So I'm using a utility to convert a

tls.PrivateKey

pem

into

openssh

format and throwing it into a k8s secret using

stringData

The issue is that pulumi thinks the secret changes every single update (despite it remaining stable), and so it recreates the secret every time. Anyone run into this?

I use the

tls

package for similar purposes and haven’t seen this happen. What does this code look like?

So the

PrivateKey

resource in tls only outputs

privateKeyPem

, so I use the

sshpk

util to convert over to openssh format:

function convertPrivateKeyToOpenSSH(key: pulumi.Input<string>) {
  return pulumi.output(key).apply((unwrappedKey) => {
    const parsedKey = sshpk.parsePrivateKey(unwrappedKey, "pem");
    // @ts-ignore
    return parsedKey.toString("ssh");
  });
}

... which is called like:

convertPrivateKeyToOpenSSH(tlsPrivateKeyOutput.privateKeyPem)

... the result of which is pushed in

stringData

in a k8s cluster Secret.

what's in the diff?

and presumably

convertPrivateKeyToOpenSSH

returns the same string every time?

Diff looks like this, it's odd I can't see the keys inside `stringData`:

+-kubernetes:core/v1:Secret: (replace)
                      ~ stringData: {
                        }

... and I compared secrets before/after application and they look identical.