 Chart: pulumi.String("oci://registry-1.docker.io/bitnamicharts/cert-manager"),
 Version: pulumi.String("1.3.1"),
 })
 if err != nil {
 return err
 }
 return nil
 })
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Kubernetes = Pulumi.Kubernetes;

return await Deployment.RunAsync(() =>
{
 var certman = new Kubernetes.Helm.V4.Chart("cert-manager", new()
 {
 Namespace = "cert-manager",
 Chart = "oci://registry-1.docker.io/bitnamicharts/cert-manager",
 Version = "1.3.1",
 });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.kubernetes.helm.sh_v4.Chart;
import com.pulumi.kubernetes.helm.sh_v4.ChartArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 public static void stack(Context ctx) {
 var certman = new Chart("cert-manager", ChartArgs.builder()
 .namespace("cert-manager")
 .chart("oci://registry-1.docker.io/bitnamicharts/cert-manager")
 .version("1.3.1")
 .build());

 }
}

resources:
 cert-manager:
 type: kubernetes:helm.sh/v4:Chart
 properties:
 namespace: cert-manager
 chart: oci://registry-1.docker.io/bitnamicharts/cert-manager
 version: "1.3.1"

OCI registry support

You can use container registries with OCI support such as Docker Hub to store and share Helm chart packages. The Chart v4 resource now has full support for OCI, bringing it to parity with the Release resource.

To use an authenticated OCI registry, you must first login using helm registry login or docker login.

Chart v4 also supports the use of Helm chart repositories, and adopts the same repositoryOpts API as was introduced in the Release resource.

Lock file support

Helm has support for lock files (Chart.lock) to control a chart’s dependencies. When deploying a chart from a local directory, Pulumi automatically rebuilds the chart’s dependencies if a lock file is present. See Helm Dependency Build for details.

Better handling of chart values

Chart v4 offers new ways to work with Chart values. It is now possible to use multiple values files and to use Pulumi Assets. Of course you can also use output values from other resources as chart values.

It is also possible to set a chart value to the contents of a text file, similarly to using Helm’s --set-file argument. To do that, simply use a Pulumi Asset as a value within the values map. This is useful for injecting large values into a chart, such as additional templates as supported by the extraDeploy parameter of some Bitnami charts.

Here’s an example of using a combination of values from different sources.

import * as pulumi from "@pulumi/pulumi";
import * as kubernetes from "@pulumi/kubernetes";

const certManager = new kubernetes.helm.v4.Chart("cert-manager", {
 namespace: "cert-manager",
 chart: "oci://registry-1.docker.io/bitnamicharts/cert-manager",
 version: "1.3.1",
 valueYamlFiles: [new pulumi.asset.FileAsset("values.yaml")],
 values: {
 commonLabels: {
 "pulumi.com/stackName": pulumi.getStack(),
 },
 extraDeploy: [new pulumi.asset.FileAsset("manifest.yaml")],
 },
});

import pulumi
import pulumi_kubernetes as kubernetes

cert_manager = kubernetes.helm.v4.Chart("cert-manager",
 namespace="cert-manager",
 chart="oci://registry-1.docker.io/bitnamicharts/cert-manager",
 version="1.3.1",
 value_yaml_files=[pulumi.FileAsset("values.yaml")],
 values={
 "commonLabels": {
 "pulumi.com/stackName": pulumi.get_stack(),
 },
 "extraDeploy": [pulumi.FileAsset("manifest.yaml")],
 })

package main

import (
 helmv4 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/helm/v4"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 _, err := helmv4.NewChart(ctx, "cert-manager", &helmv4.ChartArgs{
 Namespace: pulumi.String("cert-manager"),
 Chart: pulumi.String("oci://registry-1.docker.io/bitnamicharts/cert-manager"),
 Version: pulumi.String("1.3.1"),
 ValueYamlFiles: pulumi.AssetOrArchiveArray{
 pulumi.NewFileAsset("values.yaml"),
 },
 Values: pulumi.Map{
 "commonLabels": pulumi.Any(map[string]interface{}{
 "pulumi.com/stackName": ctx.Stack(),
 }),
 "extraDeploy": pulumi.Array{
 pulumi.NewFileAsset("manifest.yaml"),
 },
 },
 })
 if err != nil {
 return err
 }
 return nil
 })
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Kubernetes = Pulumi.Kubernetes;

return await Deployment.RunAsync(() =>
{
 var certManager = new Kubernetes.Helm.V4.Chart("cert-manager", new()
 {
 Namespace = "cert-manager",
 Chart = "oci://registry-1.docker.io/bitnamicharts/cert-manager",
 Version = "1.3.1",
 ValueYamlFiles = new[]
 {
 new FileAsset("values.yaml"),
 },
 Values =
 {
 { "commonLabels", new Dictionary<string, object?>
 {
 ["pulumi.com/stackName"] = Deployment.Instance.StackName,
 } },
 { "extraDeploy", new[]
 {
 new FileAsset("manifest.yaml"),
 } },
 },
 });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.deployment.Deployment;
import com.pulumi.kubernetes.helm.v4.Chart;
import com.pulumi.kubernetes.helm.v4.ChartArgs;
import com.pulumi.asset.FileAsset;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 public static void stack(Context ctx) {
 var certManager = new Chart("cert-manager", ChartArgs.builder()
 .namespace("cert-manager")
 .chart("oci://registry-1.docker.io/bitnamicharts/cert-manager")
 .version("1.3.1")
 .valueYamlFiles(new FileAsset("values.yaml"))
 .values(Map.ofEntries(
 Map.entry("commonLabels", Map.of("pulumi.com/stackName", Deployment.getInstance().getStackName())),
 Map.entry("extraDeploy", List.of(new FileAsset("manifest.yaml")))
 ))
 .build());

 }
}

resources:
 cert-manager:
 type: kubernetes:helm.sh/v4:Chart
 properties:
 namespace: cert-manager
 chart: oci://registry-1.docker.io/bitnamicharts/cert-manager
 version: "1.3.1"
 valueYamlFiles:
 - fn::fileAsset: values.yaml
 values:
 commonLabels:
 pulumi.com/stackName: ${pulumi.stack}
 extraDeploy:
 - fn::fileAsset: manifest.yaml

Better connectivity

You may now use charts that use chart functions requiring a connection to the cluster, e.g. to:

Check the Kubernetes server version with .Capabilities.KubeVersion
Check if an API version or kind is available with .Capabilities.APIVersions.Has
Use the lookup function in your templates to get existing objects in your live cluster.

Note that the lookup function is executed in both the preview and the non-preview mode, and keep in mind that the expected object may not exist during a preview.

Improved resource ordering

It’s now easy to wait for a chart’s resources to be installed before installing other resources, simply by using the dependsOn option. In earlier versions, we relied on a ready output property.

The Chart resource automatically detects dependencies between resources in the manifest(s). For example, it knows to install namespaces and Custom Resource Definitions (CRDs) first.

Use the config.kubernetes.io/depends-on annotation to declare an explicit resource dependency. The annotation accepts a list of resource references, delimited by commas.

It consists of the group, kind, name, and optionally the namespace, delimited by forward slashes.

Resource Scope	Format
namespace-scoped	`<group>/namespaces/<namespace>/<kind>/<name>`
cluster-scoped	`<group>/<kind>/<name>`

For resources in the “core” group, the empty string is used instead (for example: /namespaces/test/Pod/pod-a).

New-style Pulumi transformations

Pulumi has a new way to transform component resources and their children, the transforms options. The older transformations option doesn’t work with multi-language components like Chart v4. See Resource Option: transforms for more details.

Note: you cannot change an object’s namespace or name using a Pulumi transformation, and you cannot add or discard an object.

Here’s an example of using the transforms option to add the pulumi.com/patchForce annotation to a chart’s resources.

const applyPatchForceAnnotation = async (args: pulumi.ResourceTransformArgs) => {
 switch(args.type) {
 case "kubernetes:helm.sh/v4:Chart":
 break;
 default:
 args.props.metadata.annotations = {
 "pulumi.com/patchForce": "true",
 ...args.props.metadata.annotations
 }
 }
 return {
 props: args.props,
 opts: args.opts,
 };
};

const ingressController = new kubernetes.helm.v4.Chart("ingresscontroller", {
 chart: "nginx-ingress",
 namespace: ingressNs.metadata.name,
 repositoryOpts: {
 repo: "https://helm.nginx.com/stable",
 },
 version: "0.14.1",
}, {transforms: [applyPatchForceAnnotation]});

def apply_patchforce_annotation(args: ResourceTransformArgs):
 if not args.type_ == "kubernetes:helm.sh/v4:Chart":
 if not 'metadata' in args.props:
 args.props['metadata'] = {}
 if not 'annotations' in args.props['metadata']:
 args.props['metadata']['annotations'] = {}
 args.props['metadata']['annotations']['pulumi.com/patchForce'] = 'true'

 return ResourceTransformResult(
 props=args.props,
 opts=args.opts)

ingresscontroller = kubernetes.helm.v4.Chart(
 "ingresscontroller",
 chart="nginx-ingress",
 namespace=ingress_ns.metadata.name,
 repository_opts=kubernetes.helm.v3.RepositoryOptsArgs(
 repo="https://helm.nginx.com/stable",
 ),
 version="0.14.1",
 opts=pulumi.ResourceOptions(transforms=[apply_patchforce_annotation])
)

applyPatchForceAnnotation := func(ctx context.Context, rta *pulumi.ResourceTransformArgs) *pulumi.ResourceTransformResult {
 transform := func(applier interface{}) {
 o := rta.Props.ToMapOutputWithContext(ctx).ApplyT(applier)
 r, err := internals.UnsafeAwaitOutput(ctx, o)
 if err != nil {
 panic(err)
 }
 rta.Props = r.Value.(pulumi.Map)
 }

 switch rta.Type {
 case "kubernetes:helm.sh/v4:Chart":
 // Do nothing for Helm charts
 default:
 transform(func(obj map[string]any) pulumi.Map {
 // note: obj is an ordinary Unstructured object at this point.
 unstructured.SetNestedField(obj, "true", "metadata", "annotations", "pulumi.com/patchForce")
 return pulumi.ToMap(obj)
 })
 }
 return &pulumi.ResourceTransformResult{
 Props: rta.Props,
 Opts: rta.Opts,
 }
}

// Use Helm to install the Nginx ingress controller
_, err = helmv4.NewChart(ctx, "ingresscontroller", &helmv4.ChartArgs{
 Chart: pulumi.String("nginx-ingress"),
 Namespace: ingressNs.Metadata.Name(),
 RepositoryOpts: &helmv4.RepositoryOptsArgs{
 Repo: pulumi.String("https://helm.nginx.com/stable"),
 },
 Version: pulumi.String("0.14.1"),
}, pulumi.Transforms([]pulumi.ResourceTransform{applyPatchForceAnnotation}))
if err != nil {
 return err
}

Post-rendering support

New to v4 is support for a post-rendering command, with optional arguments, to be applied to the rendered manifest. See Advanced Helm Techniques: Post Rendering for details.

“Keep” policy

The Chart v4 resource now understands Helm resource policies, specifically “keep” which instructs Pulumi not to delete a given object when the resource is destroyed. Simply apply the helm.sh/resource-policy: keep annotation to the object. See Tell Helm Not To Uninstall a Resource for details.

Release name

Charts typically generate object names based on the Helm release name. By default, Chart v4 uses its own resource name as the release name. To customize the release name, set the name property on the Chart.

Some charts also accept a fullnameOverride value to control object naming, use that if possible.

Limitations

Not supported: Kubernetes transformations

Chart v4 does not support the transformations argument as seen in Chart v3, that facilitates a Kubernetes-centric transformation and/or discarding of objects from the rendered manifest.

One alternative is to use use Pulumi transformations to transform the object and resource options. Another is to use post-rendering, which we’ll cover next.

Not supported: Helm hooks

Some charts use hooks to perform pre- and post-installation tasks, and we recommend using the Release resource to install such charts. Another option is to emulate the hook by performing the task directly, using other Pulumi resources such as kubernetes.batch/v1.Job and kubernetes.core/v1.Secret.

Note that Chart v3 does not support hooks either but, for historical reasons, does emit the hooks as ordinary child resources.

Evolving: Resource outputs

The child resources created by the chart are presented to your program via the resources output, as an array of Pulumi Resource objects. In some SDKs, you can cast the resource into the appropriate resource type, e.g. corev1.ConfigMap. Not all SDKs support this (yet); see pulumi/pulumi#15788.

Deploy Helm charts with Pulumi

Apply any Helm chart with the Chart v4 resource and manage the cloud resources it depends on, like IAM roles and storage buckets, in the same program.

Get started

Example: Argo CD

Here’s a real-world example of installing Argo CD into a Kubernetes cluster, and of using Argo CD’s Application custom resource to deploy the ‘guestbook’ example.

import * as pulumi from "@pulumi/pulumi";
import * as kubernetes from "@pulumi/kubernetes";
import * as random from "@pulumi/random";

const ns = new kubernetes.core.v1.Namespace("ns", {metadata: {
 name: "argocd",
}});
const redisPasswordResource = new random.RandomPassword("redis-password", {length: 16});
const redisSecret = new kubernetes.core.v1.Secret("redis-secret", {
 metadata: {
 name: "argocd-redis",
 namespace: ns.metadata.apply(metadata => metadata.name),
 },
 type: "Opaque",
 stringData: {
 auth: redisPasswordResource.result,
 },
});
const argocd = new kubernetes.helm.v4.Chart("argocd", {
 chart: "argo-cd",
 version: "6.11.1",
 namespace: ns.metadata.apply(metadata => metadata.name),
 repositoryOpts: {
 repo: "https://argoproj.github.io/argo-helm",
 },
 values: {
 fullnameOverride: "",
 },
});
const guestbook = new kubernetes.yaml.v2.ConfigGroup("guestbook", {objs: [{
 apiVersion: "argoproj.io/v1alpha1",
 kind: "Application",
 metadata: {
 name: "guestbook",
 namespace: ns.metadata.apply(metadata => metadata.name),
 },
 spec: {
 project: "default",
 source: {
 repoURL: "https://github.com/argoproj/argocd-example-apps.git",
 targetRevision: "HEAD",
 path: "guestbook",
 },
 destination: {
 server: "https://kubernetes.default.svc",
 namespace: "default",
 },
 },
}]}, {
 dependsOn: [argocd],
});
export const redisPassword = redisPasswordResource.result;

import pulumi
import pulumi_kubernetes as kubernetes
import pulumi_random as random

ns = kubernetes.core.v1.Namespace("ns", metadata=kubernetes.meta.v1.ObjectMetaArgs(
 name="argocd",
))
redis_password_resource = random.RandomPassword("redis-password", length=16)
redis_secret = kubernetes.core.v1.Secret("redis-secret",
 metadata=kubernetes.meta.v1.ObjectMetaArgs(
 name="argocd-redis",
 namespace=ns.metadata.name,
 ),
 type="Opaque",
 string_data={
 "auth": redis_password_resource.result,
 })
argocd = kubernetes.helm.v4.Chart("argocd",
 chart="argo-cd",
 version="6.11.1",
 namespace=ns.metadata.name,
 repository_opts=kubernetes.helm.v4.RepositoryOptsArgs(
 repo="https://argoproj.github.io/argo-helm",
 ),
 values={
 "fullnameOverride": "",
 })
guestbook = kubernetes.yaml.v2.ConfigGroup("guestbook", objs=[{
 "apiVersion": "argoproj.io/v1alpha1",
 "kind": "Application",
 "metadata": {
 "name": "guestbook",
 "namespace": ns.metadata.name,
 },
 "spec": {
 "project": "default",
 "source": {
 "repoURL": "https://github.com/argoproj/argocd-example-apps.git",
 "targetRevision": "HEAD",
 "path": "guestbook",
 },
 "destination": {
 "server": "https://kubernetes.default.svc",
 "namespace": "default",
 },
 },
}],
opts=pulumi.ResourceOptions(depends_on=[argocd]))
pulumi.export("redisPassword", redis_password_resource.result)

package main

import (
 corev1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/core/v1"
 helmv4 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/helm/v4"
 metav1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/meta/v1"
 yamlv2 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/yaml/v2"
 "github.com/pulumi/pulumi-random/sdk/v4/go/random"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {
 ns, err := corev1.NewNamespace(ctx, "ns", &corev1.NamespaceArgs{
 Metadata: &metav1.ObjectMetaArgs{
 Name: pulumi.String("argocd"),
 },
 })
 if err != nil {
 return err
 }
 redisPasswordResource, err := random.NewRandomPassword(ctx, "redis-password", &random.RandomPasswordArgs{
 Length: pulumi.Int(16),
 })
 if err != nil {
 return err
 }
 _, err = corev1.NewSecret(ctx, "redis-secret", &corev1.SecretArgs{
 Metadata: &metav1.ObjectMetaArgs{
 Name: pulumi.String("argocd-redis"),
 Namespace: ns.Metadata.ApplyT(func(metadata metav1.ObjectMeta) (*string, error) {
 return metadata.Name, nil
 }).(pulumi.StringPtrOutput),
 },
 Type: pulumi.String("Opaque"),
 StringData: pulumi.StringMap{
 "auth": redisPasswordResource.Result,
 },
 })
 if err != nil {
 return err
 }
 argocd, err := helmv4.NewChart(ctx, "argocd", &helmv4.ChartArgs{
 Chart: pulumi.String("argo-cd"),
 Version: pulumi.String("6.11.1"),
 Namespace: ns.Metadata.ApplyT(func(metadata metav1.ObjectMeta) (*string, error) {
 return metadata.Name, nil
 }).(pulumi.StringPtrOutput),
 RepositoryOpts: &helmv4.RepositoryOptsArgs{
 Repo: pulumi.String("https://argoproj.github.io/argo-helm"),
 },
 Values: pulumi.Map{
 "fullnameOverride": pulumi.Any(""),
 },
 })
 if err != nil {
 return err
 }
 _, err = yamlv2.NewConfigGroup(ctx, "guestbook", &yamlv2.ConfigGroupArgs{
 Objs: pulumi.Array{
 pulumi.Any(map[string]interface{}{
 "apiVersion": "argoproj.io/v1alpha1",
 "kind": "Application",
 "metadata": map[string]interface{}{
 "name": "guestbook",
 "namespace": ns.Metadata.ApplyT(func(metadata metav1.ObjectMeta) (*string, error) {
 return metadata.Name, nil
 }).(pulumi.StringPtrOutput),
 },
 "spec": map[string]interface{}{
 "project": "default",
 "source": map[string]interface{}{
 "repoURL": "https://github.com/argoproj/argocd-example-apps.git",
 "targetRevision": "HEAD",
 "path": "guestbook",
 },
 "destination": map[string]interface{}{
 "server": "https://kubernetes.default.svc",
 "namespace": "default",
 },
 },
 }),
 },
 }, pulumi.DependsOn([]pulumi.Resource{
 argocd,
 }))
 if err != nil {
 return err
 }
 ctx.Export("redisPassword", redisPasswordResource.Result)
 return nil
 })
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Kubernetes = Pulumi.Kubernetes;
using Random = Pulumi.Random;

return await Deployment.RunAsync(() =>
{
 var ns = new Kubernetes.Core.V1.Namespace("ns", new()
 {
 Metadata = new Kubernetes.Types.Inputs.Meta.V1.ObjectMetaArgs
 {
 Name = "argocd",
 },
 });

 var redisPasswordResource = new Random.RandomPassword("redis-password", new()
 {
 Length = 16,
 });

 var redisSecret = new Kubernetes.Core.V1.Secret("redis-secret", new()
 {
 Metadata = new Kubernetes.Types.Inputs.Meta.V1.ObjectMetaArgs
 {
 Name = "argocd-redis",
 Namespace = ns.Metadata.Apply(metadata => metadata.Name),
 },
 Type = "Opaque",
 StringData =
 {
 { "auth", redisPasswordResource.Result },
 },
 });

 var argocd = new Kubernetes.Helm.V4.Chart("argocd", new()
 {
 Chart = "argo-cd",
 Version = "6.11.1",
 Namespace = ns.Metadata.Apply(metadata => metadata.Name),
 RepositoryOpts = new Kubernetes.Types.Inputs.Helm.V4.RepositoryOptsArgs
 {
 Repo = "https://argoproj.github.io/argo-helm",
 },
 Values =
 {
 { "fullnameOverride", "" },
 },
 });

 var guestbook = new Kubernetes.Yaml.V2.ConfigGroup("guestbook", new()
 {
 Objs = new[]
 {
 new Dictionary<string, object?>
 {
 ["apiVersion"] = "argoproj.io/v1alpha1",
 ["kind"] = "Application",
 ["metadata"] = new Dictionary<string, object?>
 {
 ["name"] = "guestbook",
 ["namespace"] = ns.Metadata.Apply(metadata => metadata.Name),
 },
 ["spec"] = new Dictionary<string, object?>
 {
 ["project"] = "default",
 ["source"] = new Dictionary<string, object?>
 {
 ["repoURL"] = "https://github.com/argoproj/argocd-example-apps.git",
 ["targetRevision"] = "HEAD",
 ["path"] = "guestbook",
 },
 ["destination"] = new Dictionary<string, object?>
 {
 ["server"] = "https://kubernetes.default.svc",
 ["namespace"] = "default",
 },
 },
 },
 },
 }, new ComponentResourceOptions
 {
 DependsOn =
 {
 argocd,
 },
 });

 return new Dictionary<string, object?>
 {
 ["redisPassword"] = redisPasswordResource.Result,
 };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.kubernetes.core.v1.Namespace;
import com.pulumi.kubernetes.core.v1.NamespaceArgs;
import com.pulumi.kubernetes.meta.v1.inputs.ObjectMetaArgs;
import com.pulumi.random.RandomPassword;
import com.pulumi.random.RandomPasswordArgs;
import com.pulumi.kubernetes.core.v1.Secret;
import com.pulumi.kubernetes.core.v1.SecretArgs;
import com.pulumi.kubernetes.helm.v4.Chart;
import com.pulumi.kubernetes.helm.v4.ChartArgs;
import com.pulumi.kubernetes.helm.v4.inputs.RepositoryOptsArgs;
import com.pulumi.kubernetes.yaml.v2.ConfigGroup;
import com.pulumi.kubernetes.yaml.v2.ConfigGroupArgs;
import com.pulumi.resources.ComponentResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }

 public static void stack(Context ctx) {
 var ns = new Namespace("ns", NamespaceArgs.builder()
 .metadata(ObjectMetaArgs.builder()
 .name("argocd")
 .build())
 .build());

 var redisPasswordResource = new RandomPassword("redisPasswordResource", RandomPasswordArgs.builder()
 .length(16)
 .build());

 var redisSecret = new Secret("redisSecret", SecretArgs.builder()
 .metadata(ObjectMetaArgs.builder()
 .name("argocd-redis")
 .namespace(ns.metadata().applyValue(metadata -> metadata.name().get()))
 .build())
 .type("Opaque")
 .stringData(redisPasswordResource.result().applyValue(password -> Map.of("auth", password)))
 .build());

 var argocd = new Chart("argocd", ChartArgs.builder()
 .chart("argo-cd")
 .version("6.11.1")
 .namespace(ns.metadata().applyValue(metadata -> metadata.name().get()))
 .repositoryOpts(RepositoryOptsArgs.builder()
 .repo("https://argoproj.github.io/argo-helm")
 .build())
 .values(Map.of("fullnameOverride", ""))
 .build());

 var guestbook = new ConfigGroup("guestbook", ConfigGroupArgs.builder()
 .objs(Map.ofEntries(
 Map.entry("apiVersion", "argoproj.io/v1alpha1"),
 Map.entry("kind", "Application"),
 Map.entry("metadata", Map.ofEntries(
 Map.entry("name", "guestbook"),
 Map.entry("namespace", ns.metadata().applyValue(metadata -> metadata.name().get()))
 )),
 Map.entry("spec", Map.ofEntries(
 Map.entry("project", "default"),
 Map.entry("source", Map.ofEntries(
 Map.entry("repoURL", "https://github.com/argoproj/argocd-example-apps.git"),
 Map.entry("targetRevision", "HEAD"),
 Map.entry("path", "guestbook")
 )),
 Map.entry("destination", Map.ofEntries(
 Map.entry("server", "https://kubernetes.default.svc"),
 Map.entry("namespace", "default")
 ))
 ))
 ))
 .build(), ComponentResourceOptions.builder()
 .dependsOn(argocd)
 .build());

 ctx.export("redisPassword", redisPasswordResource.result());
 }
}

resources:
 ns:
 type: kubernetes:core/v1:Namespace
 properties:
 metadata:
 name: argocd

 redis-password:
 type: random:RandomPassword
 properties:
 length: 16

 redis-secret:
 type: kubernetes:core/v1:Secret
 properties:
 metadata:
 name: argocd-redis
 namespace: ${ns.metadata.name}
 type: Opaque
 stringData:
 auth: ${redis-password.result}
 options:
 retainOnDelete: true

 argocd:
 type: kubernetes:helm.sh/v4:Chart
 properties:
 chart: argo-cd
 version: "6.11.1"
 namespace: ${ns.metadata.name}
 repositoryOpts:
 repo: https://argoproj.github.io/argo-helm
 values:
 fullnameOverride: ""

 guestbook:
 type: kubernetes:yaml/v2:ConfigGroup
 properties:
 objs:
 - apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
 name: guestbook
 namespace: ${ns.metadata.name}
 spec:
 project: default
 source:
 repoURL: https://github.com/argoproj/argocd-example-apps.git
 targetRevision: HEAD
 path: guestbook
 destination:
 server: https://kubernetes.default.svc
 namespace: default
 options:
 dependsOn:
 - ${argocd}

outputs:
 redisPassword: ${redis-password.result}

The program creates the argocd namespace, installs the ArgoCD server, and then creates an ArgoCD Application resource. Observe how the program installs and uses a Custom Resource Definition (CRD) successfully, and uses dependsOn to ensure that the CRD is installed before using it.

The argo-cd chart normally makes use of a Helm hook to initialize a password for the redis server. Since the Chart v4 resource doesn’t support Helm hooks, this program creates the password directly.

Conclusion

Pulumi loves empowering developers to use the best tools for the job, and we recommend using Helm charts to install third-party Kubernetes applications. Pulumi complements Helm by handling the cloud resources that are often required, such as an IAM Role or cloud storage bucket. Such combinations make for great reusable componentry.

Check out the following links to learn more about Pulumi Kubernetes today!

New: ConfigGroup, ConfigFile resources for Java, YAML SDKs

Eron Wright — Fri, 12 Apr 2024 00:00:00 -0700

The Pulumi Kubernetes provider makes it easy to deploy Kubernetes resources to your cluster, giving you options based on how your application or workload is packaged. The options include strongly-typed resources for standard Kubernetes types, Helm charts, Kustomizations, and Kubernetes manifests.

In v4.10, we leveled up the support for working with Kubernetes manifests with the introduction of the yaml/v2 package. The package provides new implementations of the ConfigGroup and ConfigFile resources, expanding support to the Pulumi Java SDK and to Pulumi YAML. The new implementations are also smarter about applying the objects in the correct order.

Please note that these resources are in a preview stage of maturity, as we continue to round out the feature set. These new resources are provided side-by-side with the existing implementations.

Let’s explore how it’s easier than ever to deploy diverse Kubernetes workloads using Pulumi.

kubernetes.yaml/v2.ConfigGroup

The ConfigGroup resource creates a set of Kubernetes objects from Kubernetes manifests and/or object literals. The Kubernetes manifest may be supplied using any combination of the following methods:

a filename or a list of filenames.
a file pattern or a list of file patterns.
a literal string containing YAML or JSON text.
a literal object or a list of objects.

The ConfigGroup resource accepts the following input properties:

Property	Description
`files`	Set of files, patterns and/or URLs to Kubernetes manifest files. Filenames containing any of the characters ``, `?`, and `[` are treated as patterns*.
`objs`	Set of Kubernetes objects.
`yaml`	A Kubernetes manifest as a YAML or JSON string.
`resourcePrefix`	A prefix for auto-generated names of the child resources. Defaults to the `ConfigGroup` name.
`skipAwait`	Skips over the readiness checks on the child resources.

Note that all objects defined within the manifest must have a metadata.name field; Pulumi autonaming is not supported.

See the API Reference documentation for more information.

Manifest Files

Here’s an example of applying a Kubernetes manifest file to your cluster.

name: demo-cg-1
runtime: yaml
resources:
 cg:
 type: kubernetes:yaml/v2:ConfigGroup
 properties:
 files:
 - ./manifest.yaml

YAML Text

Here’s how to apply an inline manifest.

name: demo-cg-2
runtime: yaml
resources:
 cg:
 type: kubernetes:yaml/v2:ConfigGroup
 properties:
 yaml: |
 apiVersion: v1
 kind: ConfigMap
 metadata:
 name: my-server-config
 data:
 altGreeting: "Good Morning!"
 ---
 apiVersion: v1
 kind: Secret
 metadata:
 name: my-dotfile-secret
 data:
 .secret-file: dmFsdWUtMg0KDQo=

Object Literals

With ConfigGroup it’s easy to define a Kubernetes object using Pulumi property values. Let’s create a Kubernetes namespace and deploy a custom resource into that namespace.

name: demo-cg-3
runtime: yaml
resources:
 ns:
 type: kubernetes:core/v1:Namespace
 cg:
 type: kubernetes:yaml/v2:ConfigGroup
 properties:
 objs:
 - apiVersion: stable.example.com/v1
 kind: CronTab
 metadata:
 namespace: ${ns.metadata.name}
 name: my-crontab
 spec:
 cronSpec: "* * * * */5"

This feature is especially useful for Pulumi YAML, since the apiextensions.k8s.io:CustomResource resource isn’t supported yet (see pulumi-kubernetes#2787).

Resource Ordering

The ConfigGroup resource automatically detects dependencies between resources in the manifest(s). For example, it knows to install namespaces and Custom Resource Definitions (CRDs) first.

Use the config.kubernetes.io/depends-on annotation to declare an explicit resource dependency. The annotation accepts a list of resource references, delimited by commas.

It consists of the group, kind, name, and optionally the namespace, delimited by forward slashes.

Resource Scope	Format
namespace-scoped	`<group>/namespaces/<namespace>/<kind>/<name>`
cluster-scoped	`<group>/<kind>/<name>`

For resources in the “core” group, the empty string is used instead (for example: /namespaces/test/Pod/pod-a).

Resource Prefixes

The purpose of the resource prefix is to ensure the uniqueness of child resource names, as described in Pulumi: Resource Names. The best practice is to use the component name as a prefix, and now that’s the default behavior.

Note that the resource prefix is not applied to the Kubernetes object names.

Transformation Support

The Kubernetes provider generally supports resource transformations, e.g. to apply a resource alias or to apply an object name prefix or object label. Transformations aren’t yet possible with the new ConfigGroup resource (see pulumi/pulumi#12996), but stay tuned as we work towards a GA release later this year.

kubernetes.yaml/v2.ConfigFile

The ConfigFile resource creates a set of Kubernetes objects from a Kubernetes manifest. While ConfigGroup offers a superset of functionality, the ConfigFile gives a concise way to apply a specific manifest.

The ConfigFile resource accepts the following input properties:

Property	Description
`file`	A file or URL to a Kubernetes manifest file.
`resourcePrefix`	A prefix for auto-generated names of the child resources. Defaults to the `ConfigFile` name.
`skipAwait`	Skips over the readiness checks on the child resources.

See the API Reference documentation for more information.

Manifest File

Here’s an example of applying a Kubernetes manifest file to your cluster:

name: demo-cg-1
runtime: yaml
resources:
 cf:
 type: kubernetes:yaml/v2:ConfigFile
 properties:
 file: ./manifest.yaml

Example: Certificate Manager

Here’s a complete example of how to install and use cert-manager using ConfigGroup resources.

name: cert-manager
runtime: yaml
description: Installs cert-manager. See https://cert-manager.io/docs/installation/kubectl/ for details.
variables: {}
resources:
 install:
 type: kubernetes:yaml/v2:ConfigGroup
 properties:
 files:
 - https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.yaml
 test:
 type: kubernetes:yaml/v2:ConfigGroup
 options:
 dependsOn:
 - ${install}
 properties:
 yaml: |
 apiVersion: v1
 kind: Namespace
 metadata:
 name: cert-manager-test
 ---
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
 name: test-selfsigned
 namespace: cert-manager-test
 spec:
 selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
 name: selfsigned-cert
 namespace: cert-manager-test
 annotations:
 config.kubernetes.io/depends-on: cert-manager.io/namespaces/cert-manager-test/Issuer/test-selfsigned
 spec:
 dnsNames:
 - example.com
 secretName: selfsigned-cert-tls
 issuerRef:
 name: test-selfsigned

Conclusion

With the new resources in yaml/v2, we’re excited to enable new scenarios in Pulumi YAML and the Pulumi Java SDK. Stay tuned for new editions of the Chart and Directory resources, coming soon.

This is part of a broad initiative to use Multi-Language Component (MLC) technology to offer a consistent experience across the Pulumi SDKs. See pulumi-kubernetes#1971 for details.

Check out the following links to learn more about Pulumi Kubernetes today!

Pulumi Universal IaC: New Support For Java, YAML and AWS CDK

Luke Hoban — Wed, 04 May 2022 07:00:00 -0700

Some of the code in this post is out of date. See the AWS guides for an updated overview and examples.

Over the last year since the launch of Pulumi 3.0, we’ve seen incredible growth in adoption and usage of the Pulumi open source project and Cloud Engineering platform, with more than a thousand new open source contributors, tens of thousands of new users, and millions of new cloud infrastructure resources being managed by Pulumi. Pulumi’s infrastructure as code tools are enabling teams to scale up their cloud infrastructure with robust software engineering tools and practices to get the most value out of their cloud platform investments.

Today, we’re excited to announce a wave of innovation across the Pulumi project with a collection of significant new feature launches. These new features bring together Pulumi’s Universal Infrastructure as Code offering, supporting the widest range of builders, clouds, programming languages, and cloud architectures.

Today’s launches include:

Pulumi support for Java: New support for Java across the entire Pulumi platform, providing full access to the rich software engineering ecosystem for Java and the JVM.
Pulumi YAML: A new simple YAML interface to the Pulumi platform, broadening the reach of Pulumi to use cases where a full blown programming language is not (yet!) necessary.
Crosswalk for AWS in all Pulumi Languages: Support for the popular Crosswalk for AWS packages (for ECS, VPC, API Gateway and EKS) in all Pulumi languages.
AWS CDK on Pulumi: Support for deploying AWS CDK constructs from within Pulumi infrastructure as code programs, enabling access to the broad array of higher-level components for AWS built by teams at AWS and the AWS CDK community.
New Cloud and SaaS Providers: More than a dozen new packages in the Pulumi Registry for popular cloud/SaaS platforms from Pulumi partners, including Oracle Cloud, Elastic Cloud and Databricks.
Pulumi Service Provider for Pulumi: A new provider for managing the Pulumi Service using Pulumi Infrastructure as Code.
Pulumi CrossCode: Key improvements in the core technology powering Pulumi’s universal infrastructure as code features, including pulumi import, pulumi convert and more.

These new features build on the Pulumi 3.0 foundation to offer a truly universal infrastructure as code platform for modern cloud engineers and teams.

Pulumi Support For Java

Java is one of the most used programming languages in the world, with heavy usage in enterprises and organizations building for the cloud. The Java ecosystem has played a leading role in offering an incredibly rich ecosystem of software engineering capabilities - IDE tooling, strong typing, design patterns, build and package management, unit testing, and more.

Pulumi now supports Java (in addition to existing support for TypeScript, Python, Go and .NET) and other languages targeting the JVM. All the existing Pulumi CLI workflows can now be used with Java, and all packages in the Pulumi Registry are now available as Java libraries in Maven Central.

You can get started with Pulumi using Java today in the Pulumi Getting Started guide and the Pulumi and Java language docs.

👉 Read more in the Pulumi and Java blog post.

Pulumi YAML

Pulumi has differentiated itself as an Infrastructure as Code tool that embraces popular programming languages and their rich software engineering ecosystems. However, our goal has always been to offer the broadest range of language support for the wide variety of use cases and users who need to interact with cloud infrastructure in modern cloud organizations.

Pulumi YAML offers a new, simple interface to the full richness of the Pulumi Platform. Pulumi YAML allows infrastructure as code to be authored in a single simple YAML file with just a few lines of YAML, immediately familiar to any engineer, operator or developer.

name: yamldemo
runtime: yaml
resources:
 bucket:
 type: aws:s3:Bucket
 properties:
 website:
 indexDocument: index.html
 index.html:
 type: aws:s3:BucketObject
 properties:
 bucket: ${bucket.id}
 content: <h1>Hello, world!</h1>
 contentType: text/html
 acl: public-read
outputs:
 bucketName: ${bucket.id}

Like all other Pulumi languages, Pulumi YAML programs have access to all the core features of Pulumi’s infrastructure as code tooling, including native providers, secrets management, stack references, Pulumi Packages, and all the features of the Pulumi Service. YAML programs can interoperate seamlessly with the rest of the Pulumi ecosystem, consuming the outputs of other Pulumi programs and using Pulumi components built in existing Pulumi languages. For example, a complete EKS cluster can be configured using the EKS package (implemented in TypeScript):

name: eks-cluster
runtime: yaml
resources:
 cluster:
 type: eks:Cluster
outputs:
 kubeconfig: ${cluster.kubeconfig}

Access to Pulumi packages authored in other Pulumi languages means complexity can be pushed into reusable infrastructure components instead of copy-pasted in YAML. And when complexity does increase, Pulumi YAML supports a new pulumi convert command to eject into any other Pulumi programming language to manage the increased complexity via rich software engineering features in those languages.

You can get started with Pulumi YAML today in the Pulumi Getting Started guide and the Pulumi YAML language docs.

👉 Read more in the Pulumi YAML blog post.

Crosswalk for AWS in All Pulumi Languages

Crosswalk for AWS is a collection of libraries that use automatic well-architected best practices to make common infrastructure as code tasks in AWS easier and more secure. This includes libraries for EKS and API Gateway as well as the AWSX library that provides VPC, ECS, LoadBalancing and more. All of these libraries are now available in the Pulumi Registry for all Pulumi languages. The AWSX library, which was previously only available for Pulumi TypeScript users has become one of the most used libraries in the Pulumi ecosystem. With today’s release, it is now available to the entirety of the Pulumi language ecosystem - including Java and YAML!

For example - to run a Docker container in ECS using default network and cluster settings, users can use the awsx.ecs.FargateService class along with an Application Load Balancer listening on port 80 at a stable address - with just a few lines of code:

import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";

const cluster = new aws.ecs.Cluster("default-cluster");

const lb = new awsx.lb.ApplicationLoadBalancer("nginx-lb");

const service = new awsx.ecs.FargateService("my-service", {
 cluster: cluster.arn,
 desiredCount: 2,
 taskDefinitionArgs: {
 container: {
 image: "nginx:latest",
 cpu: 512,
 memory: 128,
 essential: true,
 portMappings: [
 {
 containerPort: 80,
 targetGroup: lb.defaultTargetGroup,
 },
 ],
 },
 },
});

export const url = lb.loadBalancer.dnsName;

import pulumi
import pulumi_aws as aws
import pulumi_awsx as awsx

cluster = aws.ecs.Cluster("default-cluster")

lb = awsx.lb.ApplicationLoadBalancer("nginx-lb")

service = awsx.ecs.FargateService("my-service",
 cluster=cluster.arn,
 desired_count=2,
 task_definition_args=awsx.ecs.FargateServiceTaskDefinitionArgs(
 container=awsx.ecs.TaskDefinitionContainerDefinitionArgs(
 image="nginx:latest",
 cpu=512,
 memory=128,
 essential=True,
 port_mappings=[awsx.ecs.TaskDefinitionPortMappingArgs(
 target_group=lb.default_target_group
 )],
 )
 )
)

package main

import (
 "github.com/pulumi/pulumi-aws/sdk/v5/go/aws/ecs"
 "github.com/pulumi/pulumi-aws/sdk/v5/go/aws/lb"
 ecsx "github.com/pulumi/pulumi-awsx/sdk/go/awsx/ecs"
 lbx "github.com/pulumi/pulumi-awsx/sdk/go/awsx/lb"
 "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
 pulumi.Run(func(ctx *pulumi.Context) error {

 cluster, err := ecs.NewCluster(ctx, "default-cluster", &ecs.ClusterArgs{})
 if err != nil {
 return err
 }

 loadBalancer, err := lbx.NewApplicationLoadBalancer(ctx, "nginx-lb", &lbx.ApplicationLoadBalancerArgs{})
 if err != nil {
 return err
 }

 _, err = ecsx.NewFargateService(ctx, "my-service", &ecsx.FargateServiceArgs{
 Cluster: cluster.Arn,
 DesiredCount: pulumi.Int(2),
 TaskDefinitionArgs: &ecsx.FargateServiceTaskDefinitionArgs{
 Container: &ecsx.TaskDefinitionContainerDefinitionArgs{
 Image: pulumi.String("nginx:latest"),
 Cpu: pulumi.Int(512),
 Memory: pulumi.Int(128),
 Essential: pulumi.Bool(true),
 PortMappings: ecsx.TaskDefinitionPortMappingArray{
 ecsx.TaskDefinitionPortMappingArgs{
 ContainerPort: pulumi.Int(80),
 TargetGroup: loadBalancer.DefaultTargetGroup,
 },
 },
 },
 },
 })
 if err != nil {
 return err
 }

 ctx.Export("url", loadBalancer.LoadBalancer.ApplyT(func(alb *lb.LoadBalancer) interface{} {
 return alb.DnsName
 }))
 return nil
 })
}

var cluster = new Aws.Ecs.Cluster("default-cluster");
var lb = new Awsx.Lb.ApplicationLoadBalancer("nginx-lb");
var service = new Awsx.Ecs.FargateService("my-service", new Awsx.Ecs.FargateServiceArgs
{
 Cluster = cluster.Arn,
 DesiredCount = 2,
 TaskDefinitionArgs = new Awsx.Ecs.Inputs.FargateServiceTaskDefinitionArgs
 {
 Container = new Awsx.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
 {
 Image = "nginx:latest",
 Cpu = 512,
 Memory = 128,
 Essential = true,
 PortMappings = {new Awsx.Ecs.Inputs.TaskDefinitionPortMappingArgs
 {
 TargetGroup = lb.DefaultTargetGroup,
 }},
 }
 }
});
this.Url = lb.LoadBalancer.Apply(lb => lb.DnsName);

name: awsx
runtime: yaml
resources:
 cluster:
 type: aws:ecs:Cluster
 lb:
 type: awsx:lb:ApplicationLoadBalancer
 nginx:
 type: awsx:ecs:FargateService
 properties:
 cluster: ${cluster.arn}
 taskDefinitionArgs:
 container:
 image: nginx:latest
 cpu: 512
 memory: 128
 portMappings:
 - containerPort: 80
 targetGroup: ${lb.defaultTargetGroup}
outputs:
 url: ${lb.loadBalancer.dnsName}

You can get started with Crosswalk for AWS in the Pulumi Crosswalk for AWS Guides, now available with examples in all languages.

👉 Read more in the Pulumi Crosswalk for AWS support for all Pulumi Languages blog post.

AWS CDK on Pulumi

The AWS Cloud Development Kit (CDK) offers a large collection of higher-level libraries (“constructs”) for working with the AWS platform, built by service teams at AWS and by the AWS CDK community. These libraries are available in the same set of general purpose programming languages that Pulumi supports, with the primary difference being that AWS CDK compiles infrastructure programs into CloudFormation, and uses CloudFormation to drive deployments.

With the new AWS CDK on Pulumi project, available in public preview today, we are opening up the ability to use AWS CDK constructs from within a Pulumi deployment. For developers already using AWS CDK, this provides Pulumi as a new option for orchestrating deployments in place of CloudFormation, offering improved deployment speed, integration with the full set of features of the Pulumi Cloud Engineering Platform (like Policy as Code, Audit Logs, Secrets, and much more). But even better, you can also now combine AWS CDK and Pulumi resources in a single Pulumi infrastructure as code project - passing outputs from Pulumi resources into AWS CDK constructs, and outputs from AWS CDK constructs into Pulumi resources. This allows you to work across the >80 cloud and SaaS providers that Pulumi offers access to, while still benefiting from high level libraries from the AWS CDK project.

import * as fs from 'fs';
import * as aws_events from 'aws-cdk-lib/aws-events';
import * as aws_events_targets from 'aws-cdk-lib/aws-events-targets';
import * as aws_lambda from 'aws-cdk-lib/aws-lambda';
import { CfnOutput, Duration } from 'aws-cdk-lib';
import * as pulumi from '@pulumi/pulumi';
import * as pulumicdk from '@pulumi/cdk';
import { Construct } from 'constructs';
import { remapCloudControlResource } from './adapter';

// Use Pulumi to construct an inline Lambda function
const lambdaFn = new aws.lambda.CallbackFunction('lambda', {
 callback: (ev, ctx) => console.log(ev),
});

class LambdaStack extends pulumicdk.Stack {
 lambdaArn: pulumi.Output<string>;

 constructor(id: string, options?: pulumicdk.StackOptions) {
 super(id, { ...options, remapCloudControlResource });

 // Use the AWS CDK Rule API directly.
 const rule = new aws_events.Rule(this, 'rule', {
 // Run 6:00 PM UTC every Monday through Friday
 schedule: aws_events.Schedule.expression('cron(0 18 ? * MON-FRI *)'),
 });

 const fn = aws_lambda.Function.fromFunctionArn(this, 'lambdaFn', pulumicdk.asString(lambdaFn.arn))

 // Use the AWS CDK to add a Rule target to trigger the Function.
 rule.addTarget(new aws_events_targets.LambdaFunction(lambdaFn));

 // Export the Lambda function's ARN as an output.
 this.lambdaArn = this.asOutput(lambdaFn.functionArn);

 this.synth();
 }
}

// Construct the CDK stack as a Pulumi component.
const stack = new LambdaStack('teststack');

// Use an output from the CDK construct from Pulumi.
export const lambdaArn = stack.lambdaArn;

This can be deployed with the pulumi CLI just like any other Pulumi program.

> pulumi up
Updating (dev)
View Live: https://app.pulumi.com/lukehoban/cdk-cron-lambda/dev/updates/37
Type Name Status
+ pulumi:pulumi:Stack cdk-cron-lambda-dev created
+ └─ cdk:index:Stack teststack created
+ └─ cdk:construct:LambdaStack teststack/teststack created
+ ├─ cdk:construct:Function teststack/teststack/lambda created
+ │ ├─ cdk:construct:Role teststack/teststack/lambda/ServiceRole created
+ │ │ └─ aws-native:iam:Role lambdaServiceRole494E4CA6 created
+ │ └─ aws-native:lambda:Function lambda8B5974B5 created
+ └─ cdk:construct:Rule teststack/teststack/rule created
+ ├─ aws:cloudwatch:EventRule ruleF2C1DCDC created
+ ├─ aws:cloudwatch:EventTarget Target0 created
+ └─ aws:lambda:Permission ruleAllowEventRuleteststacklambda47768855D6EFF36B created
Resources:
+ 11 created
Duration: 48s

AWS CDK on Pulumi is available for TypeScript today in public preview.

👉 Read more in the AWS CDK on Pulumi blog post.

New Cloud and SaaS Providers

Since launching the Pulumi Registry last fall, we’ve added more than a dozen new packages, supporting a variety of new cloud and SaaS providers.

Oracle Cloud is the most recent major new cloud provider, offering access to the entire surface area of Oracle’s Cloud platform. In addition, new providers for Elastic Cloud, DataBricks, jFrog Artifactory, Event Store Cloud, Scaleway, Slack, TailScale, Twingate, Checkly, Buildkite and more continue to expand the long tail of cloud and SaaS platforms accessible from Pulumi.

Every package in the Pulumi Registry supports all Pulumi programming languages, including Java and YAML. Documentation and getting started guides for every package are available from the Registry. Contributions to the Registry are now simpler than ever, with enhanced guides for authoring and publishing your own package in the Pulumi Registry.

New Provider for the Pulumi Service

Pulumi’s users love managing all of their cloud infrastructure using Pulumi, and that includes managing the state of the Pulumi Service itself.

Today, we released a new Pulumi provider for the Pulumi Service, supporting configuration of Teams, Access Tokens, Stack Tags and Webhooks using infrastructure as code.

For example, you can create a webhook that is notified whenever a Pulumi Update completes, and log it using an AWS Lambda, with just a few lines of code using the new Pulumi Service provider along with the API Gateway package.

import * as awsx from "@pulumi/awsx";
import * as pulumiservice from "@pulumi/pulumi-service";

const api = new awsx.apigateway.API("api", {
 routes: [{ path: "/", method: "POST", eventHandler: async (ev) => {
 const body = Buffer.from(ev.body!, 'base64').toString("ascii")
 console.log(JSON.stringify(body));
 return { statusCode: 200, body: "" };
 }}],
});

const webhook = new pulumiservice.Webhook("webhook", {
 active: true,
 organizationName: "upstarts",
 displayName: "pulumipulumi",
 payloadUrl: api.url,
});

👉 Read more in the Pulumi Provider for the Pulumi Service blog post.

Pulumi CrossCode

Pulumi CrossCode is the underlying set of technologies that Pulumi uses to support a wide range of programming languages, to enable sharing components and packages between languages, to support converting infrastructure from existing formats into Pulumi, to import infrastructure directly from cloud providers into Pulumi code, and to support converting Pulumi YAML into other Pulumi languages.

Support for Java and YAML was built on (and into) CrossCode to enable these languages to leverage everything that exists in the Pulumi ecosystem and to easily plug into existing features like conversion tools, example generation and so much more value that exists in the Pulumi platform.

In addition, recent improvements to the pulumi import command were enabled by CrossCode - making it possible to generate Pulumi Programs from existing cloud infrastructure.

And of course, the new pulumi convert command is powered by the existing features of CrossCode, opening up new paths for adoption and scaling of Pulumi projects.

Learn more about the technology underlying CrossCode in GitHub.

Summary

Pulumi’s Universal Infrastructure as Code platform supports the widest range of builders, clouds, programming languages, and cloud architectures available today.

With support for a broad range of languages - from the enterprise software engineering features of Java, to the simple declarative interface of Pulumi YAML - Pulumi scales from the simplest cloud use cases up into the most complex cloud infrastructure being managed today, and bridges the gap between cloud platform teams, operations teams, and application development teams.

With support for more than 80 cloud and SaaS providers, Pulumi can be used across multi-cloud workloads, and to coordinate the entire range of cloud infrastructure and managed services that define your cloud application - not just a single cloud provider. And with high level components for AWS from both Pulumi Crosswalk for AWS and AWS CDK on Pulumi, developers working in AWS have the richest set of high level infrastructure building blocks available for productively composing well-architected cloud infrastructure on AWS.

To learn more about each of the new features - check out these blog posts with more details:

We’re incredibly excited about today’s launches, but also see an amazing opportunity ahead to continue to drive new innovation in Infrastructure as Code and the future of Cloud Engineering. Can’t wait to see what you build!

Infrastructure as Code with Java and Pulumi

Mikhail Shilkov — Wed, 04 May 2022 06:59:00 -0700

Infrastructure has become a core part of application development as modern cloud capabilities such as microservices, containers, serverless, and data stores define your application’s architecture. The term “infrastructure” covers all of the cloud resources your application needs to run. Modern architectures require thinking deeply about infrastructure while building your application, instead of treating it as an afterthought. Pulumi’s approach helps developers, infrastructure engineers, and platform teams work together to leverage everything the modern cloud has to offer.

Pulumi has worked with hundreds of companies to get cloud applications into production, and Java has quickly risen to become one of the most frequently requested features by the community. Pulumi is an open source product, and we are grateful to our awesome community members who bootstrapped Pulumi for Java last year and were instrumental in helping us with this public preview. Thank you to Paweł Prażak and his VirtusLab colleagues!

Pulumi supports Java for all of your modern infrastructure as code needs, this means you can build, deploy, and manage your infrastructure on any cloud—including all of AWS, Azure, Google Cloud, Kubernetes, Oracle Cloud, and more—using Java and other JVM languages. With Pulumi, you will have the entire cloud at your fingertips without ever having to leave your code editor, while using production-ready infrastructure as code techniques.

What is Pulumi?

Pulumi lets you build, deploy, and manage infrastructure on any cloud using general-purpose programming languages (TypeScript, Python, Go, .NET, Java) and markup languages (YAML, CUE) to express your application’s infrastructure needs, using a powerful technique called “infrastructure as code.” You declare desired infrastructure, and an engine provisions it for you, so that it’s automated, easy to replicate, and robust enough for demanding production requirements. Pulumi takes this approach a step further by leveraging programming languages and software engineering tools to make modern cloud infrastructure patterns, such as containers and serverless programs, easy and first-class citizens.

With Pulumi for Java you can:

Declare infrastructure using programs, classes, and libraries written in Java or other JVM languages (Kotlin, Scala, Clojure, Groovy, etc.).
Automatically create, update, or delete cloud resources using Pulumi’s infrastructure as code engine, removing manual point-and-clicking in web consoles and ad-hoc scripts.
Use your favorite IDEs and tools, including IntelliJ IDEA and Visual Studio Code, taking advantage of features like auto-completion, refactoring, and interactive documentation.
Catch mistakes early on with standard compiler errors, analyzers, and an infrastructure-specific policy engine for enforcing security, compliance, and best practices.
Reuse any existing Java package, or distribute your own, whether that’s for infrastructure best practices, productivity, or just general programming patterns.
Deploy continuously, predictably, and reliably using GitHub Actions, or one of over a dozen CI integrations.
Build scalable cloud applications using cloud native technologies like Kubernetes, Docker containers, serverless functions, and PaaS services into your core development experience, bringing them closer to your application code.

Pulumi’s free open source SDK, which includes a CLI and an assortment of libraries, enables these capabilities.

Example: Provision a GKE cluster with a Kubernetes namespace

The following Java snippet demonstrates the power of Pulumi for Java (full source code). The program defines a Google Kubernetes Engine cluster, calculates its kubeconfig and exports it for user’s needs, and deploys a Kubernetes namespace into the newly provisioned cluster.

package gke_sample;

import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;
import com.pulumi.gcp.container.*;
import com.pulumi.kubernetes.core_v1.*;

public class Program {
 private static void stack(Context ctx) {
 // Create a GKE cluster
 var cluster = new Cluster("mygke",
 ClusterArgs.builder()
 .initialNodeCount(1)
 .minMasterVersion("1.20.7")
 .build()
 );

 // Build and export a Kubeconfig for the newly created cluster.
 var kubeconfig = Utils.buildKubeconfig(cluster);
 ctx.export("kubeconfig", kubeconfig);

 // Create a Kubernetes provider instance that uses our cluster from above.
 var clusterProvider = new Provider("gke-provider",
 ProviderArgs.builder().kubeconfig(kubeconfig).build());

 // Create a Kubernetes Namespace
 var ns = new Namespace("test",
 NamespaceArgs.Empty,
 CustomResourceOptions.builder().provider(clusterProvider).build()
 );
 }

 public static void main(String[] args) {
 Pulumi.run(App::stack);
 }
}

Resources are defined declaratively using class constructors and argument builders. Dependencies between resources are managed automatically by the Pulumi engine based on the way you use variables in the program. You are free to use any libraries, helper functions—for instance, to build the kubeconfig string above, classes, if statements, for loops, and all the other tools available to Java developers.

Why is Java great for infrastructure too?

Many of us love using Java to author our applications, so why not use it for infrastructure as code too? By using Java, you get many helpful features for your infrastructure code:

Familiarity: No need to learn DSLs or markup templating languages.
Expressiveness: Use loops, conditionals, pattern matching, async code, and more, to dynamically create infrastructure that meets the target environment’s needs.
Abstraction: Encapsulate common patterns into classes and functions to hide complexity and avoid copy-and-pasting the same boilerplate repeatedly.
Sharing and reuse: Tap into a community of cloud applications and infrastructure experts by sharing and reusing Maven or Gradle packages with your team or the global community.
Productivity: Use your favorite IDE and get statement completion, go to definition, live error checking, refactoring, static analysis, and interactive documentation.
Project organization: Use common code structuring techniques to manage your infrastructure across one or more projects.
Application lifecycle: Use existing ALM systems and techniques to manage and deploy your infrastructure projects, including source control, code review, testing, and continuous integration (CI) and delivery (CD).

Pulumi unlocks access to the entire JVM ecosystem—something that’s easy to take for granted but is missing from other solutions based on DSLs or CLI scripts. This approach also helps developers and operators work better together using a shared foundation. Add all of the above together, and you get things done faster and more reliably.

Join the community and get started

The first preview of Pulumi for Java includes support for the entire breadth of services in AWS, Azure, Google Cloud, and more. Give Pulumi a try, visit the Pulumi for Java docs.

There you will find several instructions on installing and getting started with Pulumi for Java. The following resources provide additional useful information:

Although Pulumi for Java is listed in “preview” status, it supports all of the most essential Pulumi programming model features (and the rest is on its way). Our goal is to gather feedback over the next few weeks, and we will be working hard to improve the Java experience across the board, including more examples and better documentation.

Pulumi is open source on GitHub and you can find the Java plugin at pulumi/pulumi-java. And you’re welcome to join the community in Slack to discuss your scenarios, ideas, and to get any needed assistance from the team and other end users.

We look forward to seeing the new and amazing cloud applications you build with Pulumi for Java!