No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

```SecretPatch(
    f"{self.name}-argo-externaldns-secret-patch",
    metadata={
        "name": f"{self.name}",
        "namespace": "argocd",
        "annotations": {
            "external-dns-sa-arn": iam_role.arn
        },
    },
    opts=pulumi.ResourceOptions(
        depends_on=[
            role_attach,
            argo_cluster_secret,
        ],
        provider=self.cluster_provider,
    ),
)```

The usage looks correct.
Have you enabled Server Side Apply?

<https://www.pulumi.com/registry/packages/kubernetes/how-to-guides/managing-resources-with-server-side-apply/|https://www.pulumi.com/registry/packages/kubernetes/how-to-guides/managing-resources-with-server-side-apply/>

yeah I have that enabled on the k8s provider currently:
```self.cluster_provider = Provider(
            resource_name=name,
            kubeconfig=cluster.kubeconfig,
            opts=pulumi.ResourceOptions(depends_on=[cluster]),
            enable_server_side_apply=True,
        )```

Not sure then. I've used it in the past to set string_data.
Given it's mentioned in the error, what happens if you provide an empty dict?

hm, that's a good suggestion. seems like it does clear that error! does seem like the labels are going to be deleted in the original secret though so need to figure that out now :thinking_face:

Interesting, the labels should definitely not delete.

Worth raising issues for both on github

interestingly seems like it was just in the `pulumi up` details diff but the labels are still there. running it through again to verify the behavior but will make a ticket for the secret data issue. appreciate the help!