What’s the go-to approach for looking up a Kubernetes resource? I tried

k8s.core.v1.Secrets.get

as an example but get my hand slapped by Pulumi when it runs in an update.

/* Returns auth from a `ServiceAccount`'s associated secret */
export const getServiceAccountAuth = (serviceAccount: ServiceAccount): pulumi.Output<{ token: string, caCert: string}> =>
    pulumi.output(serviceAccount.secrets[0].name).apply(secretName => {
        const secret = k8s.core.v1.Secret.get(secretName, secretName)
        const { token, ['ca.crt']: caCert } = secret.data.get()
        return { token, caCert }
    })

we deploy the secret out of a chart,s o that might be a bit different, but this is how we do it:

const fabricCa = new FabricCaResource(this.name, caSettings, this.config, {
      ...this.opts,
      parent: this.k8sNamespace,
    });

    const tlsCertSecret = fabricCa.chart.getResource('v1/Secret', this.namespace, 'ca-tls-cert');

    // <https://www.pulumi.com/docs/intro/concepts/resources/#resource-get>
    const updatedTlsCertSecret = k8s.core.v1.Secret.get('tls-secret', tlsCertSecret.id, {
      ...this.opts,
      dependsOn: [fabricCa],
    });