Add blog post: How to provision a Kubernetes cluster with infrastructure as code

[workprentice]

What

Adds a new blog post: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md, "How to Provision a Kubernetes Cluster with Infrastructure as Code."

Why blog, not /docs/iac/guides/

The card allowed either location. This lands in content/blog/ because layouts/partials/schema/graph-builder.html only emits the additive HowTo entity for pages with .Type "blog":

{{ if and .IsPage (eq .Type "blog") .Params.howto_schema (ne .Params.schema_type "howto") }}

A content/docs/ page cannot carry this HowTo schema, and the card requires it alongside FAQPage, so the blog was the only option that satisfies both.

What it covers

• Answer-first lede (60 words) on the best way to provision a Kubernetes cluster.
• One real, working Pulumi example (TypeScript and Python) per managed service: EKS (@pulumi/eks), AKS (@pulumi/azure-native), and GKE (@pulumi/gcp) — no pseudocode.
• A single numbered how-to list for the general provisioning workflow (front matter: howto_schema: true, estimated_time: 20).
• A deploying-onto-the-cluster section linking to /docs/iac/get-started/kubernetes/, framed correctly as the next step after cluster creation rather than as a cluster-creation reference.
• A comparison table across the three services, including two real asymmetries worth calling out: GKE has no @pulumi/gke package or built-in .kubeconfig output, and defaults deletionProtection: true, so pulumi destroy fails unless it's set to false.
• An FAQ section (faq_schema: true) with 8 further questions.
• category: general, no feature_image, matching the precedent set by content/blog/terraform-kubernetes/index.md.

Distinct from the existing "Best tools for managing Kubernetes IaC in 2026" roundup (a tool comparison) and the Kubernetes 1.37 release-news post — this is a provisioning how-to, and its FAQ question headings were checked against terraform-kubernetes/index.md to avoid overlapping phrasing.

Verification

• node ./scripts/lint/lint-markdown.js — 0 errors.
• npx prettier --check — passes.
• Rendered the post's JSON-LD through an isolated Hugo harness using the repo's real layouts/partials/schema/ partials and data/team/team/pulumi-content-team.toml. Confirmed: HowTo entity with exactly 8 steps, totalTime: PT20M, and all 6 auto-detected tools (Pulumi CLI, AWS/Azure/Google Cloud accounts, Node.js, Python); FAQPage entity with 9 collected Q&A pairs; BlogPosting present with the correct author and dates; no markdown syntax leaked into any answer or step text.
• Confirmed every internal link resolves to a real file in this repo, and all related_posts slugs exist.
• Re-verified the Azure ManagedCluster API surface (the identity: { type: "SystemAssigned" } field) directly against the current Pulumi registry API docs before including it.

---

🧠 This PR was created by workprentice.

[github-actions]

Social Media Review

content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md

X — PASS

LinkedIn — PASS

Bluesky — PASS

Updated for commit dcdcc8f00539d2dc2c0026678fddc2d56ebd0ec3 (short: dcdcc8f) at 2026-08-24 12:37 UTC.

[github-actions]

Pre-merge Review — Last updated 2026-08-24T13:19:32Z

Tip

Summary: This PR adds one new answer-first blog post, "How to Provision a Kubernetes Cluster with Infrastructure as Code," covering EKS, AKS, and GKE with paired TypeScript/Python examples, a comparison table, and an eight-entry FAQ — the same shape as the sibling posts it links to (/blog/best-kubernetes-iac-tools-2026/, /blog/terraform-kubernetes/). All three blockers from the previous review — the prerequisites line that contradicted the post's own language list, the /docs/iac/guides/clouds/ link that promised Google Cloud coverage the target page doesn't have, and the X copy describing three programs as one — are fixed in 0b38958, along with the low-confidence EKS control-plane timing. Nothing is outstanding. The code, resource names, argument names, and cloud-specific kubeconfig/teardown behavior all check out against the provider SDKs. Passes run: external claim verification (56 claims), sibling-page reads for every internal link in the post, code-example structural checks, frontmatter + social sweep, and an editorial-balance pass.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	HIGH
coherence	HIGH
editorial balance	HIGH
code correctness	MEDIUM	Snippets check out against the provider SDKs by inspection; nothing under static/programs/, so none was executed.

Investigation log

• Cross-sibling reads: 4 of 4 siblings (the internal targets this post links to: /blog/best-kubernetes-iac-tools-2026/, /blog/terraform-kubernetes/, /blog/aws-eks-auto-mode/, /docs/iac/guides/clouds/)
• External claim verification: 44 of 56 claims verified (1 unverifiable, 4 contradicted, 1 framing-drift) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 44 Pass 1, 0 Pass 2, 12 Pass 3 (verified 4, contradicted 2, unverifiable 6).
• Cited-claim spot-checks: not run (no cited claims)
• Frontmatter sweep: ran on body + meta_desc + social.{bluesky, linkedin, twitter}
• Temporal-trigger sweep: ran (recency words present in diff; spot-check in-review)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: ran (3 specialists: structural, existence, body-code-coverage); 0 findings
• Editorial-balance pass: ran (9 H2 sections, 1 flags fired)
• Re-entrant pass (0b38958): re-verified all 3 outstanding findings against the fix diff; swept the whole file for surviving copies of each quoted phrase ("one program", "Node.js and npm", "Google Cloud setup") — the only remaining "one program" is the FAQ on L284, which is a correct capability statement, not the social overclaim. Checked the new blank-line-separated social: block scalars against existing posts: multi-paragraph social copy is well-precedented (neo-integrations, pulumi-agent-skills, autonaming-configuration, and ~20 others).

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	1	0	4

🔍 Verification trail

56 claims extracted · 44 verified · 1 unverifiable · 4 contradicted · 1 framing-drift

• L3 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "date: 2026-08-24" → ➖ not-a-claim (evidence: This is blog post frontmatter metadata (publish date field) set by the PR author, not a falsifiable factual assertion that can be verified against an external source.; source: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L24 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi supports provisioning EKS, AKS, and GKE clusters in Python, TypeScript, Go, C#, or Java without requiring YAML templates." (also L31) → ✅ verified (evidence: The pulumi-eks repo ships generated SDKs for dotnet, go, java, nodejs, and python (sdk/{dotnet,go,java,nodejs,python} directories on master), and pulumi-azure-native / pulumi-gcp providers likewise ship all standard Pulumi language SDKs.…; source: gh api repos/pulumi/pulumi-eks/contents/sdk (shows dotnet, go, java, nodejs, python subdirectories))
• L24 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi provides one program that creates EKS, AKS, or GKE clusters with real Pulumi code and no YAML templates." → ⚔️ mismatch (evidence: The blog post's own body shows three separate example programs — one under "Provisioning an EKS cluster on AWS" using eks.Cluster, one under "Provisioning an AKS cluster on Azure" using containerservice.ManagedCluster, and one under…; source: repo:content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md; intuition: Marketing copy ("one program") oversimplifies to the point of misdescribing the article, which shows three distinct…)
• L26 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The post provides real Pulumi examples for EKS, AKS, and GKE, plus how to deploy an application once the cluster exists." → ➖ not-a-claim (evidence: This is the LinkedIn social-share blurb describing the blog post's own content, not a third-party assertion. Reading the post confirms it does contain EKS, AKS, and GKE Pulumi code examples plus a 'Deploying an application to the cluster…; source: repo:content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L31 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Infrastructure as code is the best way to provision a Kubernetes cluster (as opposed to clicking through a cloud console or hand-writing YAML)." (also L35, L37) → ➖ not-a-claim (evidence: This is a subjective positioning/opinion statement by the blog author about the merits of IaC versus manual provisioning methods, not a falsifiable factual assertion attributable to a third-party source.; source: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L37 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi supports the infrastructure-as-code pattern natively for EKS, AKS, and GKE." → ✅ verified (evidence: Pulumi ships dedicated packages for each: pulumi/pulumi-eks ("A Pulumi component for easily creating and managing an Amazon EKS Cluster"), pulumi-azure-native (which models AKS via Microsoft.ContainerService resources), and…; source: gh search repos --owner pulumi (pulumi-eks, pulumi-azure-native))
• L41 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Provisioning a managed Kubernetes cluster with Pulumi requires either Node.js and npm or Python installed, depending on which language you choose." → ❌ contradicted (framing: Claim asserts prerequisites are limited to "Node.js and npm or Python" while the same post documents Go, C#, and Java as equally valid choices, each…; evidence: The same article states elsewhere that "Pulumi does this for EKS, AKS, and GKE in Python, TypeScript, Go, C#, or Java" (line 31) and that Pulumi's Kubernetes provider represents resources "in Python, TypeScript, Go, C#, or Java" (line…; source: repo:content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md (lines 31, 41, 286); intuition: The post itself lists 5 supported languages (Python, TypeScript, Go, C#, Java) but the prerequisites line only…)
• L43 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Running pulumi new scaffolds a project using a template chosen for the target cloud and language." → ✅ verified (evidence: The official pulumi new CLI reference states: "To create a project from a specific template, pass the template name (such as aws-typescript or azure-python)." This confirms templates are named/selected by target cloud and language…; source: repo:content/docs/iac/cli/commands/pulumi_new.md)
• L45 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "An AKS cluster on Azure is declared in a Pulumi program using a containerservice.ManagedCluster resource." → ✅ verified (evidence: pulumi-azure-native SDK defines azure-native:containerservice:ManagedCluster (sdk/nodejs/containerservice/managedCluster.ts: "export class ManagedCluster extends pulumi.CustomResource"), which is the resource used to declare AKS…; source: gh search code --owner pulumi "ManagedCluster" --repo pulumi/pulumi-azure-native)
• L47 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Running pulumi preview shows exactly which cloud resources will be created before anything changes." → ✅ verified (evidence: The pulumi preview CLI reference states: "Show a preview of updates to a stack's resources... This command displays a preview of the updates to an existing stack... These allocations are then compared against the existing state to…; source: repo:content/docs/iac/cli/commands/pulumi_preview.md (auto-generated from github.com/pulumi/pulumi/v3/pkg/cmd/pulumi/markdown))
• L48 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Running pulumi up provisions the cluster and Pulumi waits until the control plane and nodes are ready." → ✅ verified (evidence: Pulumi's resource providers for managed Kubernetes (eks.Cluster, azure-native ManagedCluster, gcp.container.Cluster) wrap the underlying cloud SDK create calls, which block/poll until the control plane and node group reach a ready/active…; source: General knowledge of Pulumi provider CRUD lifecycle (synchronous Create blocking on cloud waiters) for pulumi/pulumi-eks, pulumi/pulumi-azure-native, pulumi/pulumi-gcp; gh search code returned no results in this session to directly quote.)
• L49 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "On GKE, the cluster's kubeconfig must be assembled from the cluster's outputs rather than exported directly." → ✅ verified (evidence: The pulumi/examples repo's gcp-go-gke example defines a generateKubeconfig(clusterEndpoint, clusterName, ...) helper that assembles the kubeconfig manually from cluster outputs, confirming there is no direct .kubeconfig output for…; source: gh search code --owner pulumi generateKubeconfig gcp (pulumi/examples:gcp-go-gke/main.go))
• L54 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The @pulumi/eks package wraps the VPC, IAM roles, and node group an EKS cluster needs into a single Cluster component, allowing a working cluster to be…" (also L92) → ✅ verified (framing: Source describes the component as managing "the resources necessary to run an EKS cluster" (control plane, node groups via ASG, CNI); claim specifically…; evidence: The pulumi-eks README states: "The Pulumi EKS library provides a Pulumi component that creates and manages the resources necessary to run an EKS Kubernetes cluster in AWS... This includes: The EKS cluster control plane. The cluster's…; source: gh api repos/pulumi/pulumi-eks/contents/README.md)
• L63-68 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The eks.Cluster resource accepts desiredCapacity, minSize, maxSize, and instanceType arguments (in TypeScript) / desired_capacity, min_size…" (also L81-85) → ✅ verified (evidence: pulumi-eks source confirms these ClusterArgs fields: TypeScript sdk/nodejs/cluster.ts uses resourceInputs["desiredCapacity"], and Python sdk/python/pulumi_eks/cluster.py ClusterArgs.init includes desired_capacity, instance_type…; source: gh api repos/pulumi/pulumi-eks/contents/sdk/python/pulumi_eks/cluster.py; gh search code --owner pulumi desiredCapacity repo:pulumi/pulumi-eks)
• L70 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The eks.Cluster resource exposes a kubeconfig output property." (also L87) → ✅ verified (evidence: pulumi-eks Cluster.py: def kubeconfig(self) -> pulumi.Output[Any]: ... A kubeconfig that can be used to connect to the EKS cluster. — confirms eks.Cluster exposes a kubeconfig output property across SDKs (Python, TS, Go, .NET, Java).; source: gh search code --owner pulumi "kubeconfig" repo:pulumi/pulumi-eks (sdk/python/pulumi_eks/cluster.py))
• L92 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The instanceType argument on eks.Cluster describes the default managed node group, and a fleet with mixed instance types requires a separate node group…" → ✅ verified (evidence: Pulumi's eks.Cluster registry docs describe instanceType as "The instance type to use for the cluster's nodes" (singular, applying to the default managed node group), while mixed/multiple instance types require using a separate…; source: https://www.pulumi.com/registry/packages/eks/api-docs/cluster/ and https://www.pulumi.com/ai/answers/5Sir8Kmd3WQfQLfAbWQ8FL/eks-nodegroup-flexibility-with-multiple-aws-instance-types)
• L92 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The default node group approach described in this post remains the registry's canonical starting point for EKS." → ✅ verified (framing: Source shows the default eks.Cluster (default node group) as the flagship quickstart example; claim that this remains the "canonical starting point" is a…; evidence: The current Pulumi EKS registry package page and eks.Cluster API docs still present the default node group approach (new eks.Cluster("cluster", {})) as the canonical starting example: "Create an EKS cluster with the default…; source: https://www.pulumi.com/registry/packages/eks/ and https://www.pulumi.com/registry/packages/eks/api-docs/cluster/)
• L96 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "AKS clusters are provisioned through @pulumi/azure-native's ManagedCluster resource." → ✅ verified (evidence: pulumi-azure-native source confirms containerservice.ManagedCluster (registered as azure-native:containerservice:ManagedCluster) is the AKS resource, e.g. sdk/nodejs/containerservice/managedCluster.ts: "export class ManagedCluster…; source: gh search code --owner pulumi pulumi-azure-native ManagedCluster; repo:content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L96 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "AKS cluster credentials for kubectl come back from a separate call (listManagedClusterUserCredentialsOutput) and must be decoded from base64." (also L169) → ✅ verified (evidence: Official pulumi/examples repo (azure-ts-aks/index.ts) confirms the exact pattern: `const creds = containerservice.listManagedClusterUserCredentialsOutput({...}); const encoded = creds.kubeconfigs[0].value; export const kubeconfig = ...…; source: gh api repos/pulumi/examples/contents/azure-ts-aks/index.ts)
• L108-121 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The ManagedCluster resource accepts resourceGroupName, agentPoolProfiles, dnsPrefix, enableRBAC, and identity arguments (TypeScript) /…" (also L143-155) → ✅ verified (evidence: Decoded pulumi-azure-native Python SDK source (sdk/python/pulumi_azure_native/containerservice/managed_cluster.py) confirms ManagedClusterArgs.init accepts resource_group_name, agent_pool_profiles, dns_prefix, enable_rbac, and…; source: gh api repos/pulumi/pulumi-azure-native/contents/sdk/python/pulumi_azure_native/containerservice/managed_cluster.py)
• L123-126 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "containerservice.listManagedClusterUserCredentialsOutput (TypeScript) / list_managed_cluster_user_credentials_output (Python) is the function used to…" (also L157-159) → ✅ verified (evidence: pulumi-azure-native SDK source confirms both symbols: nodejs export function listManagedClusterUserCredentialsOutput(args: [REDACTED], ...) and python `def…; source: gh search code --owner pulumi listManagedClusterUserCredentialsOutput / list_managed_cluster_user_credentials_output (pulumi/pulumi-azure-native))
• L169 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Azure returns the kubeconfig base64-encoded from listManagedClusterUserCredentialsOutput, making decoding a required step rather than an optional cleanup…" → ✅ verified (evidence: The blog's own code examples decode the credential value with base64 (Buffer.from(enc, "base64") in TS and base64.b64decode(...) in Python) applied to creds.kubeconfigs[0].value from listManagedClusterUserCredentialsOutput, and…; source: gh search code --owner pulumi listManagedClusterUserCredentials; repo:content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L173 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "GKE splits cluster and node pool into two separate resources in @pulumi/gcp." → ✅ verified (evidence: pulumi-gcp source confirms gcp.container.Cluster (cluster.ts) and gcp.container.NodePool (nodePool.ts) are two distinct resource classes; nodePool.ts docstring states it "Manages a node pool in a Google Kubernetes Engine (GKE)…; source: gh api repos/pulumi/pulumi-gcp/contents/sdk/nodejs/container/nodePool.ts (and cluster.ts listing))
• L173 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "GKE defaults deletionProtection to true, which must be set explicitly for a cluster intended to be torn down later." (also L290) → ✅ verified (evidence: The blog text itself states "GKE splits cluster and node pool into two resources in @pulumi/gcp, and it defaults deletionProtection to true, which must be set explicitly for a cluster you intend to tear down later" and the FAQ…; source: pulumi/pulumi-gcp (schema generated from terraform-provider-google google_container_cluster deletion_protection field, default true))
• L182-193 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The gcp.container.Cluster and gcp.container.NodePool resources accept arguments including initialNodeCount, removeDefaultNodePool…" (also L206-216) → ✅ verified (evidence: pulumi-gcp SDK source confirms all cited fields: Cluster.java exposes initialNodeCount, and cluster.ts/NodePool.ts docstrings show removeDefaultNodePool: true, deletionProtection, initialNodeCount: 1, and `nodeConfig: {…; source: gh search code --owner pulumi repo:pulumi/pulumi-gcp (sdk/nodejs/container/cluster.ts, sdk/nodejs/container/nodePool.ts, sdk/java/.../Cluster.java, .../NodePool.java))
• L223 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "A GKE kubeconfig must be assembled from the cluster's name, endpoint, and masterAuth.clusterCaCertificate, plus a gke-gcloud-auth-plugin exec entry that…" → ✅ verified (evidence: Pulumi's official gcp-ts-gke example (pulumi/examples) builds the kubeconfig exactly this way: pulumi.all([k8sCluster.name, k8sCluster.endpoint, k8sCluster.masterAuth]).apply(...) embeds ${auth.clusterCaCertificate} and…; source: gh api repos/pulumi/examples/contents/gcp-ts-gke/cluster.ts)
• L223 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "There is no built-in .kubeconfig output for GKE clusters the way @pulumi/eks provides one." → ✅ verified (evidence: pulumi-eks's Cluster resource exposes a dedicated kubeconfig output property (see sdk/nodejs/clusterMixins.ts, examples exporting cluster.kubeconfig directly), whereas gcp.container.Cluster has no such output — its doc/schema only…; source: gh search code --owner pulumi pulumi-eks kubeconfig; gh api repos/pulumi/pulumi-gcp/contents/sdk/nodejs/container/cluster.ts)
• L223 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The asymmetry in kubeconfig handling across EKS, AKS, and GKE is real and intentional, not an oversight in this guide." → ➖ not-a-claim (evidence: This is an editorial/positioning statement about the guide author's own intentional design choice in presenting kubeconfig handling differently across EKS, AKS, and GKE — it is not a falsifiable technical assertion about product behavior…; source: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md (self-referential authorial statement))
• L232-244 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi's Kubernetes provider can be pointed at a cluster's kubeconfig and used to declare a Deployment resource using the same declarative pattern as the…" → ✅ verified (evidence: pulumi-kubernetes provider source confirms the Provider resource accepts a "kubeconfig" argument (provider/pkg/provider/provider.go references Property: "kubeconfig" and validates the Provider "kubeconfig" argument), matching the blog's…; source: gh search code --owner pulumi repo:pulumi/pulumi-kubernetes filename:provider.go kubeconfig)
• L247 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi's Kubernetes get-started guide at /docs/iac/get-started/kubernetes/ provides a full walkthrough of deploying a workload onto an existing cluster…" (also L264, L274) → ✅ verified (framing: Tutorial demonstrates a static replicas field rather than a dedicated "scaling" section, but this is a special case of scaling configuration entailed by the…; evidence: The page at /docs/iac/get-started/kubernetes/ is a step-by-step tutorial deploying an NGINX Deployment and exposing it via a Kubernetes Service (LoadBalancer/ClusterIP), with the Deployment spec including a replicas field (`replicas…; source: repo:content/docs/iac/get-started/kubernetes/modify-program.md and _index.md)
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "EKS's kubeconfig is available as a direct cluster.kubeconfig output." → ✅ verified (evidence: pulumi-eks source confirms Cluster exposes a direct kubeconfig output property (e.g. Python SDK: "def kubeconfig(self) -> pulumi.Output[Any]: ... A kubeconfig that can be used to connect to the EKS cluster."), and official examples…; source: gh search code --owner pulumi "kubeconfig" repo:pulumi/pulumi-eks (sdk/python/pulumi_eks/cluster.py, examples/cluster/index.ts))
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "AKS's kubeconfig comes from a base64-encoded credential call." → ✅ verified (evidence: The pulumi-azure-native SDK source for listManagedClusterUserCredentials documents its result field as: "Base64-encoded Kubernetes configuration file" (kubeconfigs: outputs.containerservice.CredentialResultResponse[]), matching the…; source: gh api repos/pulumi/pulumi-azure-native/contents/sdk/nodejs/containerservice/listManagedClusterUserCredentials.ts)
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "GKE's kubeconfig must be assembled from cluster fields plus an auth plugin." → ✅ verified (evidence: Multiple official Pulumi templates/examples (e.g. pulumi/templates:kubernetes-gcp-typescript/index.ts, pulumi/examples:gcp-ts-gke/cluster.ts) construct the GKE kubeconfig manually using ${gkeCluster.masterAuth.clusterCaCertificate}…; source: gh search code --owner pulumi "gke-gcloud-auth-plugin clusterCaCertificate" (pulumi/templates:kubernetes-gcp-typescript/index.ts, pulumi/examples:gcp-ts-gke/cluster.ts))
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "GKE has a teardown gotcha requiring deletionProtection to be set to false first, whereas EKS and AKS have no such teardown gotcha by default." → ✅ verified (evidence: Pulumi's own GCP provider docs confirm: "On version 5.0.0+ of the provider, you must explicitly set deletionProtection = false and run pulumi up to write the field to state in order to destroy a cluster." No equivalent…; source: https://www.pulumi.com/registry/packages/gcp/api-docs/container/cluster/)
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "GKE's control plane is fully managed by Google Cloud." → ✅ verified (evidence: Google Cloud's GKE documentation states that in standard GKE, Google manages the cluster control plane (API server, scheduler, controller manager, etcd) on the customer's behalf, while the customer manages nodes. This matches the blog's…; source: Google Cloud GKE documentation (cluster architecture: control plane and nodes))
• L249-257 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "EKS uses a managed node group by default for node management." → ✅ verified (evidence: The same blog post confirms elsewhere that @pulumi/eks's Cluster component creates "the default managed node group" automatically ("instanceType describes the default managed node group... the default node group above remains the…; source: repo:pulumi/pulumi-eks sdk/nodejs/nodegroupMixins.ts; content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md L92)
• L261 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The blog post 'Best tools for managing Kubernetes infrastructure as code in 2026' (at /blog/best-kubernetes-iac-tools-2026/) compares Pulumi against…" → ❌ contradicted (evidence: No Pulumi blog post exists at the URL "/blog/best-kubernetes-iac-tools-2026/". The closest matching real Pulumi content comparing Pulumi, Terraform, Crossplane, etc. for Kubernetes is titled "Terraform and Kubernetes: A Practical Guide…; source: WebSearch ran query "best-kubernetes-iac-tools-2026 pulumi.com"; top results show the real post is at /blog/terraform-kubernetes/, not the cited URL; intuition: The cited slug /blog/best-kubernetes-iac-tools-2026/ does not match any indexed Pulumi blog URL; likely a fabricated…)
• L262 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The blog post 'Terraform and Kubernetes: a practical guide for 2026' (at /blog/terraform-kubernetes/) covers what changes if you're migrating an existing…" → ✅ verified (evidence: The page "Terraform and Kubernetes: A Practical Guide for 2026" at pulumi.com/blog/terraform-kubernetes/ exists and discusses migration paths, stating: "Pulumi's pulumi convert command translates existing Terraform HCL into a Pulumi…; source: https://www.pulumi.com/blog/terraform-kubernetes/)
• L263 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi's cloud provider guides at /docs/iac/guides/clouds/ cover AWS, Azure, and Google Cloud setup in more depth than fits in this post." → ❌ contradicted (framing: overclaim — source covers only "AWS and Azure"; claim adds "and Google Cloud" which the page does not contain; evidence: The actual /docs/iac/guides/clouds/ index page only has sections for "AWS" and "Azure" (linking to aws/ and azure.md guides), with meta_desc explicitly stating "Infrastructure as Code guides for AWS and Azure with Pulumi." There is no…; source: repo:pulumi/docs content/docs/iac/guides/clouds/_index.md)
• L264 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "The page /docs/iac/get-started/kubernetes/ ('Deploying to Kubernetes with Pulumi') is described as the next step once a cluster is running." → ✅ verified (framing: Blog link text "Deploying to Kubernetes with Pulumi" is a paraphrase of the actual page title "Get Started with Pulumi and Kubernetes," but the description…; evidence: The page at /docs/iac/get-started/kubernetes/ exists (title: "Get Started with Pulumi and Kubernetes") and its content is a step-by-step tutorial to deploy an NGINX workload onto an existing Kubernetes cluster ("Before you begin: You…; source: gh api repos/pulumi/docs/contents/content/docs/iac/get-started/kubernetes/_index.md)
• L270 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Using the @pulumi/eks package, a minimal program creates the cluster, its managed node group, and its kubeconfig output in under twenty lines, with no…" → ✅ verified (evidence: The pulumi-eks README states the component "creates and manages the resources necessary to run an EKS Kubernetes cluster in AWS," including "The EKS cluster control plane," "worker nodes configured as node groups," and networking (CNI…; source: gh api repos/pulumi/pulumi-eks/contents/README.md; content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md L60-71)
• L274 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "You provision the cluster first, then deploy applications onto it separately. Once a cluster exists, point Pulumi's Kubernetes provider at its kubeconfig and…" → ✅ verified (evidence: The get-started guide at /docs/iac/get-started/kubernetes/ states "You need access to a Kubernetes cluster (local or cloud-based) and kubectl installed and configured" then walks through deploying an NGINX web server onto that existing…; source: repo:content/docs/iac/get-started/kubernetes/_index.md)
• L276 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "### Can I manage EKS, AKS, and GKE clusters from one Pulumi project?" → ➖ not-a-claim (evidence: This is a section heading phrased as a question ("Can I manage EKS, AKS, and GKE clusters from one Pulumi project?") used to introduce FAQ content, not a falsifiable factual assertion requiring source verification.; source: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md L276)
• L278 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi tracks the state of multiple clusters across different clouds independently within one project." → ✅ verified (evidence: Pulumi's resource model tracks each resource (a CustomResource managed by any provider — AWS, Azure, GCP, Kubernetes, etc.) individually in a stack's state, each with its own URN, inputs, and outputs, independent of other resources or…; source: repo:content/docs/iac/concepts/resources/_index.md ("A custom resource is a cloud resource managed by a resource provider such as AWS, Microsoft Azure, Google Cloud or Kubernetes"))
• L278 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi projects are not tied to a single cloud, so one program can create an EKS cluster with @pulumi/eks, an AKS cluster with @pulumi/azure-native, and…" → ✅ verified (evidence: Confirmed package names exist: pulumi-eks repo publishes "@pulumi/eks" (nodejs/eks/package.json), pulumi-azure-native repo publishes "@pulumi/azure-native" (sdk/nodejs/package.json). @pulumi/gcp is likewise a standard published Pulumi…; source: gh search code --owner pulumi repo:pulumi/pulumi-eks filename:package.json eks; gh search code --owner pulumi repo:pulumi/pulumi-azure-native filename:package.json azure-native)
• L282 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "pulumi up blocks until the cluster and its kubeconfig are ready." → ✅ verified (evidence: Pulumi's deployment engine executes pulumi up synchronously against the resource DAG: it does not return until all resources in the program (and any outputs, including exported kubeconfig strings derived from cluster properties) have…; source: Pulumi engine behavior (resource dependency graph execution model, general CLI docs at pulumi.com/docs/iac/cli/commands/pulumi_up))
• L282 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "EKS control planes typically take ten to fifteen minutes to provision." → 🌀 framing-drift (framing: shifted — AWS's current average is "9 minutes or less"; claim's "ten to fifteen minutes" reflects the pre-2021 baseline, not current typical performance.; evidence: AWS states in its official announcement: "Amazon Elastic Kubernetes Service (EKS) has reduced control plane creation time by 40%, enabling you to create a new EKS cluster control plane in 9 minutes or less, on average." The older…; source: https://aws.amazon.com/about-aws/whats-new/2021/03/amazon-eks-reduces-cluster-creation-time-40-percent/; intuition: Claimed range skews toward the old (pre-2021 improvement) average rather than AWS's current stated ~9-minutes-or-less…)
• L282 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Worker nodes take a few minutes more to join the cluster after the control plane is provisioned." → 🤷 unverifiable (evidence: This is a general, approximate timing statement about Kubernetes cluster provisioning (worker nodes joining after control plane setup), which is a well-known operational characteristic but not tied to a specific measurable claim or cited…; source: N/A - general operational description, no specific source cited; intuition: Vague qualitative timing claim ("a few minutes more") with no specific numbers or cited benchmark - likely author's… (WebSearch dispatched but verification did not converge within the turn budget))
• L286 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Pulumi's Kubernetes provider represents Deployments, Services, and every other Kubernetes object as typed resources in Python, TypeScript, Go, C#, or Java." → ✅ verified (evidence: pulumi/pulumi-kubernetes repo's sdk/ directory contains generated SDKs for dotnet (C#), go, java, nodejs (TypeScript), and python, confirming Kubernetes resources (e.g., Deployments, Services) are represented as typed resources across…; source: gh api repos/pulumi/pulumi-kubernetes/contents/sdk)
• L286 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Writing new YAML is never required when managing Kubernetes with Pulumi." → ✅ verified (evidence: Pulumi's Kubernetes provider (pulumi-kubernetes) exposes typed resources for all core Kubernetes objects (Deployments, Services, etc.) in Python, TypeScript, Go, C#, and Java, so any manifest can be expressed as native code instead of…; source: gh search code --owner pulumi repo:pulumi/pulumi-kubernetes "yaml.ConfigFile")
• L290 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Running pulumi destroy from the same project tears down an EKS or AKS cluster and its supporting resources directly." → ✅ verified (framing: Claim describes default pulumi destroy behavior for EKS/AKS (no opt-in protection blocking it), consistent with AWS/Azure not defaulting cluster deletion…; evidence: pulumi-eks's Cluster component does expose a deletionProtection option (confirmed in schema.json and the deletion-policy example), but unlike GCP's Container Cluster resource (which defaults deletionProtection to true, per pulumi-gcp…; source: gh search code --owner pulumi "deletionProtection" repo:pulumi/pulumi-eks; repo:pulumi/pulumi-gcp)
• L290 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "For GKE, deletionProtection must be set to false on the Cluster resource before destroying it." → ✅ verified (evidence: The pulumi-gcp SDK source for gcp.container.Cluster states: "On version 5.0.0+ of the provider, you must explicitly set deletionProtection = false and run pulumi up to write the field to state in order to destroy a cluster." This…; source: gh search code --owner pulumi -R pulumi/pulumi-gcp deletionProtection (sdk/nodejs/container/cluster.ts doc comment))
• L290 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "Google's provider defaults deletionProtection to true." → ✅ verified (evidence: The GKE Cluster resource (gcp.container.Cluster, bridged from Terraform's google_container_cluster) has a deletion_protection field that defaults to true, which is why Pulumi/Terraform users must explicitly pass…; source: gh api repos/hashicorp/terraform-provider-google (resource_container_cluster.go) / pulumi/pulumi-gcp bridged schema for gcp.container.Cluster.deletionProtection)
• L290 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "pulumi destroy fails against a GKE cluster protected by deletionProtection until that flag is turned off." → ✅ verified (evidence: pulumi-gcp's own provider documentation (provider/replacements.json) states for the deletion_protection field: "Unless this field is set to false in the statefile, a pulumi destroy or pulumi up that would delete the instance will…; source: gh search code --owner pulumi "deletion_protection" repo:pulumi/pulumi-gcp (provider/replacements.json))
• L292-294 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "For most teams, a managed Kubernetes service is better than running Kubernetes themselves." → ➖ not-a-claim (evidence: This is a subjective opinion/recommendation statement (positioning), not a falsifiable factual assertion with a checkable source, name, number, or date.; source: content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md)
• L294 in content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md "EKS, AKS, and GKE each run and patch the control plane, handle etcd and API server availability, and integrate with their cloud's identity and networking…" → ✅ verified (evidence: This is standard, well-documented behavior of managed Kubernetes offerings: AWS EKS, Azure AKS, and GCP GKE all manage/patch the control plane (including etcd and API server availability) and natively integrate with their respective…; source: General knowledge of AWS EKS, Azure AKS, and GCP GKE managed control plane documentation)

📊 Editorial balance

Section depth, mention distribution, recommendation steering

• Section depth: 9 H2 sections (mean 19.4 lines, median 16, std 17.1). Outliers: Provisioning an AKS cluster on Azure: 57 (3.6× median).
• Vendor / entity mentions: Pulumi: 59 · EKS: 29 · GKE: 17 · AKS: 14 · AWS: 10 · Azure: 9 · Google Cloud: 7 · Terraform: 2 · Crossplane: 1 · CDK: 1. The three clouds are covered comparably (EKS runs ahead mainly because @pulumi/eks is discussed twice — in the walkthrough and again in the kubeconfig contrast). Competitor mentions are confined to two "Where to go next" links; no comparative claims are made in the body.
• FAQ steering: 8 FAQ entries; 8 answer in terms of Pulumi, 0 recommend an alternative tool. Expected for a single-product how-to whose questions are all "how do I do X with Pulumi" — not flagged.
• Section-depth outlier: the AKS section's 57 lines are almost entirely the paired TypeScript/Python code blocks (AKS needs an explicit resource group, agent pool profile, identity block, and a base64 credential decode where EKS needs four arguments). The prose around it is comparable in length to the EKS and GKE sections — not flagged.

🚨 Outstanding in this PR

These must be resolved or refuted before merging.

No outstanding issues.

⚠️ Low-confidence

Review each and resolve as appropriate — these don't block the PR.

• [L288] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — "plus a few minutes more for worker nodes to join" — verdict: 🤷 unverifiable. No cloud provider publishes a node-join SLA, so there's nothing to check "a few minutes more" against. It sits on the same line as the control-plane timings, which are now aligned with AWS's published average, so it reads as part of a sourced answer. It isn't a spec or price a reader will act on, so it doesn't block the PR. Author question (still open): is this from your own runs, or carried over from the surrounding estimates? If it's observed, the sentence is fine as written; if it's a guess, softening it to "plus additional time for worker nodes to join" costs the reader nothing.

Style suggestions

Optional polish from pattern-based linting — never blocking, not counted above. Take the ones that read better and ignore the rest. ✏️ marks one you can apply from the Files changed tab — use Add suggestion to batch on each, then Commit suggestions to take several in a single commit.

No style suggestions for this change.

📋 Triaged verifier findings

I double-checked these and realized they weren't real findings — click to expand

• [L261] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — "The blog post 'Best tools for managing Kubernetes infrastructure as code in 2026' (at /blog/best-kubernetes-iac-tools-2026/) compares Pulumi against…" — Spurious: the page does exist. content/blog/best-kubernetes-iac-tools-2026/index.md is on master (published 2026-08-14, draft: false), and its meta_desc — "Pulumi, Terraform, Helm, Kustomize, Crossplane, Argo CD, Flux, cdk8s, and kro, compared honestly on fit" — supports the comparison this post attributes to it. The verification step searched the live site rather than the repo and didn't find the URL, likely because the post is recent enough not to be indexed yet. The link text ("Best tools for managing Kubernetes infrastructure as code in 2026") paraphrases the real title ("Best Kubernetes Infrastructure as Code Tools in 2026"), which is fine for link prose.
• [L56] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — "so the cluster's definition, not just its running state, is reviewable by your team" — Spurious: the prose linter read "just" as a difficulty qualifier (as in "it's just a few lines"), but here it carries the exclusive sense — "not only its running state." No change needed.

💡 Pre-existing issues in touched files (optional)

No pre-existing issues in touched files.

✅ Resolved since last review

• [L24] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — "Here's one program that creates EKS, AKS, or GKE clusters" in social.twitter — resolved in 0b38958. The X copy now reads "Here's working Pulumi code for EKS, AKS, and GKE clusters, no YAML templates," which matches the three programs the post actually ships and lines up with the LinkedIn and Bluesky copy.
• [L41] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — prerequisites named only Node.js/npm and Python while the post promises five languages — resolved in 0b38958. The line now scopes the runtime requirement to the examples ("the runtime for your chosen language installed — Node.js and npm for the TypeScript examples below, or Python for the Python ones") instead of narrowing the guide.
• [L263] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — the /docs/iac/guides/clouds/ link claimed Google Cloud coverage — resolved in 0b38958. It now reads "cover AWS and Azure setup," matching the two sections on that index page.
• [L282] content/blog/how-to-provision-a-kubernetes-cluster-with-iac/index.md — "EKS control planes typically take ten to fifteen minutes" (framing-drift against AWS's published "9 minutes or less, on average") — resolved in 0b38958; now "around ten minutes."

📜 Review history

• 2026-08-24T12:33:08Z — New Kubernetes provisioning post: 3 blockers (prerequisites contradict the post's own language list, the /docs/iac/guides/clouds/ link overpromises Google Cloud, X social copy says "one program" for three programs); code and provider APIs verified clean. (ef8b2d9)
• 2026-08-24T13:19:32Z — re-reviewed after fix push (2 new commits, 0b38958). All 3 outstanding findings resolved, plus the low-confidence EKS control-plane timing; 1 low-confidence author question remains open. No new findings: the reworked social: block scalars follow existing multi-paragraph precedent, and the surviving "one program" on L284 is a correct capability statement about multi-cloud projects, not the social overclaim. A prose-linter hit on "just" (L56) was triaged as a false positive — exclusive sense, not a difficulty qualifier. Supersedes the errored run at comment 5395359458.

---

• Refresh this review — comment @claude #update-review. Say what you fixed, or which finding you dispute and why; both work in the same mention.
• Ask for anything else — comment @claude with no hashtag (questions, one-off fixes). Leaves this review untouched.

Important

Please don't hide, resolve, or delete this comment! It breaks things!

📖 How pre-merge review works — the full lifecycle, short-circuits, and escape hatches.

[workprentice]

Addressed all three Outstanding findings plus the framing-drift low-confidence item in 0b389584fe:

• X copy now matches the LinkedIn/Bluesky copy in describing three examples, not one program.
• Prerequisites line rewritten to point at the runtime for whichever language a reader picks, rather than naming only two of the five supported languages.
• "Where to go next" link to /docs/iac/guides/clouds/ narrowed to AWS and Azure, matching that page's actual coverage.
• EKS control-plane timing updated from the pre-2021 "ten to fifteen minutes" baseline to "around ten minutes", matching AWS's current stated average.

[workprentice]

@claude #update-review — please refresh the pre-merge review against 0b38958; all three Outstanding findings and the framing-drift item above are addressed.

[github-actions]

🤖 @workprentice[bot] — review errored. Mention @claude #update-review again to retry.

[workprentice]

@claude #update-review — retrying after the prior run errored (comment 5395359458). Findings from CLAUDE_REVIEW_HEAD ef8b2d9 addressed in 0b38958; see comment 5395344946 for the summary.

[github-actions]

🤖 Review updated on @workprentice[bot]'s request.