feat: Stacks Pulumi support by maciaszczykm · Pull Request #3820 · pluralsh/console

maciaszczykm · 2026-07-09T13:44:47Z

Similar to #3631 which added support for Terragrunt.

Documentation added in pluralsh/documentation#611.

Test Plan

Repository with samples: https://github.com/pluralsh/pulumi-samples
Test environment: https://console.plrl-dev-aws.onplural.sh/
Console, controller and agent image tag: sha-10ecf45

Checklist

I have added a meaningful title and summary to convey the impact of this PR to a user.
If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

linear · 2026-07-09T13:44:51Z

PROD-4659

soffi-ai · 2026-07-09T13:45:02Z

Soffi AI Summary

This PR adds Pulumi as a first-class IaC stack type in Plural Console, following the same pattern established by the earlier Terragrunt support. It introduces end-to-end support across all layers of the stack — server, controller, deployment agent harness, Go client, and React frontend.

Key changes by layer:

Elixir server & GraphQL schema: New PulumiConfiguration type (with fields for stack, backendUrl, parallel, refresh, approveEmpty) is added to StackConfiguration and StackOverrides. A new PULUMI enum value is added to StackType. Validation is added to reject Pulumi stacks that specify a policy engine (incompatible combination).
Go controller (go/controller/): InfrastructureStack and StackDefinition CRD types gain a PulumiConfiguration struct and field. CRD YAML manifests (both in go/controller/config/crd/ and charts/controller/crds/) are regenerated to include the new Pulumi fields. Deepcopy methods are generated. Unit tests are added for the new stack type.
Go client (go/client/): GraphQL operations and models are updated/regenerated to include PulumiConfiguration and the new StackType enum value. Persisted queries are updated accordingly.
Deployment operator harness (go/deployment-operator/): A new CD workflow (deployment-operator-cd-harness.yaml) for the Pulumi harness image is added, enabling the agent to execute Pulumi stack runs (preview, up, destroy). Fixes include nil pointer dereference handling, ensuring the Pulumi home directory, passing env vars to pulumi stack export, using preview mode during up, and supporting a configurable backend URL via pulumi login.
React frontend (assets/): The stack configuration UI is extended with a Pulumi-specific settings panel (stack name, backend URL, parallelism, refresh, approve-empty options). A PulumiLogoIcon is added to the design system. Stack type utilities and the type icon component are updated to recognize PULUMI. New GraphQL fragments and queries for Pulumi configuration are added and codegen-regenerated.
Docker/CI: The Dockerfile base image is bumped, and the harness CD workflow is wired up for Pulumi alongside the existing Terraform/Terragrunt/Ansible harnesses. Agent/sentinel harness workflows are updated to reflect related image tag changes.

The feature was validated end-to-end using sample Pulumi programs in a dedicated test repo against a live Console environment.

Commits

Commit	Summary

Deploy in Soffi

Updated: 2026-07-15 09:32 UTC

socket-security · 2026-07-10T09:55:13Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/node@22.20.0 ⏵ 24.10.1	⁺¹		⁺¹

View full report

maciaszczykm · 2026-07-10T09:56:14Z

@greptileai

greptile-apps · 2026-07-10T10:01:27Z

Greptile Summary

This PR adds Pulumi as a supported IaC tool in the stacks harness, following the same structure introduced for Terragrunt. The implementation covers the full lifecycle: backend login, stack selection, config variable injection, dependency installation, preview, apply, destroy, state export, output collection, and secret detection.

Go harness (pkg/harness/tool/pulumi/): New Pulumi tool wiring together Prepare, four ArgsModifier types, State/Output via pulumi stack export/output --json, and HasChanges via pulumi preview --json. The previously raised missing-env-in-stackExport and nil-Run-dereference issues are both resolved.
Elixir layer: Adds pulumi: 4 enum, Pulumi configuration embed, policy-engine validation guard, and three-clause pulumi_commands/2 consistent with the modifier expectations.
CRD & controller: New PulumiConfiguration type; Validate() blocks policy-engine use on Pulumi stacks at admission time.

Confidence Score: 5/5

Safe to merge — the new Pulumi tool is well-structured and the prior issues are all resolved in this version.

The implementation correctly handles the full Pulumi lifecycle with proper env propagation, nil guards, and plan-file threading. All prior blocking issues are resolved. Two minor observations remain but neither affects runtime correctness.

No files require special attention.

Important Files Changed

Filename	Overview
go/deployment-operator/pkg/harness/tool/pulumi/pulumi.go	New Pulumi tool implementation. The stackExport env fix and nil-run guard are correctly in place. Minor: installDependencies uses raw osexec.Command for go mod download (no timeout, no exec-level logging) inconsistently with the npm path.
go/deployment-operator/pkg/harness/tool/pulumi/modifier.go	Four ArgsModifier implementations. UpArgsModifier now correctly appends --plan planFile. Logic for idempotent flag injection is correct.
go/deployment-operator/dockerfiles/harness/pulumi.Dockerfile	New Pulumi harness image with SHA256-verified binary download. Python omitted and documented.
go/deployment-operator/pkg/harness/controller/controller_hooks.go	Adds Prepare() call in preStart(). Scan() errors remain klog.ErrorS (non-fatal), consistent with prior behavior.
go/deployment-operator/pkg/harness/stackrun/v1/types.go	Adds Parallel, PulumiStack, PulumiBackendURL, Deleted fields. Deleted correctly derives from Stack.DeletedAt.
go/controller/api/v1alpha1/infrastructurestack_types.go	Adds PulumiConfiguration and Validate() blocking policyEngine on PULUMI stacks. Both Go and Elixir layers enforce this.
lib/console/deployments/stacks/commands.ex	Adds pulumi_commands/2 with three clauses matching modifier expectations.
lib/console/schema/stack.ex	Adds pulumi: 4 enum, Pulumi embed, and validate_policy_engine/1 guard.
go/deployment-operator/pkg/harness/tool/pulumi/pulumi_test.go	Good coverage: HasChanges, Output secret redaction, configureVariables type mapping, Prepare env propagation, and nil-Run constructor.

_{Reviews (7): Last reviewed commit: "update persisted queries with new operat..." | Re-trigger Greptile}

maciaszczykm · 2026-07-10T11:03:33Z

@greptileai

maciaszczykm · 2026-07-10T14:18:54Z

@greptileai

maciaszczykm · 2026-07-10T14:41:39Z

@greptileai

…acks-pulumi-support

maciaszczykm · 2026-07-14T13:15:21Z

@greptileai

maciaszczykm · 2026-07-14T14:19:36Z

@greptileai

…acks-pulumi-support

michaeljguarino

will the pulumi code need a specific go version if it's go based? Probably not a huge issue since node is probably our best target here, but worth thinking about.

…acks-pulumi-support

maciaszczykm · 2026-07-15T09:38:56Z

@michaeljguarino Added a ticket to investigate it.

add image

57b3522

maciaszczykm added 9 commits July 10, 2026 11:12

update server and client

bf4993b

update controller

2cc6b9c

update harness

9fa84d7

update frontend

c078161

add samples

d0863a9

fix controller

5ff41a6

update node

c032e37

update node

bed1c0b

fix frontend

43c78cb

maciaszczykm added the enhancement New feature or request label Jul 10, 2026

add pulumi icon

3080761

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread go/deployment-operator/pkg/harness/tool/pulumi/modifier.go

Comment thread go/deployment-operator/pkg/harness/tool/pulumi/pulumi.go Outdated

Comment thread go/deployment-operator/dockerfiles/harness/pulumi.Dockerfile

maciaszczykm added 3 commits July 10, 2026 12:56

use preview during up

75f9d5d

fix nil pointer dereference

ad06907

add comments

5fe5026

add backend url support

659ca45

maciaszczykm force-pushed the marcin/prod-4659-stacks-pulumi-support branch from 817d4d6 to 659ca45 Compare July 10, 2026 14:13

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread go/deployment-operator/pkg/harness/tool/pulumi/pulumi.go

pass env to pulumi stack export command

10ecf45

maciaszczykm added 2 commits July 13, 2026 14:21

Merge remote-tracking branch 'origin/master' into marcin/prod-4659-st…

4539c20

…acks-pulumi-support

fix linter

206ec98

maciaszczykm added 2 commits July 13, 2026 15:49

ensure pulumi home directory

a9fadd4

update samples

d268021

maciaszczykm marked this pull request as ready for review July 14, 2026 13:31

maciaszczykm requested a review from a team as a code owner July 14, 2026 13:31

greptile-apps Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread go/deployment-operator/pkg/harness/controller/controller_hooks.go

add validation to reject Pulumi stacks with policy engines

149de4e

maciaszczykm added 2 commits July 14, 2026 16:20

Merge remote-tracking branch 'origin/master' into marcin/prod-4659-st…

d3b5e92

…acks-pulumi-support

update persisted queries with new operations

6d26f34

maciaszczykm requested a review from a team July 14, 2026 14:23

michaeljguarino approved these changes Jul 14, 2026

View reviewed changes

maciaszczykm added 2 commits July 15, 2026 11:27

Merge remote-tracking branch 'origin/master' into marcin/prod-4659-st…

e981493

…acks-pulumi-support

generate

6570ff6

maciaszczykm merged commit fc037ec into master Jul 15, 2026
108 of 110 checks passed

maciaszczykm deleted the marcin/prod-4659-stacks-pulumi-support branch July 15, 2026 09:56

Uh oh!

Conversation

maciaszczykm commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Plan

Checklist

Uh oh!

linear Bot commented Jul 9, 2026

Uh oh!

soffi-ai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Soffi AI Summary

Commits

Uh oh!

socket-security Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maciaszczykm commented Jul 10, 2026

Uh oh!

greptile-apps Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maciaszczykm commented Jul 10, 2026

Uh oh!

maciaszczykm commented Jul 10, 2026

Uh oh!

Uh oh!

maciaszczykm commented Jul 10, 2026

Uh oh!

maciaszczykm commented Jul 14, 2026

Uh oh!

Uh oh!

maciaszczykm commented Jul 14, 2026

Uh oh!

michaeljguarino left a comment

Choose a reason for hiding this comment

Uh oh!

maciaszczykm commented Jul 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maciaszczykm commented Jul 9, 2026 •

edited

Loading

soffi-ai Bot commented Jul 9, 2026 •

edited

Loading

socket-security Bot commented Jul 10, 2026 •

edited

Loading

greptile-apps Bot commented Jul 10, 2026 •

edited

Loading