No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Pulumi seems to think that some of my resource specifications are (1) secrets and (2) get updated every time, but they're hardcoded strings. Any suggestions on how I can diagnose this?

e.g. I'll get a diff like:
```      ~ spec: {
          ~ template: {
              ~ spec: {
                  ~ containers: [
                      ~ [0]: {
                              ~ resources: {
                                  ~ requests: {
                                      ~ cpu: [secret] =&gt; [secret]
                                    }
                                }
                            }
                    ]
                }
            }
        }```
but the actual requests are:
```              resources: {
                requests: {
                  cpu: "2000m",
                  memory: "16Gi",
                },
              },```

A property is a secret if the implementing class defines it as one. What resource type is this?

the only reference I have to secrets is via env vars, but it's to the name of a k8s secret not a pulumi secret (I don't think it's a pulumi secret)

```{
  name: "FOO_URL",
  valueFrom: { secretKeyRef: { name: secrets.fooApiSecret.metadata.name, key: "url" } },
},```

how can I diagnose what (if anything) is making the whole thing a secret?