npx skills add https://github.com/pulumi/agent-skills --skill pulumi-escPulumi ESC 是一项集中式服务,用于跨云基础设施和应用程序管理环境、密钥和配置。
ESC 使团队能够:
# 创建新环境
pulumi env init <org>/<project-name>/<environment-name>
# 编辑环境(在编辑器中打开)
pulumi env edit <org>/<project-name>/<environment-name>
# 设置值
pulumi env set <org>/<project-name>/<environment-name> <key> <value>
pulumi env set <org>/<project-name>/<environment-name> <key> <value> --secret
# 查看定义(密钥被隐藏)
pulumi env get <org>/<project-name>/<environment-name>
# 打开并解析(显示密钥)
pulumi env open <org>/<project-name>/<environment-name>
# 在环境中运行命令
pulumi env run <org>/<project-name>/<environment-name> -- <command>
# 链接到 Pulumi 堆栈
pulumi config env add <project-name>/<environment-name>
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
pulumi env get:显示静态定义,密钥显示为 [secret]pulumi env open:解析并显示所有值,包括密钥和动态凭证pulumi env run:加载环境变量后执行命令pulumi config env add:仅接受 <project-name>/<environment-name> 格式环境是包含保留顶级键的 YAML 文档:
imports:导入并组合其他环境values:定义配置和密钥values 下的保留子键:
environmentVariables:将值映射到 Shell 环境变量pulumiConfig:配置 Pulumi 堆栈设置files:使用环境数据生成文件imports:
- common/base-config
values:
environment: production
region: us-west-2
dbPassword:
fn::secret: super-secure-password
environmentVariables:
AWS_REGION: ${region}
DB_PASSWORD: ${dbPassword}
pulumiConfig:
aws:region: ${region}
app:dbPassword: ${dbPassword}
如果用户询问基本问题,例如“如何创建环境?”或“get 和 open 有什么区别?”,请直接使用上述信息回答。
当用户需要更多信息时,使用 web-fetch 工具从官方 Pulumi ESC 文档获取内容:
pulumi env 子命令而非 esc CLI。使用 web-fetch 工具并配合特定提示,从这些文档中提取相关信息。
帮助用户时:
pulumi env 命令列出环境或读取定义pulumi env get 或 pulumi preview 进行测试。仅在需要完全解析的值时才使用 pulumi env open,但要谨慎使用,因为它会显示密钥。用户:"如何在 ESC 中设置 AWS OIDC 凭证?"
1. 使用 web-fetch 工具从 "https://www.pulumi.com/docs/esc/integrations/dynamic-login-credentials/aws-login/" 获取 AWS OIDC 文档
2. 向用户提供配置
3. 询问用户是否已有预定义的角色,或者是否需要创建一个
4. 尽可能多地设置环境,然后引导他们完成你无法为他们完成的步骤
5. 如有必要,帮助他们使用 `pulumi env get` 或 `pulumi env open` 进行测试
pulumi env init my-org/my-project/dev-config
# 编辑环境(接受来自文件的新定义,对代理更友好,对用户较难)
pulumi env edit --file /tmp/example.yml my-org/my-project/dev-config
pulumi config env add my-project/dev-config
pulumi config # 验证环境值是否可访问
始终优先使用 CLI 命令。 仅在绝对必要时(例如批量操作、自动化)才使用 API。
可用的 API 端点包括:
GET /api/esc/environments/{orgName} - 列出环境GET /api/esc/environments/{orgName}/{projectName}/{envName} - 读取环境定义GET /api/esc/providers?orgName={orgName} - 列出可用提供商需要时使用 call_pulumi_cloud_api() 工具发出请求。
fn::secret<org>/my-app/production-aws,而不是 <org>/app/prodpulumi config 是否显示预期值pulumi env runpulumi env open,因为它会显示密钥pulumi env ls -o <org> 检查权限pulumi env open 而非 pulumi env getpulumi config env ls 以确保堆栈已列出。
<project-name>/<environment-name> 格式引用。pulumi env get <org>/<project-name>/<environment-name> 获取特定的环境定义。pulumiConfig 键是否存在且嵌套在 values 键下。每周安装量
379
代码仓库
GitHub 星标数
30
首次出现
2026年1月28日
安全审计
安装于
opencode333
codex330
github-copilot330
gemini-cli321
amp316
kimi-cli315
Pulumi ESC is a centralized service for managing environments, secrets, and configuration across cloud infrastructure and applications.
ESC enables teams to:
# Create a new environment
pulumi env init <org>/<project-name>/<environment-name>
# Edit environment (opens in editor)
pulumi env edit <org>/<project-name>/<environment-name>
# Set values
pulumi env set <org>/<project-name>/<environment-name> <key> <value>
pulumi env set <org>/<project-name>/<environment-name> <key> <value> --secret
# View definition (secrets hidden)
pulumi env get <org>/<project-name>/<environment-name>
# Open and resolve (reveals secrets)
pulumi env open <org>/<project-name>/<environment-name>
# Run command with environment
pulumi env run <org>/<project-name>/<environment-name> -- <command>
# Link to Pulumi stack
pulumi config env add <project-name>/<environment-name>
pulumi env get : Shows static definition, secrets appear as [secret]pulumi env open : Resolves and reveals all values including secrets and dynamic credentialspulumi env run : Executes commands with environment variables loadedpulumi config env add : Only takes the / portionEnvironments are YAML documents with reserved top-level keys:
imports : Import and compose other environmentsvalues : Define configuration and secretsReserved sub-keys under values:
environmentVariables : Map values to shell environment variablespulumiConfig : Configure Pulumi stack settingsfiles : Generate files with environment dataimports:
- common/base-config
values:
environment: production
region: us-west-2
dbPassword:
fn::secret: super-secure-password
environmentVariables:
AWS_REGION: ${region}
DB_PASSWORD: ${dbPassword}
pulumiConfig:
aws:region: ${region}
app:dbPassword: ${dbPassword}
If the user asks basic questions like "How do I create an environment?" or "What's the difference between get and open?", answer directly using the information above.
When users need more information, use the web-fetch tool to get content from the official Pulumi ESC documentation:
pulumi env subcommands over esc CLI.Use the web-fetch tool with specific prompts to extract relevant information from these docs.
When helping users:
pulumi env commands to list environments or read definitionspulumi env get or pulumi preview a. Only use pulumi env open when the full resolved values are needed, but use cautiously as it reveals secrets.User: "How do I set up AWS OIDC credentials in ESC?"
1. Use the web-fetch tool to get AWS OIDC documentation from "https://www.pulumi.com/docs/esc/integrations/dynamic-login-credentials/aws-login/"
2. Provide the user with the configuration
3. Ask the user if they have a pre-defined role or need one created for them
4. Set up as much of the environment as possible, then guide them through any steps that you can't do for them
5. Help them test with `pulumi env get` or `pulumi env open` if necessary
pulumi env init my-org/my-project/dev-config
# Edit environment (accepts new definition from a file, better for agents, more difficult for users)
pulumi env edit --file /tmp/example.yml my-org/my-project/dev-config
pulumi config env add my-project/dev-config
pulumi config # Verify environment values are accessible
Always prefer CLI commands. Only use the API when absolutely necessary (e.g., bulk operations, automation).
Available API endpoints include:
GET /api/esc/environments/{orgName} - List environmentsGET /api/esc/environments/{orgName}/{projectName}/{envName} - Read environment definitionGET /api/esc/providers?orgName={orgName} - List available providersUse call_pulumi_cloud_api() tool to make requests when needed.
fn::secret for sensitive values<org>/my-app/production-aws not <org>/app/prodpulumi config shows expected values after linking an environment to a stackpulumi env run for commands needing environment variablespulumi env open when absolutely necessary, as it reveals secretspulumi env ls -o <org>pulumi env open not pulumi env getpulumi config env ls to ensure the stack is listed.
pulumi env get <org>/<project-name>/<environment-name>.pulumiConfig key exists and is nested under the values key.Weekly Installs
379
Repository
GitHub Stars
30
First Seen
Jan 28, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
opencode333
codex330
github-copilot330
gemini-cli321
amp316
kimi-cli315
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
100,500 周安装