tag: Iac · 26 items
- Platform/SRE — Plan: Platform teams pulling providers and modules from the public Terraform Registry are subject to the revised ToS; review the updated terms and evaluate whether to implement a provider network mirror or private registry to ensure automated and commercial usage remains compliant.
- CI/CD — Plan: CI pipelines that run
terraform initagainst the public registry are exposed to ToS restrictions on automated usage; audit pipeline patterns and consider mirroring providers or switching to the OpenTofu registry to keep builds compliant. - Leader — Plan: This ToS change compounds the earlier BSL relicensing as a vendor-risk signal for orgs standardized on Terraform; use this moment to formally evaluate OpenTofu as the org’s IaC standard and assess whether current Registry usage complies with the new terms before the next planning cycle.
- Platform/SRE — Learn: A newly open-sourced collaborative IaC/DevOps tool worth evaluating as an alternative to existing platforms, but no GA maturity signal or migration deadline to act on yet.
- CI/CD — Skip
- Leader — Learn: Open-sourcing lowers vendor-risk barriers for evaluation; worth tracking as a potential addition to the golden-path toolkit, but no procurement or licensing decision is forced now.
- Platform/SRE — Learn: A thoughtful architectural critique of stateless Terraform patterns that could inform how platform teams design state management — no action required, but worth reading before committing to a stateless approach.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Two correctness fixes worth scheduling: the env edit/set/rm overwriting bug could silently discard environment changes in Pulumi-managed stacks, and the drift status fix improves reliability reporting accuracy. No deadline, but upgrade when next maintaining the Pulumi toolchain.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Oracle’s adoption of OpenTofu adds credibility to the fork as a production-grade Terraform alternative, reinforcing the case for teams still evaluating their IaC path after HashiCorp’s BSL relicensing — but no deadline or forced action exists here.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly standardizing on OpenTofu is a meaningful market signal; if your org hasn’t yet resolved its Terraform-vs-OpenTofu strategy following the 2023 BSL license change, schedule that evaluation this quarter before toolchain drift makes migration harder.
- Platform/SRE — Plan: This GA minor release patches a snapshot integrity error and restores elided asset contents from prior state — real correctness bugs for teams running Pulumi in production. Schedule an upgrade within the current planning cycle; no hard deadline exists.
- CI/CD — Learn: The new automation API methods (version, whoami, install) across Node/Python/Go SDKs expand programmatic pipeline control options, but no deprecation or breaking change makes this actionable today.
- Leader — Skip
- Platform/SRE — Plan: If you use pulumi-java with Maven 3.10, plugin downloads are silently broken because Maven 3.10 mixes log output into stdout and corrupts JSON parsing; upgrade to Pulumi SDK v3.268.0 to restore correct behavior while the upstream Maven bug is resolved.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If your team uses CDKTF for infrastructure, this HN discussion signals potential direction changes worth tracking; no concrete EOL date means no Act, but evaluate whether to continue investing in CDKTF vs. native HCL or OpenTofu-based workflows this quarter.
- CI/CD — Skip
- Leader — Plan: A high-signal HN thread (136 pts, 134 comments) on CDKTF’s future warrants a toolchain-risk review if your org has standardized on it — especially given the HashiCorp/IBM acquisition context; assess alternatives before teams invest further.
- Platform/SRE — Plan: Teams running AFT for multi-account provisioning should evaluate upgrading to AFT 1.22.0 to enable plan-only runs, which support pre-rollout drift detection and safer customization validation; no hard deadline, but it’s a meaningful operational improvement worth scheduling this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.7 to address CVE-2026-78662 and CVE-2026-56855, which allow an attacker-controlled SSH server to deadlock remote-exec/file provisioner connections; neither CVE is KEV-listed and EPSS scores are near zero, so schedule within the next IaC toolchain maintenance cycle rather than treating as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-56855 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78662 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: GA IaC release with real breaking changes: WinRM provisioner removed, macOS 13 Ventura now minimum, and 1.13.x will be the last series supporting 32-bit CPUs — audit current usage of these before upgrading, and plan the 32-bit migration for the next cycle.
- CI/CD — Plan: If OpenTofu runs inside pipelines (infra provisioning steps), audit for WinRM provisioner usage and verify the base64gzip output change doesn’t break deterministic artifact checks before scheduling the upgrade.
- Leader — Learn: OpenTofu 1.13’s healthy GA cadence (new planning primitives, upcoming linting/policy experiment) reinforces confidence in the Terraform-alternative bet, but there is no licensing, pricing, or vendor-risk development requiring a leadership decision here.
- Signals: OpenTofu 1.13 EOL 2027-08-01 · deprecation mentioned (no explicit date found)
- Platform/SRE — Learn: If your team uses CloudFront flat-rate plans, you can now automate subscription management via CloudFormation/CDK instead of manual console steps — useful for IaC-driven workflows but no operational change required today.
- CI/CD — Skip
- Leader — Plan: If the org is evaluating CloudFront flat-rate plans for cost predictability, API-driven subscription management now makes it viable to automate within IaC pipelines — worth assessing during the next cloud cost review cycle.
- Platform/SRE — Plan: If you use Pulumi with connection-string URLs (e.g. Postgres), upgrade to sdk/v3.260.0 to prevent passwords leaking into state/log output; no hard deadline but a meaningful security hygiene improvement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Act: OpenTofu 1.11 hit EOL on 2026-08-19 and this is its final patch; the credential-leak via OCI HTTP redirect and the DoS via crafted remote-state URLs are both active security risks in IaC runs. Upgrade to a supported OpenTofu release series (1.12+) now that EOL has passed.
- CI/CD — Act: The credential-leak bug affects
tofu initwhen pulling modules or providers from OCI registries — a standard pipeline step — and could expose registry credentials to a redirect target. Upgrade the OpenTofu version pinned in CI pipelines from 1.11.x to a supported series immediately; 1.11 is already EOL. - Leader — Skip
- Signals: OpenTofu 1.11 is past EOL (2026-08-19, 5d ago)
- Platform/SRE — Learn: Adds a useful –ignore-protect flag for managing protected resources and fixes TLS verification failures against self-hosted Pulumi backends using self-signed certs; no deadline or breaking change, so worth noting for Pulumi shops at the next upgrade cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New
pulumi stack migratecommand enables moving stacks between backends with secret re-encryption, and--override-envallows one-shot environment substitution without editing stack config — useful patterns to know but no action required with no deadline or breaking change. - CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Platform engineers running OpenTofu should upgrade to 1.12.5 to address the ECH handshake privacy leak (server hostname de-anonymization via passive observation) and the implicit-move provider state bug; no KEV listing or active exploitation reported, so no hard deadline, but this should be included in the next IaC toolchain update cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: A security fix for an ECH pre-shared key identity leak in OpenTofu v1.11.x warrants upgrading to v1.11.13; no KEV listing or active exploitation reported, so this is a planned patch rather than an emergency — schedule the upgrade this sprint.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: HCP Terraform and Terraform Enterprise now include workspace and Stacks restore features, which are relevant to DR and state-recovery planning for teams standardized on either product; evaluate whether these capabilities close gaps in your current runbooks.
- CI/CD — Skip
- Leader — Learn: HashiCorp is expanding HCP Terraform’s resilience and governance surface; useful context for teams standardized on the product when assessing vendor roadmap health, but no strategic decision is forced here.
- Platform/SRE — Learn: Google’s managed Terraform execution service removes the need to self-host a Terraform backend or state management layer on GCP; worth evaluating if you run Terraform on GCP but no action required today.
- CI/CD — Skip
- Leader — Learn: A managed Terraform service from GCP could shift the build-vs-buy calculus on Terraform state/execution tooling, but no strategic decision is forced yet — file for next platform toolchain review.
- Platform/SRE — Learn: A thoughtful analysis of stateless Terraform patterns is worth reading for platform engineers managing state backends and drift, but no operational change is required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Oracle’s enterprise-scale migration validates OpenTofu as production-ready; teams running Terraform under the BUSL license should schedule an evaluation of OpenTofu as a drop-in replacement within the next planning cycle.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly switching to the OpenTofu fork is a clear signal that the fork has enterprise momentum; leaders standardized on Terraform should put an OpenTofu migration evaluation on the roadmap to reduce BUSL licensing risk before it becomes a contractual concern.
- Platform/SRE — Plan: If your pipelines use pulumi/actions or pulumi/action-install-pulumi-cli, both have major version bumps (v6→v7, v1→v2) that likely include breaking changes; audit your workflow files and update action refs this quarter.
- CI/CD — Plan: pulumi/actions jumped v6→v7 and pulumi/action-install-pulumi-cli jumped v1→v2 — major bumps that may break existing pipeline steps; review release notes for both actions and update workflow references before Renovate auto-merges cause unexpected failures.
- Leader — Skip
- Platform/SRE — Learn: A survey of root module organization patterns for Terraform — useful for evaluating or refining IaC structure, but no operational change required today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Reframes Terraform state as a distributed consistency problem — worth reading to inform how you architect remote state backends and locking, but no GA tool or urgent change to make today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Teams using CDKTF for IaC should read this discussion to gauge whether HashiCorp/IBM intends to maintain it long-term; no deprecation date in signals, so no action required now.
- CI/CD — Skip
- Leader — Plan: Against the backdrop of HashiCorp’s BSL relicensing and IBM acquisition, a high-signal HN discussion on CDKTF’s direction is a prompt to evaluate whether to continue standardizing on CDKTF or assess alternatives like OpenTofu CDK this planning cycle.