Pulumi Integration

# Set the operator token (issued by the service)
export PULUMI_ACCESS_TOKEN="<ITL_PULUMI_TOKEN>"

# Login — this is the only URL teams need
pulumi login https://attest.itlusions.com

# Create a stack — use the service as secrets provider (no passphrase needed)
pulumi stack init myorg/myproject/production \
  --secrets-provider https://attest.itlusions.com

# Normal Pulumi workflow
pulumi up
pulumi refresh
pulumi destroy

# First stack init — Attestation Service generates a random 256-bit key and stores it
pulumi stack init myorg/myproject/production \
  --secrets-provider https://attest.itlusions.com

# Set an encrypted config value — the CLI calls /encrypt
pulumi config set --secret database_password "s3cr3t!"

# The ciphertext stored in Pulumi.production.yaml looks like:
#   v1:ABcd...==
# It is only readable by calling /decrypt with the correct operator token.

# Queue an update from a git repository
curl -X POST https://attest.itlusions.com/api/stacks/myorg/myproject/production/deployments \
  -H "Authorization: token $ITL_PULUMI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operation": "update",
    "source": {
      "repoURL": "https://github.com/myorg/infra",
      "branch": "main",
      "repoDir": "environments/production"
    },
    "environmentVariables": {
      "TF_VAR_region": "westeurope"
    }
  }'

# Returns 202 Accepted immediately; poll for status
curl https://attest.itlusions.com/api/stacks/myorg/myproject/production/deployments/<id> \
  -H "Authorization: token $ITL_PULUMI_TOKEN"

export PULUMI_ACCESS_TOKEN="eyJ..."   # ITL_PULUMI_TOKEN value

# Verify the token is accepted
curl -s https://attest.itlusions.com/api/user \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" | python3 -m json.tool
# {"name":"operator","githubLogin":"operator","avatarUrl":""}

pulumi login https://attest.itlusions.com
# Logged into https://attest.itlusions.com as operator

mkdir ~/infra/myproject && cd ~/infra/myproject
pulumi new python --name myproject --description "ITL infra stack" --yes

# Init the stack — use the service as the secrets provider
pulumi stack init itlusions/myproject/production \
  --secrets-provider https://attest.itlusions.com
# Created stack 'production'
# Stack 'production' is using the service's secrets provider

pulumi config set aws_region eu-west-1
pulumi config set --secret db_password "correct-horse-battery"

pulumi up

# Show stack outputs
pulumi stack output

# Export checkpoint JSON (useful for debugging)
curl -s "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/export" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" | python3 -m json.tool | head -40

# List all stacks visible to the operator
curl -s "https://attest.itlusions.com/api/user/stacks" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" | python3 -m json.tool

DEPLOYMENT=$(curl -s -X POST \
  "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/deployments" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operation": "update",
    "source": {
      "repoURL": "https://github.com/itlusions/infra",
      "branch": "main",
      "repoDir": "environments/production"
    },
    "environmentVariables": {
      "PULUMI_CONFIG_PASSPHRASE": ""
    }
  }')

DEPLOYMENT_ID=$(echo "$DEPLOYMENT" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
echo "Deployment queued: $DEPLOYMENT_ID"

# Poll until done
while true; do
  STATUS=$(curl -s \
    "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/deployments/$DEPLOYMENT_ID" \
    -H "Authorization: token $PULUMI_ACCESS_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
  echo "Status: $STATUS"
  [[ "$STATUS" == "succeeded" || "$STATUS" == "failed" || "$STATUS" == "cancelled" ]] && break
  sleep 5
done

curl -s \
  "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/deployments/$DEPLOYMENT_ID" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" | python3 -m json.tool

curl -s -X DELETE \
  "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/deployments/$DEPLOYMENT_ID/cancel" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN"
# HTTP 204 No Content

# Locally
pulumi destroy --yes

# Or server-side
curl -X POST \
  "https://attest.itlusions.com/api/stacks/itlusions/myproject/production/deployments" \
  -H "Authorization: token $PULUMI_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"operation": "destroy"}'

pip install pulumi>=3.0.0 pulumi-random>=4.16.0
# Install the provider from the monorepo
pip install -e ./src/pulumi_provider

pip install pulumi-itl-attestation

pulumi refresh    # reads live state from the API
pulumi up         # reconciles — re-registers revoked machines

cd examples/pulumi-demo
pulumi stack init dev
pulumi config set attestation:endpoint http://localhost:8080
pulumi config set --secret attestation:token <ITL_ADMIN_TOKEN>
pulumi up