fwiw, I just starting using sops for secrets handling .. so I'm storing the pulumi config secret in sops along with azure creds