Pulumi stacks

Configure Pulumi stacks and authenticate to Pulumi Cloud or self-managed state backends

Plural runs Pulumi programs through an InfrastructureStack with type: PULUMI. A Pulumi run logs in to the configured backend, selects or creates the configured stack, then runs the usual preview, apply, or destroy workflow.

yaml

apiVersion: deployments.plural.sh/v1alpha1
kind: InfrastructureStack
metadata:
  name: example-pulumi-stack
  namespace: default
spec:
  type: PULUMI
  repositoryRef:
    name: infrastructure
    namespace: default
  clusterRef:
    name: mgmt
    namespace: infra
  git:
    ref: main
    folder: pulumi
  configuration:
    pulumi:
      stack: dev
      parallel: 10
      refresh: true
      approveEmpty: true

configuration.pulumi.stack defaults to dev. Omit backendUrl to use Pulumi Cloud, or set it to a Pulumi-supported self-managed backend URL. Unlike Terraform, manageState does not manage Pulumi state; configure the state backend with backendUrl.

Pulumi Cloud

Pulumi Cloud is the default backend. Authenticate the runner with a PULUMI_ACCESS_TOKEN sourced from a Kubernetes Secret in the same namespace as the InfrastructureStack.

yaml

apiVersion: v1
kind: Secret
metadata:
  name: pulumi-cloud-credentials
  namespace: default
type: Opaque
stringData:
  accessToken: YOUR-PULUMI-ACCESS-TOKEN
---
apiVersion: deployments.plural.sh/v1alpha1
kind: InfrastructureStack
metadata:
  name: example-pulumi-cloud
  namespace: default
spec:
  type: PULUMI
  # repositoryRef, clusterRef, and git omitted
  environment:
    - name: PULUMI_ACCESS_TOKEN
      secretKeyRef:
        name: pulumi-cloud-credentials
        key: accessToken

Create access tokens in Pulumi Cloud for the organization that owns the project and stack. Do not put a token in backendUrl, Git, or a plain environment value.

S3 and other self-managed backends

To use S3, set backendUrl and authenticate the runner to AWS. Workload identity is recommended: configure the stack runner's service account with EKS Pod Identity or IRSA, then select it with jobSpec.serviceAccount.

yaml

apiVersion: deployments.plural.sh/v1alpha1
kind: InfrastructureStack
metadata:
  name: example-pulumi-s3
  namespace: default
spec:
  type: PULUMI
  # repositoryRef, clusterRef, and git omitted
  configuration:
    pulumi:
      stack: dev
      backendUrl: s3://YOUR-PULUMI-STATE-BUCKET?region=eu-central-1&awssdk=v2
  environment:
    - name: AWS_REGION
      value: eu-central-1
    - name: PULUMI_CONFIG_PASSPHRASE
      secretKeyRef:
        name: pulumi-state-credentials
        key: passphrase
  jobSpec:
    namespace: plrl-deploy-operator
    serviceAccount: stacks