When using `pulumi login local` is there a way to skip disab

Question

When using `pulumi login local` is there a way to skip disable this paraphrase thing There is absolutely no point in using it as there is no way it can ever be secure setting it as an env variable

billowy-army-68599 · Answer

you can set a blank passphrase ```export PULUMI CONFIG PASSPHRASE= ``` but you need to set some value for it so that we can encrypt stack secrets

nice-eye-54931 · Answer

Windows doesn t accept empty environment variables

nice-eye-54931 · Answer

And setting environment variables isn t a safe way to store that anyway Why is there no option to disable it all together I know you shouldn t do that for production environments but in dev that s just annoying

nice-eye-54931 · Answer

Especially since other programs can read out environment variables I don t wanna be setting it each time I run pulumi and placing in my profile is a bad idea imho

billowy-army-68599 · Answer

well today I learned I guess set it to changeme We cannot turn it off because we encrypt secrets inside the state and we need a key to encrypt it with Generally we recommend people only use passphrase for development environments and set it to an easy to remember value For production we recommend a cloud secrets provider like awskms or azurekms <https www pulumi com blog peace of mind with cloud secret providers >

billowy-army-68599 · Answer

i understand the concern about setting the values as environment variables but leaving secrets in plaintext is equally as unacceptable to us the passphrase mechanism is an option for quick development iteration

nice-eye-54931 · Answer

indeed I plan to use vault for this but on a local dev cluster that got me annoyed Maybe something extra in the docs would help there that would have prevented me from even trying

billowy-army-68599 · Answer

what would like to add to the docs to make it clearer

red-match-15116 · Answer

Hey Giovanni < billowy army 68599> is doing his best to help you Repeatedly calling our work annoying is not a great way to build trust so we continue to want to help you slightly smiling face

nice-eye-54931 · Answer

I didn t call your work annoying I said I got annoyed I didn t want to disrespect anybody

nice-eye-54931 · Answer

< billowy army 68599> There are no real guides in the docs on using the local backend `pulumi login local` and what the consequences and the best practices to follow there No information on how to use the PULUMI CONFIG PASSPHRASE FILE I had to restart 7 times deleting my pulumi folder once I know where it was because I tried setting the paraphrase to an empty value like ssh perfectly accepts which it happily accepted but then refusing to destroy the stack

nice-eye-54931 · Answer

That got me into searching how to set an environment var to an empty value which can t be done in Windows So either never accept an empty value as a paraphrase in the first place or accept it and bbe able to work with it That d be my advice

billowy-army-68599 · Answer

I ve opened to track this we do have the following links but it doesn t mention the passphrase portion so we ll try and improve this

nice-eye-54931 · Answer

Is accepting an empty paraphrase desirable As that would never work when later destroying the stack That s one of the first things I tried Will pulumi clean everything up like terraform does when I destroy it

billowy-army-68599 · Answer

what do you mean setting a passphrase to an empty string definitely works

broad-dog-22463 · Answer

Yes this definitely works I even added a test for this on our last release to make sure that it doesn t regress

nice-eye-54931 · Answer

Well I did hit it just now on Windows so either that test is not water tight or there is a bug Thing is that you cannot set an empty string to an environment variable

nice-eye-54931 · Answer

so the `pulumi up` works but then a `pulumi destroy s lt stackname gt ` fails saying it can t find the env variable as there isn t any

broad-dog-22463 · Answer

You should be able to use something like Cmd v c set PULUMI CONFIG PASSPHRASE= pulumi up and it ll set the env var in process This test is currently passing for us on windows the test where we do this is here <https github com pulumi pulumi pull 7019 files diff e26b69e905f24f969a12360b000fa75a1881737f03b4cf99d44585992e5b40ccR597|https github com pulumi pulumi pull 7019 files diff e26b69e905f24f969a12360b000fa75a1881737f03b4cf99d44585992e5b40ccR597>

broad-dog-22463 · Answer

Always happy to update this in our docs as part of the issue Lee opened above

nice-eye-54931 · Answer

hmmm cmd in powershell setting an empty string to an environment var deletes it

nice-eye-54931 · Answer

< broad dog 22463> adding that one liner to the docs those who want it might be useful since it doesn t work in powershell That distinction threw me off

broad-dog-22463 · Answer

The alternative for you would be to set a file on disk that s empty and use PULUMI CONFIG PASSPHRASE FILE to point to that empty file and your shell will respect that for sure

broad-dog-22463 · Answer

The file must exist of course

nice-eye-54931 · Answer

Yep that seems to work

nice-eye-54931 · Answer

I found nothing in the docs on PULUMI CONFIG PASSPHRASE FILE so I didn t try that

broad-dog-22463 · Answer

That s a complete miss then on our part I apologise for that and will get rectified

nice-eye-54931 · Answer

< broad dog 22463> Tnx that fixes my issue I can now have local dev deployments on my cluster with having to specify a paraphrase anywhere Perfect Of course in production I will use vault or something else to get that value

broad-dog-22463 · Answer

That s great news Glad we were able to point you in the right direction