Pulumi preview/up --diff for kubernetes resources does not display diffs of properties in the same level of nesting if one references a fully-encrypted resource by its name

Pulumi preview/up --diff does not display diffs of properties in the same level of nesting if one references a fully-encrypted resource by its name (or likely any other of its properties).

Expected behavior

If I change a deployment image I expect to see:

      ~ spec: {
          ~ template: {
              ~ spec: {
                  ~ containers: [
                      ~ [0]: {
                            ~ image: "oldimagename" => "newimagename"
                            }
                    ]
                }
            }
        }

Current behavior

If I change a deployment image I actually see:

    ~ kubernetes:apps/v1:Deployment: (update)
      ~ spec: {
          ~ template: {
              ~ spec: {
                  ~ containers: [
                      ~ [0]: {
                            }
                    ]
                }
            }
        }

Steps to reproduce

Create these resources

const secret = new Secret("secret", {
  stringData: {
    LALALA: pulumi.secret("lalalala"),
  },
})

const deployment = new Deployment("nginx", {
  metadata: {
    name: "nginx",
  },
  spec: {
    replicas: 1,
    selector: {
      matchLabels: { app: "nginx" },
    },
    template: {
      metadata: {
        labels: { app: "nginx" },
      },
      spec: {
        containers: [
          {
            envFrom: [
              {
                secretRef: { name: secret.metadata.name },
              },
            ],
            env: [
              {
                name: "LOLOLO",
                value: "lolololo",
              },
            ],
            name: "nginx",
            image: "nginx",
          },
        ],
      },
    },
  },
})

Then change "lolololo" to any other string. See that the preview diff does not contain useful info.

Then remove secretRef: { name: secret.metadata.name },. Apply the change. Then change the env var in the deployment again and see that the diff now displays correctly

Workaround

Wrap the “false” secrets in unsecret()

[lblackstone]

Sorry for the delay. This is still high on the priority list, and I expect to continue work on it soon.

[lblackstone]

@aaronlevy It’s still in progress, but my understanding is that you can use the unsecret() function around any .metadata.name reference to work around in the meantime.

The reason this is happening is fairly involved:

1. Pulumi’s k8s provider currently uses the last-applied-configuration annotation (issue #1659)
2. For Secret resources, we automatically encrypt inputs to avoid leaking sensitive values into the state and that annotation.
3. Any secret value in a map or array causes Pulumi to treat the entire map or array as secret since the ordering is indeterminate.
4. As a result of (3), If the last-applied-configuration annotation contains a secret value, then all of the other metadata is also marked as secret. This includes the .metadata.name property.
5. If another resource references the .metadata.name property, then it transitively becomes secret as well. This unfortunately leads to the poor diff behavior you’re seeing since every field in the spec map becomes a “secret”.