033 - Parallel Workflows, Policy Analytics, and Improved GCP/Azure

New: Parallel Workflows, Retries, Policy Analytics, Labels Improved: Azure, GCP, Plan Diffs, Runner Management

April 24, 2026

Parallel Worflows

No longer blocked on an in-flight deploy - you can run multiple workflows concurrently.

Workflows on an install used to queue behind each other, now you can fire off diagnostic actions while a deploy is in flight.

Automatic Retries

Configure auto_retry on a component and it re-plans + re-applies itself on transient failures; bound retries per component with max_auto_retries so a genuinely broken component still surfaces instead of looping forever.

Runner Process Management

On the Install’s Runner, we now show both the management (VM) process and container process directly and let you control them.

Drift Detection - Better diffs

Diff rendering is updated to be easier to navigate and approve changes. Preventing a missed critical change in the customer environment.

Policy Evaluation Analytics

When a policy is starting to throw warnings, you need to know which install and which component, action or deploy triggered it. Every policy evaluation is now surfaced on a per-app Analytics page.

Labels

You can now label installs, components, and actions. This enables you to add additional metadata to labels and correlate installs, actions and more together.

Azure Improvements

Bring your own stack

Vendors and customers can layer their own infrastructure on top of the default Azure install using the new install-stacks repo. This makes it easy to meet enterprise networking, compliance, or naming requirements.

Pick the right sandbox for the job

• AKS sandbox now supports Karpenter via the Node Auto Provisioning add-on.
• Azure Min sandbox is a lightweight sandbox for foundation Azure infrastructure such as container registry. It can power environments such as Azure Container Apps.

Start fast with proven app templates

• aks-simple for Kubernetes apps
• aca-simple for serverless container apps on Azure Container Apps

Runner authentication

Runners on Azure authenticate to Nuon using Azure’s workload identity. This removes shared secrets and rotation, and matches the zero-trust posture already available on AWS and GCP.

First-class container registry support

Builds, image syncs, and component deploys work seamlessly with Azure Container Registry, with per-organization identity and access handled automatically.

Customer-managed secrets via Key Vault

App secrets sync directly into Azure Key Vault, so workloads can consume them through native Azure mechanisms, the same pattern customers already use with AWS Secrets Manager.

GCP Improvements

GCP runners now authenticate with management-mode credentials and ship with a default runner template, so spinning up a GCP install is a one-step flow.

Other Updates

Policy Config API & Reporting

• Added a GET /v1/apps/{app_id}/policies-configs/{config_id} endpoint for retrieving an app’s policy configuration, with corresponding dashboard-ui integration.

• “Policy Evaluations” has been renamed to “Policy Reports” across the UI and docs. Sandbox policies now correctly scope to the sandbox install only.

Nuon CLI - New Commands

nuon install stacks

For listing and retrieving install stacks. This command is useful for scripting workflows and

nuon installs stacks
# e.g. to get th emost recent aws quick link url
nuon installs stacks latest --json | jq '.quick_link_url'

nuon installs actions

Has been augmented with sub-commands to get action outputs:

# for use in CI
nuon installs actions outputs --action-workflow-id --json

nuon installs components

Has been augmented with sub-commands to get component outputs:

# for use in CI
nuon installs components outputs --component-id --json