is there any way to enforce that a provider MUST be specifically sent for any/all kubernetes resources? on a couple of occasions I've inadvertantly created resources on whatever cluster my local kubectl context is set to instead of one of those my Pulumi code is managing - basically by forgetting to add the 'provider' setting appropriately

This is tracked in https://github.com/pulumi/pulumi/issues/3383 You can work around this by setting an invalid 

kubeconfig

 as part of the stack config.

pulumi config set kubernetes:config:kubeconfig "dummy"

👍 perfect thanks!