I have a fun one. I have an extension to domain join a VM. This requires a domain admin password. I do not want that stored in my config (even as a secret) as it is too sensitive to put there. Storing as an environment variable also seems like a bad idea. Is there a way to prompt the user for that credential only if the resource needs to be created? I have not really tried anything yet as I wanted to see if this was something I should even attempt or if there is a better pattern for this!