Pulumi Components

Pulumi components allow you to provision infrastructure in your customer’s cloud account to power your install.

Pulumi components allow you to deploy a Pulumi program from a public or connected repo, to provision infrastructure resources in customer installs.

Configuring a Pulumi component

To configure a Pulumi component, specify a repo, the Pulumi runtime, and any stack configuration values the program requires.

components/<your-component>.toml

# pulumi
name    = "pulumi_infra"
type    = "pulumi"
runtime = "go"

[connected_repo]
repo      = "nuonco/kitchen-sink"
directory = "components/pulumi"
branch    = "main"

[config]
"aws:region"              = "{{.nuon.install_stack.outputs.region}}"
"kitchen-sink:install_id" = "{{.nuon.install.id}}"

[env_vars]
PULUMI_SKIP_UPDATE_CHECK = "true"

The runtime field selects the language your Pulumi program is written in and must match the runtime declared in the project’s Pulumi.yaml. Supported runtimes are go, nodejs, python, dotnet, java, and yaml.

You can configure Pulumi components to use either a public repo (using a public_repo block) or a private GitHub repo (using a connected_repo block). Read more about VCS configuration here.

You can also put the Pulumi source inside of the same repo as your app config, and point to it.

If you include the Pulumi source in the app config repo, push the source along with the rest of the repo. A branch run rebuilds a component when its config changes, so a push that changes only the Pulumi source does not rebuild it. After that push, run nuon branches trigger --branch-id <branch> --force, or build the component manually in the dashboard or CLI.

By default Nuon uses the latest Pulumi CLI. To pin a specific version, set pulumi_version.

components/<your-component>.toml

# pulumi
name           = "pulumi_infra"
type           = "pulumi"
runtime        = "go"
pulumi_version = "3.100.0"

Configuring stack config

Use the [config] block to set Pulumi stack configuration values, equivalent to pulumi config set. Keys use the namespace:key format — for example, aws:region targets the AWS provider, while a project-scoped key such as kitchen-sink:install_id is read by your program via config.New(ctx, "kitchen-sink").

Config values support component variables, so they can access inputs, other components, the sandbox, and details about the install itself using templating.

components/<your-component>.toml

[config]
"aws:region"              = "{{.nuon.install_stack.outputs.region}}"
"kitchen-sink:install_id" = "{{.nuon.install.id}}"

Use the [env_vars] block to pass environment variables into the Pulumi execution environment.

State Management

All Pulumi state is managed by the Nuon data plane through the Nuon http-based API. The runner imports the prior state before each operation and uploads the updated state back to the control plane when the operation completes.

Each execution of a Pulumi component in an install is visible in the plan and apply steps in the dashboard.

The Enterprise edition has two additional features including requiring approvals of the plan and apply steps and showing diffs from previous runs.

Execution and Permissions

The runner is responsible for executing Pulumi, and is provisioned as part of the initial Install Stack. e.g., in AWS, the CloudFormation stack creates a VPC, networking, ASG and an EC2 instance to start the runner. The runner is separate from the Install’s infrastructure e.g., Kubernetes cluster.

To learn more about the runner, read the Nuon Runner Architecture blog post.

Per-install config overrides

To override a Pulumi component’s config for a single install without changing your app config, use component overrides.