Question on ESC + GCP secrets: my Pulumi program creates a secret in GCP Secret Manager (a value it computes itself, e.g. from another resource), and I also have my ESC environment importing that same secret back via fn:open:gcp-secrets, so I can read it as config. How is the ordering supposed to work here? My stack's Pulumi.yaml links the ESC environment, so opening the environment (and evaluating that import) happens before the program runs, but the program is what creates the secret in the first place. On a first-ever deploy the secret doesn't exist yet, so opening the environment fails outright and the program never gets a chance to run and create it. Is there a recommended pattern for this, or do you just have to temporarily remove the import, deploy once, then add it back?

I'm unclear why you would need to put the value in an environment: If it's in the same program, don't you already have its value?

Does your program also create the secret version (i.e., add an actual value) or just the secret (the container that will hold the versions/values)?

Yes, i do have the created resource available without importing it via ESC env, But this would mean that some of my secrets are available in ESC(the predefined ones), and some(the dynamically created ones) are only available directly from GCP secret manager, what i was trying to do was keep ESC as the centralized place for all my secrets, so that i don't have to keep track of which ones are defined in GCP vs which ones are defined in ESC.

Unless the secret value is consumed by some other stack, there's no reason to put it in ESC.