This message was deleted.

AFAIK Pulumi will always do a

create, then delete

for a

replace

action unless you specify

deleteBeforeReplace: true

in the

ResourceOptions

for any given resource. Meaning the order this takes place is not determined by the provider. Unfortunately I can't speak to the specific issue with your alias change so hopefully someone else will chime in

Huh, that’s weird that it failed for both a GCP service account and a Kubernetes secret but not for a RandomPassword then. Maybe my hypothesis is completely off 😄

The difference might just a side effect of the fact that RandomPassword isn’t actually provisioning any cloud infrastructure?

Possibly. Not sure why it should result in two different resources with the same alias though, if it’s guaranteed to delete the old resource before creating the new one