Is there any established pattern for secret generation; kind of like helm where it’ll create a random secret value if that configuration value is not populated but it won’t make a new secret on subsequent runs?

We recently added a

@pulumi.random

package. You can use it to create random values that are persisted in the checkpoint and so only created once per stack (unless you force them to be recreated by changing the inputs):

import * as random from "@pulumi/random";

const token = new random.RandomString("password", {
    length: 10,
    lower: true,
    upper: false,
    special: false,
});

export let tokenString = token.result;

https://github.com/pulumi/pulumi-random

I’ll have to take a gander, thanks!