if i run

pulumi config set vault:ca_cert_dir $HOME/pogos2/certs

naturally bash expands

$HOME

and it ends up in my config as

/Users/wryfi/pogos2/certs

.