Refresh on Deployment Settings always shows a diff if there are secrets

[komalali]

The underlying deployment settings API does not return any secret values on GET. As a result, on refresh, there is always a diff as the secret values are replaced by the string secret. Subsequently, an update also shows a diff.

To work through this, we will likely need to implement an endpoint for deployment settings that returns the secret values.

[IaroslavTitov]

Investigating into this using this example resource:

var settings = new DeploymentSettings(
        "My Settings",
        new DeploymentSettingsArgs{
            Organization = "IaroslavTitov",
            Project = "PulumiDotnet",
            Stack = "SdkTest4",
            SourceContext = new DeploymentSettingsSourceContextArgs{
                Git = new DeploymentSettingsGitSourceArgs{
                    RepoUrl = "https://fake-test.com",
                    Branch = "test",
                    GitAuth = new DeploymentSettingsGitSourceGitAuthArgs {
                        BasicAuth = new DeploymentSettingsGitAuthBasicAuthArgs{
                            Username = "IaroTest",
                            Password = "IaroTest"
                        }
                    }
                }
            }
        }
    );

Git login into are secrets.
Pulumi up succeeds, and I can see secrets in the console like so:

"password": {
       "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
       "ciphertext": "AAABAAT6I4md3+xjlqIQf1Lntt+R9PomYXFZdg2RSViuWP2CWEw3k5QN"
     },
     "username": {
       "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
       "ciphertext": "AAABABfTbRhhdObvZTKqcY0wxObHcONld3QOXZz1GzdhNASu401yqEdi"
     }

When I do pulumi refresh, it wants to update agentPooId and sourceContext, and result looks like this

      "basicAuth": {
        "password": {},
        "username": {}
      }

So Read operation breaks these secrets, which is why pulumi up shows diff and actually fails after that, failing to read empty object where it expected a string or a secret.

[IaroslavTitov]

Had a meeting to discuss this issue, review design doc and agreed on a gameplan described in the doc. Will proceed with implementation.

[IaroslavTitov]

Create this issue https://github.com/pulumi/pulumi-service/issues/19990 for first part of the plan. I will use this issue for tracking change in PSP itself.

[IaroslavTitov]

Created Sub-issue #299

PRs necessary for next step:
https://github.com/pulumi/pulumi-service/pull/20116
#298

[IaroslavTitov]

Finally merged in the last part, resolving!