Deploy with Pulumi

The Terraform stack is the single source of truth; Pulumi consumes it through the official terraform-module bridge. Identical resources, Pulumi-native state/config/secrets.

TIP

The bridge is maintained by Pulumi but younger than core providers. Terraform remains the primary supported path — the same stack applies cleanly with plain Terraform if you hit a bridge issue.

Setup

cd deploy/pulumi/typescript
npm install
pulumi login --local          # or Pulumi Cloud
pulumi stack init prod

# Wrap the provider-free stack module (NOT ../../terraform, whose
# provider blocks confuse the bridge):
pulumi package add terraform-module ../../terraform/stack kymaengine

If package add prints a pnpm pkg set error after "Successfully generated an SDK", the SDK is fine — link it manually:

npm pkg set 'dependencies.@pulumi/kymaengine=file:sdks/kymaengine'
npm install

Configure

export SUPABASE_ACCESS_TOKEN=sbp_…
export AWS_REGION=us-east-1    # match awsRegion — the bridged module
                               # inherits the ambient provider region

pulumi config set supabaseOrgId <org-id>
pulumi config set --secret supabaseDbPassword "$(openssl rand -base64 24)"
pulumi config set adminEmails '["you@company.com"]'
pulumi config set allowedEmailDomains '["company.com"]'
# optional: domain, route53ZoneId, imageTag, oauthProviders …

The stack's backend selectors are exposed as camelCased Pulumi config keys — e.g. computeBackend, databaseBackend, storageBackend, authBackend, databaseUrl, storageEndpoint, adminToken, oidcIssuer. For example, a Fargate + RDS + native-S3 + token stack:

pulumi config set computeBackend fargate
pulumi config set databaseBackend rds
pulumi config set storageBackend s3
pulumi config set authBackend token
pulumi config set --secret adminToken "$(openssl rand -base64 30)"

Outputs are camelCased too (engineUrl, eksClusterName, eksIrsaRoleArn, …).

Deploy

pulumi up
pulumi stack output engineUrl

Teardown: pulumi destroy.

kyma deploy init --tool pulumi automates all of the above inside a workspace.