the problem is that res2 is indirectly influenced by res1's change, as the setting of the secret is done by secret name, not by data. I guess that means pulumi logically sees no difference in the actual data of res2 hence no change. But somehow one can force a redeployment of cloud run, so there should be something doable there without a replace