Pulumi基础设施即代码实战：用Python/TypeScript管理云资源作者：Crown_22 | AI Agent Hermes Agent 桌面程序开发者前言Terraform 是基础设施即代码（IaC）领域的霸主，但它使用 HCL（HashiCorp Configuration Language）这种领域专用语言，学习曲线陡峭，调试困难，且无法复用常规编程语言的生态。Pulumi提出了一个颠覆性的方案：用你熟悉的编程语言（Python、TypeScript、Go、C#）来定义云基础设施。没有 DSL，没有模板语法，就是真正的代码。这意味着你可以用for循环、if条件、函数、类、包管理器、测试框架——所有你已经会的东西。本文基于真实项目经验，深入 Pulumi 的核心概念、常见踩坑和生产级实践。第一章：Pulumi 核心概念1.1 Pulumi vs Terraform：根本区别# Terraform (HCL)resource"aws_s3_bucket""example"{bucket="my-bucket"tags={Environment="production"}}resource"aws_s3_bucket_versioning""example"{bucket=aws_s3_bucket.example.idversioning_configuration{status="Enabled"}}# Pulumi (Python)importpulumiimportpulumi_awsasaws bucket=aws.s3.Bucket("example",bucket="my-bucket",tags={"Environment":"production"},)versioning=aws.s3.BucketVersioningV2("example",bucket=bucket.id,versioning_configuration=aws.s3.BucketVersioningV2VersioningConfigurationArgs(status="Enabled",),)核心差异：特性TerraformPulumi语言HCL (DSL)Python/TS/Go/C#状态管理本地/S3/Terraform CloudPulumi Cloud/S3/本地循环/条件count、for_each、三元表达式原生语言语法模块HCL modules原生包/类/函数测试Terratest (Go)pytest/Jest/任何框架Secret 管理Vault 集成内置 Secret 加密1.2 第一个 Pulumi 项目# 安装 Pulumi CLIcurl-fsSLhttps://get.pulumi.com|sh# 创建 Python 项目mkdirmy-infracdmy-infra pulumi new aws-python# 项目结构# Pulumi.yaml - 项目配置# Pulumi.dev.yaml - 开发环境配置# __main__.py - 入口文件# requirements.txt - Python 依赖# __main__.pyimportpulumiimportpulumi_awsasaws# 创建 VPCvpc=aws.ec2.Vpc("main-vpc",cidr_block="10.0.0.0/16",tags={"Name":"main-vpc"},)# 创建子网subnet=aws.ec2.Subnet("main-subnet",vpc_id=vpc.id,cidr_block="10.0.1.0/24",availability_zone="us-east-1a",tags={"Name":"main-subnet"},)# 导出资源 IDpulumi.export("vpc_id",vpc.id)pulumi.export("subnet_id",subnet.id)# 部署pulumi up# 销毁pulumi destroy第二章：Python Pulumi 实战2.1 动态创建资源：循环与条件importpulumiimportpulumi_awsasaws# 配置config=pulumi.Config()environment=config.require("environment")# dev/staging/prod# 根据环境决定实例大小instance_type={"dev":"t3.micro","staging":"t3.small","prod":"t3.large",}[environment]# 批量创建子网（HCL 的 for_each 很难做到这么灵活）availability_zones=["us-east-1a","us-east-1b","us-east-1c"]subnets=[]fori,azinenumerate(availability_zones):subnet=aws.ec2.Subnet(f"subnet-{i}",vpc_id=vpc.id,cidr_block=f"10.0.{i+1}.0/24",availability_zone=az,tags={"Name":f"subnet-{az}","Environment":environment,},)subnets.append(subnet)# 条件资源（仅在生产环境创建）ifenvironment=="prod":# 生产环境创建 NAT Gatewayeip=aws.ec2.Eip("nat-eip",domain="vpc")nat_gateway=aws.ec2.NatGateway("nat-gw",allocation_id=eip.id,subnet_id=subnets[0].id,)2.2 组件资源（Component Resources）Pulumi 的组件资源类似于 Terraform 的模块，但更灵活：importpulumiimportpulumi_awsasawsclassVpcWithSubnets(pulumi.ComponentResource):"""可复用的 VPC 组件"""def__init__(self,name:str,cidr:str,azs:list[str],opts=None):super().__init__("custom:network:VpcWithSubnets",name,{}
