This message was deleted.

There is the additionalSecretOutputs option if you're trying to make sure pulumi handles part of a resource as "secret".

For the pulumi/eks Cluster resource, the kubeConfig output is not automatically marked as a secret. Am I supposed to have to mark it as a secret explicitly or is that a bug in the API? But my main issue is that even accessing non-secret outputs require the passphrase. It's a security risk to be passing the passphrase around to every stack that only needs a "storageclassname" output for example

Generally speaking, outputs are not secret unless you use

pulumi.secret()

or they are something

pulumi

alread knows about like a password or a kubeconfig file

well i didn't figure out why I (thought I) was running into that odd behavior, but I changed my secret manager from passphrase to AWS KMS and it's working fine. Thanks for confirming that it shouldn't happen Dave