tag: Iac · 14 items
- Platform/SRE — Plan: If you use Pulumi with connection-string URLs (e.g. Postgres), upgrade to sdk/v3.260.0 to prevent passwords leaking into state/log output; no hard deadline but a meaningful security hygiene improvement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Act: OpenTofu 1.11 hit EOL on 2026-08-19 and this is its final patch; the credential-leak via OCI HTTP redirect and the DoS via crafted remote-state URLs are both active security risks in IaC runs. Upgrade to a supported OpenTofu release series (1.12+) now that EOL has passed.
- CI/CD — Act: The credential-leak bug affects
tofu initwhen pulling modules or providers from OCI registries — a standard pipeline step — and could expose registry credentials to a redirect target. Upgrade the OpenTofu version pinned in CI pipelines from 1.11.x to a supported series immediately; 1.11 is already EOL. - Leader — Skip
- Signals: OpenTofu 1.11 is past EOL (2026-08-19, 5d ago)
- Platform/SRE — Learn: Adds a useful –ignore-protect flag for managing protected resources and fixes TLS verification failures against self-hosted Pulumi backends using self-signed certs; no deadline or breaking change, so worth noting for Pulumi shops at the next upgrade cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New
pulumi stack migratecommand enables moving stacks between backends with secret re-encryption, and--override-envallows one-shot environment substitution without editing stack config — useful patterns to know but no action required with no deadline or breaking change. - CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Platform engineers running OpenTofu should upgrade to 1.12.5 to address the ECH handshake privacy leak (server hostname de-anonymization via passive observation) and the implicit-move provider state bug; no KEV listing or active exploitation reported, so no hard deadline, but this should be included in the next IaC toolchain update cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: A security fix for an ECH pre-shared key identity leak in OpenTofu v1.11.x warrants upgrading to v1.11.13; no KEV listing or active exploitation reported, so this is a planned patch rather than an emergency — schedule the upgrade this sprint.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: HCP Terraform and Terraform Enterprise now include workspace and Stacks restore features, which are relevant to DR and state-recovery planning for teams standardized on either product; evaluate whether these capabilities close gaps in your current runbooks.
- CI/CD — Skip
- Leader — Learn: HashiCorp is expanding HCP Terraform’s resilience and governance surface; useful context for teams standardized on the product when assessing vendor roadmap health, but no strategic decision is forced here.
- Platform/SRE — Learn: Google’s managed Terraform execution service removes the need to self-host a Terraform backend or state management layer on GCP; worth evaluating if you run Terraform on GCP but no action required today.
- CI/CD — Skip
- Leader — Learn: A managed Terraform service from GCP could shift the build-vs-buy calculus on Terraform state/execution tooling, but no strategic decision is forced yet — file for next platform toolchain review.
- Platform/SRE — Learn: A thoughtful analysis of stateless Terraform patterns is worth reading for platform engineers managing state backends and drift, but no operational change is required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Oracle’s enterprise-scale migration validates OpenTofu as production-ready; teams running Terraform under the BUSL license should schedule an evaluation of OpenTofu as a drop-in replacement within the next planning cycle.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly switching to the OpenTofu fork is a clear signal that the fork has enterprise momentum; leaders standardized on Terraform should put an OpenTofu migration evaluation on the roadmap to reduce BUSL licensing risk before it becomes a contractual concern.
- Platform/SRE — Plan: If your pipelines use pulumi/actions or pulumi/action-install-pulumi-cli, both have major version bumps (v6→v7, v1→v2) that likely include breaking changes; audit your workflow files and update action refs this quarter.
- CI/CD — Plan: pulumi/actions jumped v6→v7 and pulumi/action-install-pulumi-cli jumped v1→v2 — major bumps that may break existing pipeline steps; review release notes for both actions and update workflow references before Renovate auto-merges cause unexpected failures.
- Leader — Skip
- Platform/SRE — Learn: A survey of root module organization patterns for Terraform — useful for evaluating or refining IaC structure, but no operational change required today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Reframes Terraform state as a distributed consistency problem — worth reading to inform how you architect remote state backends and locking, but no GA tool or urgent change to make today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Teams using CDKTF for IaC should read this discussion to gauge whether HashiCorp/IBM intends to maintain it long-term; no deprecation date in signals, so no action required now.
- CI/CD — Skip
- Leader — Plan: Against the backdrop of HashiCorp’s BSL relicensing and IBM acquisition, a high-signal HN discussion on CDKTF’s direction is a prompt to evaluate whether to continue standardizing on CDKTF or assess alternatives like OpenTofu CDK this planning cycle.