I'm running into a python pulumi oddity. I'm rendering a jinja template with variables that are pulumi secrets ie of type pulumi.Output[str] and base64ing it to be used by a user_data field.

user_data=pulumi.Output.all(
    {
        "cluster_size": cluster_size,
        "secret_id": secret_id,
    }
).apply(
    lambda args: render_user_data_output(
        templating_env(),
        "userdata-server.sh.jinja",
        *args,
    )
),

Now for the weird part. If render_user_data_output returns a string, I get a base64 encoded pulumi object address in memory. If it returns a pulumi Output, then it renders the base64 encoded secret. Both versions defined below

def render_user_data_output(
        env: Environment, template_name: str, kwargs: Mapping[str, Any]
) -> str:
    rendered_template = render_template_file(env, template_name, kwargs)
    return base64.b64encode(rendered_template.encode("utf-8")).decode("utf-8")

def render_user_data_output(
        env: Environment, template_name: str, kwargs: Mapping[str, Any]
) -> pulumi.Output:
    rendered_template = render_template_file(env, template_name, kwargs)
    return pulumi.Output.from_input(base64.b64encode(rendered_template.encode("utf-8")).decode("utf-8"))

Does anyone know what's going on here?

just to make sure, the version returning

pulumi.Output

works as expected?

Yep

is

render_template_file

defined by you?

Yep, 1 minute