The Output of get_secret_output is not marked as a secret #424
Description
What happened?
Calling get_secret_output returns an Output that is not marked as secret and is shown in the preview if passed to other resources.
Example
Code:
credentials_data = pulumi_vault.generic.get_secret_output(path=f"rabbitmq/creds/my-role").data
provider = rabbitmq.Provider(
"rabbitmq-provider",
username=credentials_data.apply(lambda data: data["username"]),
password=credentials_data.apply(lambda data: data["password"]),
)
Preview diff:
+ pulumi:providers:rabbitmq: (create)
[urn=URN]
endpoint: [secret]
password: "CLEAR_TEXT_PASSWORD"
username: "CLEAR_TEXT_USERNAME"
version : "3.3.1"
Workaround:
credentials_data = pulumi_vault.generic.get_secret_output(path=f"rabbitmq/creds/my-role").data
provider = rabbitmq.Provider(
"rabbitmq-provider",
username=pulumi.Output.secret(credentials_data.apply(lambda data: data["username"])),
password=pulumi.Output.secret(credentials_data.apply(lambda data: data["password"])),
)
Output of pulumi about
CLI
Version 3.106.0
Go Version go1.22.0
Go Compiler gc
Plugins
python unknown
rabbitmq 3.3.1
vault 5.20.0
Host
OS darwin
Version 14.3.1
Arch arm64
This project is written in python: executable='/Users/my-user/.pyenv/shims/python3' version='3.9.18'
Dependencies:
NAME VERSION
black 22.12.0
flake8 3.9.2
isort 5.12.0
mypy 0.910
pip 23.3.1
pulumi_rabbitmq 3.3.1
pulumi_vault 5.20.0
setuptools 69.0.2
Additional context
No response
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).