Hi, I'm pretty new to Pulumi though not iac having come from terraform. I'm a developer more than ops and understand Typescript well enough for this purpose. I'm having a hell of a time figuring out secrets though. In this specific case, we have a secret that's defined in a stack config and we're trying to inject it into a cloud-init script that's being built and sent along to the ESXI instance. It doesn't accept a resource to finally interp the secret from an Output unless i'm missing something. What we're trying to do is use EJS and a template file to create the raw text string of the cloud-init content and then base64 encode it before passing it back as a text parameter being passed to the ESXI create virtual instance resource. I understand the concept of needing to late resolve things that might be an output from another resource and it won't be known until it actually happens. This is a config value, are they not known at initial runtime? Are we approaching this incorrectly? Are config secrets not the best place to store this information if we need to use it in this way?

config values should be strings, they ought to interpolate/pass in directly