DeploymentSettings doesn't handle EnvironmentVariables if it's a secret and fails/ignore silently

[smithrobs]

What happened?

Probably related to #419 - I've tried multiple ways to set an env var with a secret and cannot get anything to show up in Pulumi Cloud. The up succeeds but silently does not create the env var if one contains a secret.

I've tried creating a secret inline, pulling an existing secret from config, doing applies, nothing seems to work.

Note that if there is a single secret value in the env var at all, none of the env vars are set, even plaintext ones.

Example

    var instance = Deployment.Instance;

    var deploymentSettingsResource = new PulumiService.DeploymentSettings("deploymentSettingsResource", new()
    {
        Organization = instance.OrganizationName,
        Project = instance.ProjectName,
        Stack = instance.StackName,
        OperationContext = new PulumiService.Inputs.DeploymentSettingsOperationContextArgs
        {
            EnvironmentVariables =
            {
                { "GH_TOKEN", Output.CreateSecret("my_secret_token") },
                { "NOT_SECRET", "I love otters" },
            },
        }
    });

Output of pulumi about

pulumi about

CLI          
Version      3.139.0
Go Version   go1.23.3
Go Compiler  gc

Plugins
KIND      NAME           VERSION
resource  aws            6.60.0
resource  awsx           2.16.1
resource  docker         4.5.6
language  dotnet         unknown
resource  pulumiservice  0.27.1
resource  random         4.16.4

Host     
OS       darwin
Version  15.1.1
Arch     arm64

This project is written in dotnet: executable='/Users/rsmith/.dotnet/dotnet' version='8.0.302'

Dependencies:
NAME                  VERSION
Pulumi                3.69.0
Pulumi.Aws            6.60.0
Pulumi.Awsx           2.16.1
Pulumi.PulumiService  0.27.1
Pulumi.Random         4.16.4

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[bryantallison]

Once it's fixed, if some info or an example could be added to the documentation here, that would be very helpful. Thanks!

[IaroslavTitov]

@bryantallison We have some examples on creation of DeploymentSettings via PSP - typescript example, + in python and yaml

But definitely agree it would be better to also have examples in the registry, I'll see how easy that is

[pulumi-bot]

This issue has been addressed in PR #475 and shipped in release v0.27.4.

[smithrobs]

Hey @IaroslavTitov this is better, thank you! I'm seeing a slightly different but related issue with v0.27.4:

Given two secrets and one plaintext:

    var ghToken = config.RequireSecret("ghtoken");

// ...

            EnvironmentVariables =
            {
                { "GH_TOKEN", ghToken },
                { "GH_TOKEN_OUTPUT", Output.CreateSecret("my_secret_token") },
                { "NOT_SECRET", "I love otters" },
            },

I see three secrets in the console which isn't what I expected (2 secret, 1 plaintext):

[IaroslavTitov]

slightly different

Yes, I called it out in the PR, unfortunately this is a bug beyond PSP, with pulumi itself. For C# resources, it will turn all Env Vars secret if just one is secret.

[smithrobs]

Aha, thank you for pointing that out. Upvoting pulumi/pulumi-dotnet#22 now😄