When using ESC and 1Password, is there a way to take a secret and assign it to a variable to be used elsewhere? For example, I would like the example.jwk_private to resolve to the retrieved secret from 1Password.

It looks like that's what you're doing. If you save the environment and click open, does it work? (You can optionally show the secrets if you need to see the literal value.)

I am getting closer, but blocked on the next step. If I have an ESC Project/Environment of

secrets/integration

with:

values:
  1password:
    secrets:
      fn::open::1password-secrets:
        login:
          serviceAccountToken:
            fn::secret:
              ciphertext: [redacted]
        get:
          auth_jwk_private:
            ref: <op://Infrastructure/integration.auth/JWK_PRIVATE>
  secrets:
    auth.jwk_private: ${1password.secrets.auth_jwk_private}

And within ESC if I open and show secrets, it displays how I want. But back in my Pulumi.integration.yaml I just have the following:

environment:
  - secrets/integration

But when I run

pulumi config

I get:

KEY          VALUE
pulumi:tags  {"pulumi:template":""}
The stack's environment does not define the `environmentVariables`, `files`, or `pulumiConfig` properties.
Without at least one of these properties, the environment will not affect the stack's behavior.

Thoughts?