Manage Pulumi deployments in CI/CD

This topic describes a recommended workflow for managing Connect Pulumi resources in CI/CD pipelines.

Note: The capabilities described in this topic are available from version 26.4 and later.

Overview

The Connect product archive includes a Pulumi provider plugin. With this provider, you can define resources as code in version control. You can then apply those changes through a pipeline instead of configuring resources manually.

A common implementation pattern is to build a reusable container image once. You then run pulumi preview automatically for configuration changes, and allow deployment only after manual approval.

Note: Use this workflow as an example. You can adapt it to match your CI platform and organizational approval process.

Prerequisites

Verify that you have the following:

  • A running Connect instance and valid access token. For details, see Manage access tokens.

  • A Pulumi setup that meets the plugin and version requirements. For details, see Pulumi installation and upgrade.

  • A container registry and CI system that support protected variables and manual approval gates.

  • A Pulumi state backend and secrets provider that are reachable from the pipeline runtime.

Recommended workflow

The following workflow helps keep deployments repeatable and auditable:

  1. Build a container image that includes the extracted Connect directory, the Pulumi CLI, and the locally installed provider plugin.

  2. Push the image to your container registry, tagged with the Connect build version.

  3. Run pulumi preview automatically when Pulumi configuration changes.

  4. Require manual approval before running pulumi up.

The following steps describe this workflow in detail.

Step 1: Build a reusable image

Building a reusable image avoids repeated installation and setup during each pipeline run.

To build a reusable image:

  1. Build a container image that includes the full extracted Connect directory.

    Keep all files together, including the bundled JRE and adjacent JAR files.

  2. Install the Pulumi CLI in the same image.

  3. Install the provider plugin from a local plugin directory, so pipeline runs do not attempt to download it.

  4. Build and publish the image from a separate pipeline.

    Run this image-build pipeline manually, and only when you upgrade Connect or Pulumi.

Step 2: Configure state and secrets

Pulumi state tracks which resources exist and what has changed between runs.

To configure state and secrets:

  1. Configure a state backend that your pipeline can access.

  2. Choose a backend model that fits your environment, such as Pulumi-hosted, object storage, or self-managed storage.

  3. Configure a secrets provider so values marked as secret are encrypted before they are persisted in state.

Step 3: Define resources as code

Define the target configuration in source-controlled Pulumi project files.

To define resources as code:

  1. Define your Connect resources in Pulumi project files and keep those files in version control.

  2. Store credentials in secret Pulumi config and CI protected variables, not in project files.

  3. Verify that the resource types and properties used by your files are supported in your installed Connect version.

    To verify support, print the provider schema and validate property names before deployment.

Step 4: Preview and approve

Preview planned changes automatically, then require approval before deployment.

To preview and approve deployment:

  1. Run pulumi preview automatically on push or configuration change.

  2. Store preview output as a pipeline artifact so reviewers can inspect planned changes without opening full job logs.

  3. Configure deployment as a manual job that runs pulumi up only after approval.

  4. Ensure that unapproved pipelines do not report deployment success.

Configuration and secrets guidance

Keep non-secret configuration values in version control, for example:

  • Version numbers

  • Hostnames

  • Stack names

Keep sensitive values in your CI secret store, for example:

  • Registry credentials

  • State backend credentials

  • Connect API tokens

Upgrade process

To upgrade the deployment runtime:

  1. Add the new product archive and update the version value in your pipeline or build settings.

  2. Rebuild and publish the container image.

  3. Run the deployment pipeline and review pulumi preview output before approving deployment.

Keep previously published images available to support rollback.

Note: If needed, Support can provide an example pipeline in Gitlab CI (building the image, previewing changes, and deploying manually). You can then use the pipeline as a starting point, and adjust it to your environment.

See also