Allow Python dynamic providers to capture secrets

[justinvp]

As of #13315 (which shipped in v3.75.0), __provider (the serialized provider string) is always set to a secret in the state. This can lead to poor performance when there are a lot of dynamic resources and the serialized provider does not actually have any secrets.

This change allows Outputs to be captured during serialization of the provider, which wasn't previously possible.

Additionally, a new attribute, auto_secret, can be set on the ResourceProvider subclass to opt-in to automatically determining the secretness based on whether any secret Outputs were captured during serialization of the provider. auto_secret is False by default, which makes __provider always a secret (current behavior). If set to True, __provider will only be a secret if secret Outputs were captured during serialization of the provider.

Setting auto_secret to True aligns Python dynamic providers with Node.js.

import pulumi
from pulumi.dynamic import CreateResult, Resource, ResourceProvider

config = pulumi.Config()
password = config.require_secret("password")

class SimpleProvider(ResourceProvider):
    auto_secret = True

    def create(self, props):
        # Need to use `password.get()` to get the underlying value of the secret from within the serialized code.
        # This simulates using this as a credential to talk to an external system.
        return CreateResult("0", { "authenticated": "200" if password.get() == "s3cret" else "401" })

class SimpleResource(Resource):
    authenticated: pulumi.Output[str]

    def __init__(self, name):
        super().__init__(SimpleProvider(), name, { "authenticated": None })


r = SimpleResource("foo")
pulumi.export("out", r.authenticated)

Fixes #15539

[pulumi-bot]

Changelog

[uncommitted] (2024-04-04)

Features

• [sdk/python] Allow Python dynamic providers to capture secrets
  #15864

[justinvp]

One thing I still want to check is the behavior when there are unknowns, i.e. check the Node.js behavior and match that.