General question, why does it take so long for Pulumi to apply some k8s resources? For example, when installing cert-manager the

cert-manager/cert-manager-cainjector

resource has been

creating...

for several minutes already. Why isn't it essentially instant?

As you note, creation is almost instantaneous, but the k8s provider also waits for them to be ready before completing the update. See https://www.pulumi.com/blog/improving-kubernetes-management-with-pulumis-await-logic/ for more details on this. The readiness logic for each resource type is also documented in the API docs: https://www.pulumi.com/docs/reference/pkg/kubernetes/apps/v1/deployment/#deployment

sorry i left out some info by accident on my original post. The specific resource example I gave is a

ServiceAccount

which should be instant. Is the CLI possibly displaying the wrong resource being waited on?