No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Every time I run `pulumi up`  it has to update this resource field type `repoURL: [secret] => output<string>`, but it never takes.

Not sure why this is I guess ArgoCD is updating the type after it's written to k8s?
```Do you want to perform this update? details
  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::evilapp::pulumi:pulumi:Stack::evilapp-dev]
    ~ kubernetes:argoproj.io/v1alpha1:Application: (update)
        [id=argocd/strapi]
        [urn=urn:pulumi:dev::evilapp::kubernetes:argoproj.io/v1alpha1:Application::argo-cd-strapi-application]
        [provider=urn:pulumi:dev::evilapp::pulumi:providers:kubernetes::default_4_5_4::78e5cf16-9530-4394-b736-34f6963ef3fb]
      ~ spec: {
          ~ source: {
              ~ repoURL: [secret] => output<string>
            }
        }```
Any ideas on how to handle these kinds of fields?

are you using the Pulumi Cloud state backend? if so you can login and view the update to see the diff and find out why it changed

if you want to debug this you might also need to use `pulumi.unsecret` to see the plaintext values

<@U03CLBPHR0D>

I'm not sure why `pulumi` always wants to update `repoURL` from `[secret] =&gt; output&lt;string&gt;`.

My only guess is that Pulumi creates the custom resource with `repoURL` using the type `output&lt;string&gt;`.

Then the operator that manages those custom resources converts the `repoURL` to a `[secret]` type?

Which means when Pulumi re-examines the state of that CR the `repoURL` and its found to not be the desired type so it needs its type updating.

:man-shrugging: :man-shrugging: :man-shrugging:

Using a static string works, it's only when I'm pulling `repoURL` the output of another resource. :thinking_face:

You need to unsecret the value so you can see exactly what the difference is that Pulumi has detected 

There’s no point trying to debug this if you can’t see the actual plaintext values 