Pulumi Integration

TypeScript Example

Complete example of managing TigerAccess resources with TypeScript.

import * as pulumi from "@pulumi/pulumi";
import * as tigeraccess from "@tigeraccess/pulumi";

// Create roles
const adminRole = new tigeraccess.Role("admin", {
  metadata: {
    name: "admins",
    labels: { team: "platform" },
  },
  spec: {
    allow: {
      logins: ["root", "admin"],
      nodeLabels: { "*": ["*"] },
      rules: [{
        resources: ["*"],
        verbs: ["*"],
      }],
    },
  },
});

// Create access list
const onCallAccess = new tigeraccess.AccessList("oncall", {
  metadata: {
    name: "oncall-production",
  },
  spec: {
    title: "On-call production access",
    grants: {
      roles: ["admins"],
    },
    audit: {
      nextAuditDate: "2024-06-01",
    },
  },
});

// Create integration
const awsIntegration = new tigeraccess.Integration("aws", {
  metadata: {
    name: "aws-prod",
  },
  spec: {
    type: "aws",
    aws: {
      accountId: "123456789012",
      roleArn: "arn:aws:iam::123456789012:role/TigerAccessRole",
      regions: ["us-east-1", "us-west-2"],
    },
  },
});

export const roleName = adminRole.metadata.name;
export const accessListId = onCallAccess.metadata.name;

Python Example

Python SDK example for infrastructure teams.

import pulumi
import tigeraccess_pulumi as tigeraccess

# Create a database connection
postgres_db = tigeraccess.Database("postgres-prod",
    metadata=tigeraccess.MetadataArgs(
        name="postgres-production",
        labels={"env": "prod", "team": "data"}
    ),
    spec=tigeraccess.DatabaseSpecArgs(
        protocol="postgres",
        uri="postgres.example.com:5432",
        ca_cert="/etc/certs/postgres-ca.pem",
        admin_user=tigeraccess.DatabaseUserArgs(
            name="admin"
        )
    )
)

# Create bot for CI/CD
ci_bot = tigeraccess.Bot("ci-bot",
    metadata=tigeraccess.MetadataArgs(
        name="github-actions-bot"
    ),
    spec=tigeraccess.BotSpecArgs(
        roles=["ci-deployer"],
        traits=[
            tigeraccess.TraitArgs(
                name="github-actions",
                values=["deploy", "test"]
            )
        ]
    )
)

pulumi.export("database_name", postgres_db.metadata.name)
pulumi.export("bot_name", ci_bot.metadata.name)

Which languages does the TigerAccess Pulumi provider support?

The provider supports TypeScript, JavaScript, Python, Go, C#, and Java. All languages provide full type safety and intellisense support in modern IDEs.

How do I manage secrets in Pulumi with TigerAccess?

Use Pulumi's built-in secret management to encrypt sensitive values like certificates and tokens. You can also integrate with Pulumi ESC (Environments, Secrets, and Configuration) for centralized secret management across stacks.

Can I import existing TigerAccess resources into Pulumi?

Yes. Use the pulumi import command to import existing TigerAccess resources into your Pulumi state. This allows you to gradually migrate to infrastructure as code without recreating resources.

How does Pulumi detect drift in TigerAccess configurations?

Run pulumi preview to compare your code against the actual state of resources in TigerAccess. Pulumi will show any differences and allow you to either update your code or refresh the state to match reality.

Can I use Pulumi Automation API with TigerAccess?

Yes. The Automation API allows you to embed Pulumi in your applications and build custom workflows. This is useful for building self-service portals where users can request access and have roles automatically provisioned.

How do I handle multi-environment deployments?

Use Pulumi stacks for each environment (dev, staging, prod). Share common configuration using stack references and component resources. Override environment-specific settings using stack configuration files.