No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Found the issue. If you pass the secrets provider in the LocalWorkspaceOptions parameter, it does in fact delete the encryption key (??).

You’ll need to provide it in both the workspace options and stack settings

<https://github.com/pulumi/automation-api-examples/blob/main/nodejs/inlineSecretsProvider-ts/index.ts#L75-L98>

<@U01038HJ93R> Er, sorry if I was unclear. What I'm saying is that if you call `LocalWorkspace.selectStack()` and pass in the secrets provider at all, it will _remove_ the existing encryption key from the stack file.

I resolved the issue by only passing in the secrets provider when doing `LocalWorkspace.createStack()`, and not passing it when doing `LocalWorkspace.selectStack()`.

However because of this, it looks like secrets encryption is broken if you try to use `LocalWorkspace.createOrSelectStack()`

Ah, got it. That is certainly non-ideal. Could you please open an issue?