Hi, we cannot get the secret config values working. In particular, we have the following config value, set like this:

pulumi config set --secret databaseServerPassword "abcdef"

In a stack, we have

var databaseServerPassword = config.RequireSecret("databaseServerPassword");
...
var database = new Database(...); // This works fine

return new AppService(
    resourcesPrefix,
    new AppServiceArgs
    {
        Name = resourcesPrefix,
        AppServicePlanId = appServicePlanId,
        ResourceGroupName = resourceGroupName,        
        ConnectionStrings =
        {
            new AppServiceConnectionStringArgs
            {
                Name = "Database",
                Type = "SQLAzure",
                Value = Output.Tuple(database.ServerName, database.Name, databaseServerPassword).Apply(t =>
                {
                    var (serverName, databaseName, databasePassword) = t;                    
                    return $"Data Source=tcp:{serverName}.<http://database.windows.net|database.windows.net>,1433;Initial Catalog={databaseName};User ID={databaseUsername}@{serverName};Password={databasePassword}";
                })
            }
        }
    }
);

The app service is created fine, but without the connection string. If we remove databaseServerPassword from Output.Tuple (and remove the corresponding variable from the connection string), it works fine. Is there a problem in the way we work with secrets/output?

Any update on this? I'm having issues as well. In particular

config.RequireSecret("<secret>")

returns a type of

Output<string>

which I can't seem to get at.

No update unfortunately, I still don't know what's wrong with this approach.

What secrets provider are you using?

If I understand correctly, the issue is that the

databaseServerPassword

can’t be used because it’s an

Output<string>

. This is as per https://www.pulumi.com/docs/intro/concepts/programming-model/#how-secrets-relate-to-outputs So

.Apply

needs to be used and the reference to the secret variable used within the apply. Here is some example code where the secret is used within the

.Apply

to create a resource group:

class MyStack : Stack
{
    public MyStack()
    {
        var config = new Pulumi.Config();
        var rgName = config.GetSecret("rgName"); 

        // Create an Azure Resource Group
        var resourceGroupName = rgName.Apply(rgn => {
            var rg = new ResourceGroup(rgn, new ResourceGroupArgs
            {
                Name = rgn,
            });
            return rg.Name;
        });

        var storageAccount = new Account("storage", new AccountArgs
        {
            ResourceGroupName = resourceGroupName,
            AccountReplicationType = "LRS",
            AccountTier = "Standard"
        });

        this.ResourceGroupName = resourceGroupName;
        this.ConnectionString = storageAccount.PrimaryConnectionString;

    }
    [Output] 
    public Output<string> ResourceGroupName { get; set; }
    [Output]
    public Output<string> ConnectionString { get; set; }
}

@witty-candle-66007 But we are using apply.

Yes. And I saw that but I thought it was because of how you were using the Apply. As it turns out your code is very close to this: https://github.com/pulumi/examples/blob/master/azure-cs-appservice/AppServiceStack.cs Do you have the same problem if you follow the pattern in the referenced example? Or if there are reasons for not following that pattern, can you share your code in full?