I have a situation I’m not quite sure what’s causing it. I have the following update diff if I do preview/up:

+-kubernetes:core/v1:Secret: (replace)
        [id=itay9/odas-secrets-o46s05yb]
        [urn=urn:pulumi:tenant-itay9::okera-trial-tenants::kubernetes:core/v1:Secret::odas-secrets]
        [provider=urn:pulumi:tenant-itay9::okera-trial-tenants::pulumi:providers:kubernetes::k8s-ssa-provider::b438617b-1a9e-4bd4-94f4-9ab2a01529a2]
      ~ stringData: {
          ~ SYSTEM_TOKEN: "[secret]" => "[secret]"
        }

In the code, the secret is created like this:

...

		StringData: pulumi.StringMap{
            ...,
			"SYSTEM_TOKEN":                 systemToken,

and

systemToken

is defined like this:

systemToken := pulumi.All(jwtKey.PrivateKeyPem).ApplyT(
		func(args []interface{}) (string, error) {
           ...
		},
	).(pulumi.StringOutput)

This would all make sense if there was an update in

systemToken

, but there isn’t - that’s not one of the resources that Pulumi is saying requires an update. Any idea why this might be the case? How do I debug something like this?