It appears that this line of code doesn’t work as expected https://github.com/pulumi/pulumi-kubernetes-operator/blob/master/pkg/controller/stack/stack_controller.go#L874 If I run a pulumi stack output I can see my secrets are redacted, but they are still in the clear in the stack status.

Hmmm we have a test for this...: https://github.com/pulumi/pulumi-kubernetes-operator/blob/master/test/stack_controller_test.go#L250

might this differ between s3 vs pulumi backend?