The Architect Who Spoke in Logic
Naga the architect had trained in logic, not in blueprint-writing. She understood loops, conditions, functions, and classes. When she was given a template language to describe infrastructure — JSON, YAML, HCL — she could learn the syntax, but she could not use the tools of her trade: she could not loop in YAML the way she could in Python, she could not write a function in JSON. The forge she needed spoke only template languages. Then a new forge arrived — one that spoke Python. Naga set down the template books and picked up her own language.
“A tool that speaks the craftsman's language removes the translation layer between intent and creation.”
The Resource as Object
In the Python forge, every resource was an object. A storage vessel was not a block of JSON — it was an instance of a class, with a name, a location, and a set of parameters passed to its constructor. When Naga created a storage vessel, she wrote: storage = StorageAccount("mystorage", location="westus2"). The forge tracked that object. It knew the object's name. It knew its desired state. When Naga ran the forge, it created the vessel exactly as the object described. When she changed the object and ran the forge again, it updated the vessel. The object was the contract between Naga and the forge.
“When infrastructure is an object, all the tools of object-oriented design become infrastructure tools.”
The Stack That Remembered
Kosha the stack was the forge's memory. Every environment Naga deployed — dev, staging, production — was a separate stack. Each stack remembered which resources it had created and their current values. When Naga deployed to dev, she selected the dev stack. The forge compared the stack's memory to the current objects and applied only the differences. She could deploy to dev and production independently. She could create a new testing stack, use it for a day, and destroy it with one command. The stack was the environment. A new stack was a new world.
“Separating environments is separating memories. Each memory must not contaminate the others.”
The Output That Did Not Exist Yet
Some values could not be known until the forge had run. The hostname of a server. The connection string of a database. These were outputs — values the forge would compute during creation. Naga wrote: hostname = server.hostname. But hostname was not a string. It was a promise of a string — an Output[str] that the forge would fill in when the server was created. If she needed the hostname inside another resource's configuration, she passed the Output directly. The forge resolved the order: create the server first, then fill the hostname into the configuration of whatever needed it. The code looked sequential. The forge made it parallel where it could.
“A promise of a value is not a value yet. Treat it as a promise, not a string.”
Guhya the Secret-Keeper
Naga's forge could hold secrets — passwords, API keys, connection strings — but only if she declared them as secrets. A secret value was stored encrypted in the stack's memory. It never appeared in logs. It could not be printed. When Naga wrote config = Config(); password = config.require_secret("db-password"), the password was protected. The forge passed it to the database resource but would not reveal it to an observer watching the forge run. Guhya enforced the rule: secrets in, encrypted; secrets out, only to trusted resources. A secret that touched a log was no longer a secret.
“Encryption is not protection. Encryption plus access control plus no-log policy is protection.”
The Test Before the Build
Before Naga deployed to production, she ran tests — not on the infrastructure, but on her Python code. She mocked the forge and wrote assertions: "when environment is production, the storage replication should be GRS, not LRS." The test ran in seconds, without touching any cloud. If the assertion failed, the code was wrong before a single resource was touched. Naga deployed with confidence: the logic had been tested the same way any program is tested. Her infrastructure was a program. It had tests. It had code reviews. It had the full discipline of software engineering applied to the forge.
“Infrastructure that cannot be tested is infrastructure that cannot be trusted to change.”
🪔 Deepak — the lamp of meaning · what this fable means in code
Pulumi lets you define infrastructure using real programming languages — Python, TypeScript, Go, C#. In Python, every resource is a class instance. Stacks are isolated environments with separate state files. Output[T] is the type for values computed at deploy time — you compose them with apply() rather than treating them as strings. Config and config.require_secret() manage per-stack configuration and encrypted secrets. ComponentResource lets you group related resources into reusable classes with their own inputs and outputs. Unit testing with pytest/mocks lets you test infrastructure logic without deploying anything — the same TDD discipline that applies to application code.