when use vault kubernetes, inputs.tokenReviewerJwt field in stack checkpoint json is not encrypted about pulumi

[justinvp]

Hi @kindy, sorry for the trouble and long delay getting back to you! Thanks for your patience.

When you read the config into your program with cfg.RequireObject, the values will be in plaintext. When passing those plaintext values as inputs elsewhere, the system won't know that they are secret values.

If you use cfg.RequireSecretObject instead, the secretness would be maintained, but you'd have to access the value inside an Apply and since you're using the value in a loop to create resources, I wouldn't recommend that, since we generally don't recommend creating resources inside an Apply because it can make previews unreliable.

Instead, in this case, I'd suggest continuing to use cfg.RequireObject, but explicitly making any values secret that should be secret when passed as inputs to other resources.

For example, instead of:

TokenReviewerJwt:     pulumi.StringPtr(cfg.Token),

explicitly make it a secret:

TokenReviewerJwt:     pulumi.ToSecret(pulumi.StringPtr(cfg.Token)).(pulumi.StringPtrOutput),

[kindy]

Hi @justinvp, thanks for the reply, it helps a lot.

---

one more question: if user config some field/value as secret in stack config, should pulumi mark the value as secret automatically?

pulumi config set a.b.c some-value --secret --path