I’m using Cloudflare tunnel with Pulumi and I have a code block to add tunnel secret into pulumi stack config if secret didn’t exist:

stack.set_config(f"{type}-{name}", auto.ConfigValue(value=tunnel_secret, secret=True))

This is done for newly create tunnel but how I remove this secret when tunnel being deleted? in other words, how I detect

delete

action to perform remove stack config?

You don't. Under what circumstances would the tunnel be destroyed? Would it be just when the stack is being destroyed? In which case, you can just remove the stack config, as it's not being used.

I can understand that there is no way to automate it

How are you detecting the create action? I'd think you'd just be able to do the opposite of that

I’m not sure about that because I have a code block to create resource but there is no option to define code block to delete resource

It deletes when you remove the code block