Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Packages
  2. Control Plane Provider
  3. API Docs
  4. getSecret
Control Plane v0.0.62 published on Wednesday, Jul 9, 2025 by pulumiverse
pulumiverse/pulumi-cpln

cpln.getSecret

Explore with Pulumi AI

cpln logo
Control Plane v0.0.62 published on Wednesday, Jul 9, 2025 by pulumiverse
pulumiverse/pulumi-cpln

    Use this data source to access information about a Secret within Control Plane.

    Required

    • name (String) Name of the secret.

    Outputs

    The following attributes are exported:

    • cpln_id (String) The ID, in GUID format, of the secret.
    • name (String) Name of the secret.
    • description (String) Description of the secret.
    • tags (Map of String) Key-value map of resource tags.
    • self_link (String) Full link to this resource. Can be referenced by other resources.
    • secret_link (String) Output used when linking a secret to an environment variable or volume, in the format: cpln://secret/SECRET_NAME.
    • dictionary_as_envs (Map of String) If a dictionary secret is defined, this output will be a key-value map in the following format: key = cpln://secret/SECRET_NAME.key.
    • aws (Block List, Max: 1) (see below) Reference Page.
    • azure_connector (Block List, Max: 1) (see below) Reference Page.
    • azure_sdk (String, Sensitive) JSON string containing the Docker secret. Reference Page.
    • dictionary (Map of String) List of unique key-value pairs. Reference Page.
    • docker (String, Sensitive) JSON string containing the Docker secret. Reference Page.
    • ecr (Block List, Max: 1) (see below).
    • gcp (String, Sensitive) JSON string containing the GCP secret. Reference Page
    • keypair (Block List, Max: 1) (see below) Reference Page.
    • nats_account (Block List, Max: 1) (see below) Reference Page.
    • opaque (Block List, Max: 1) (see below) Reference Page.
    • tls (Block List, Max: 1) (see below) Reference Page.
    • userpass (Block List, Max: 1) (see below) Reference Page.

    aws

    Optional:

    • access_key (String, Sensitive) Access Key provided by AWS.
    • role_arn (String) Role ARN provided by AWS.
    • secret_key (String, Sensitive) Secret Key provided by AWS.
    • external_id (String) AWS IAM Role External ID.

    azure_connector

    Optional:

    • code (String, Sensitive) Code/Key to authenticate to deployment URL.
    • url (String, Sensitive) Deployment URL.

    ecr

    Reference Page

    Optional:

    • access_key (String) Access Key provided by AWS.
    • repos (Set of String) List of ECR repositories.
    • role_arn (String) Role ARN provided by AWS.
    • secret_key (String, Sensitive) Secret Key provided by AWS.
    • external_id (String) AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

    keypair

    Optional:

    • passphrase (String, Sensitive) Passphrase for private key.
    • public_key (String) Public Key.
    • secret_key (String, Sensitive) Secret/Private Key.

    nats_account

    Required:

    • account_id (String) Account ID.
    • private_key (String) Private Key.

    opaque

    Optional:

    • encoding (String) Available encodings: plain, base64. Default: plain.
    • payload (String, Sensitive) Plain text or base64 encoded string. Use encoding attribute to specify encoding.

    tls

    Optional:

    • cert (String) Public Certificate.
    • chain (String) Chain Certificate.
    • key (String, Sensitive) Private Certificate.

    userpass

    Optional:

    • encoding (String) Available encodings: plain, base64. Default: plain.
    • password (String, Sensitive) Password.
    • username (String) Username.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cpln from "@pulumiverse/cpln";

export = async () => {
    const example = await cpln.getSecret({
        name: "example-secret-opaque",
    });
    return {
        "example-secret-payload": example.opaques?.payload,
    };
}

    import pulumi
import pulumi_cpln as cpln

example = cpln.get_secret(name="example-secret-opaque")
pulumi.export("example-secret-payload", example.opaques.payload)

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-cpln/sdk/go/cpln"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := cpln.LookupSecret(ctx, &cpln.LookupSecretArgs{
			Name: "example-secret-opaque",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("example-secret-payload", example.Opaques.Payload)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cpln = Pulumi.Cpln;

return await Deployment.RunAsync(() => 
{
    var example = Cpln.GetSecret.Invoke(new()
    {
        Name = "example-secret-opaque",
    });

    return new Dictionary<string, object?>
    {
        ["example-secret-payload"] = example.Apply(getSecretResult => getSecretResult.Opaques?.Payload),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cpln.CplnFunctions;
import com.pulumi.cpln.inputs.GetSecretArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = CplnFunctions.getSecret(GetSecretArgs.builder()
            .name("example-secret-opaque")
            .build());

        ctx.export("example-secret-payload", example.opaques().payload());
    }
}

    variables:
  example:
    fn::invoke:
      function: cpln:getSecret
      arguments:
        name: example-secret-opaque
outputs:
  example-secret-payload: ${example.opaques.payload}

    Using getSecret

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getSecret(args: GetSecretArgs, opts?: InvokeOptions): Promise<GetSecretResult>
function getSecretOutput(args: GetSecretOutputArgs, opts?: InvokeOptions): Output<GetSecretResult>
    def get_secret(aws: Optional[Sequence[GetSecretAw]] = None,
               azure_connectors: Optional[Sequence[GetSecretAzureConnector]] = None,
               ecrs: Optional[Sequence[GetSecretEcr]] = None,
               keypairs: Optional[Sequence[GetSecretKeypair]] = None,
               name: Optional[str] = None,
               nats_accounts: Optional[Sequence[GetSecretNatsAccount]] = None,
               opaques: Optional[Sequence[GetSecretOpaque]] = None,
               tls: Optional[Sequence[GetSecretTl]] = None,
               userpasses: Optional[Sequence[GetSecretUserpass]] = None,
               opts: Optional[InvokeOptions] = None) -> GetSecretResult
def get_secret_output(aws: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretAwArgs]]]] = None,
               azure_connectors: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretAzureConnectorArgs]]]] = None,
               ecrs: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretEcrArgs]]]] = None,
               keypairs: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretKeypairArgs]]]] = None,
               name: Optional[pulumi.Input[str]] = None,
               nats_accounts: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretNatsAccountArgs]]]] = None,
               opaques: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretOpaqueArgs]]]] = None,
               tls: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretTlArgs]]]] = None,
               userpasses: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretUserpassArgs]]]] = None,
               opts: Optional[InvokeOptions] = None) -> Output[GetSecretResult]
    func LookupSecret(ctx *Context, args *LookupSecretArgs, opts ...InvokeOption) (*LookupSecretResult, error)
func LookupSecretOutput(ctx *Context, args *LookupSecretOutputArgs, opts ...InvokeOption) LookupSecretResultOutput

    > Note: This function is named LookupSecret in the Go SDK.

    public static class GetSecret 
{
    public static Task<GetSecretResult> InvokeAsync(GetSecretArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretResult> Invoke(GetSecretInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)
public static Output<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)

    fn::invoke:
  function: cpln:index/getSecret:getSecret
  arguments:
    # arguments dictionary

    The following arguments are supported:

    getSecret Result

    The following output properties are available:

    Supporting Types

    GetSecretAw

    AccessKey string
    Access Key provided by AWS.
    ExternalId string
    AWS IAM Role External ID.
    RoleArn string
    Role ARN provided by AWS.
    SecretKey string
    Secret Key provided by AWS.
    AccessKey string
    Access Key provided by AWS.
    ExternalId string
    AWS IAM Role External ID.
    RoleArn string
    Role ARN provided by AWS.
    SecretKey string
    Secret Key provided by AWS.
    accessKey String
    Access Key provided by AWS.
    externalId String
    AWS IAM Role External ID.
    roleArn String
    Role ARN provided by AWS.
    secretKey String
    Secret Key provided by AWS.
    accessKey string
    Access Key provided by AWS.
    externalId string
    AWS IAM Role External ID.
    roleArn string
    Role ARN provided by AWS.
    secretKey string
    Secret Key provided by AWS.
    access_key str
    Access Key provided by AWS.
    external_id str
    AWS IAM Role External ID.
    role_arn str
    Role ARN provided by AWS.
    secret_key str
    Secret Key provided by AWS.
    accessKey String
    Access Key provided by AWS.
    externalId String
    AWS IAM Role External ID.
    roleArn String
    Role ARN provided by AWS.
    secretKey String
    Secret Key provided by AWS.

    GetSecretAzureConnector

    Code string
    Code/Key to authenticate to deployment URL.
    Url string
    Deployment URL.
    Code string
    Code/Key to authenticate to deployment URL.
    Url string
    Deployment URL.
    code String
    Code/Key to authenticate to deployment URL.
    url String
    Deployment URL.
    code string
    Code/Key to authenticate to deployment URL.
    url string
    Deployment URL.
    code str
    Code/Key to authenticate to deployment URL.
    url str
    Deployment URL.
    code String
    Code/Key to authenticate to deployment URL.
    url String
    Deployment URL.

    GetSecretEcr

    AccessKey string
    Access Key provided by AWS.
    Repos List<string>
    List of ECR repositories.
    RoleArn string
    Role ARN provided by AWS.
    SecretKey string
    Secret Key provided by AWS.
    ExternalId string
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
    AccessKey string
    Access Key provided by AWS.
    Repos []string
    List of ECR repositories.
    RoleArn string
    Role ARN provided by AWS.
    SecretKey string
    Secret Key provided by AWS.
    ExternalId string
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
    accessKey String
    Access Key provided by AWS.
    repos List<String>
    List of ECR repositories.
    roleArn String
    Role ARN provided by AWS.
    secretKey String
    Secret Key provided by AWS.
    externalId String
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
    accessKey string
    Access Key provided by AWS.
    repos string[]
    List of ECR repositories.
    roleArn string
    Role ARN provided by AWS.
    secretKey string
    Secret Key provided by AWS.
    externalId string
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
    access_key str
    Access Key provided by AWS.
    repos Sequence[str]
    List of ECR repositories.
    role_arn str
    Role ARN provided by AWS.
    secret_key str
    Secret Key provided by AWS.
    external_id str
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.
    accessKey String
    Access Key provided by AWS.
    repos List<String>
    List of ECR repositories.
    roleArn String
    Role ARN provided by AWS.
    secretKey String
    Secret Key provided by AWS.
    externalId String
    AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

    GetSecretKeypair

    Passphrase string
    Passphrase for private key.
    PublicKey string
    Public Key.
    SecretKey string
    Secret/Private Key.
    Passphrase string
    Passphrase for private key.
    PublicKey string
    Public Key.
    SecretKey string
    Secret/Private Key.
    passphrase String
    Passphrase for private key.
    publicKey String
    Public Key.
    secretKey String
    Secret/Private Key.
    passphrase string
    Passphrase for private key.
    publicKey string
    Public Key.
    secretKey string
    Secret/Private Key.
    passphrase str
    Passphrase for private key.
    public_key str
    Public Key.
    secret_key str
    Secret/Private Key.
    passphrase String
    Passphrase for private key.
    publicKey String
    Public Key.
    secretKey String
    Secret/Private Key.

    GetSecretNatsAccount

    AccountId string
    Account ID.
    PrivateKey string
    Private Key.
    AccountId string
    Account ID.
    PrivateKey string
    Private Key.
    accountId String
    Account ID.
    privateKey String
    Private Key.
    accountId string
    Account ID.
    privateKey string
    Private Key.
    account_id str
    Account ID.
    private_key str
    Private Key.
    accountId String
    Account ID.
    privateKey String
    Private Key.

    GetSecretOpaque

    Encoding string
    Available encodings: plain, base64. Default: plain.
    Payload string
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.
    Encoding string
    Available encodings: plain, base64. Default: plain.
    Payload string
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.
    encoding String
    Available encodings: plain, base64. Default: plain.
    payload String
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.
    encoding string
    Available encodings: plain, base64. Default: plain.
    payload string
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.
    encoding str
    Available encodings: plain, base64. Default: plain.
    payload str
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.
    encoding String
    Available encodings: plain, base64. Default: plain.
    payload String
    Plain text or base64 encoded string. Use encoding attribute to specify encoding.

    GetSecretTl

    Cert string
    Public Certificate.
    Chain string
    Chain Certificate.
    Key string
    Private Certificate.
    Cert string
    Public Certificate.
    Chain string
    Chain Certificate.
    Key string
    Private Certificate.
    cert String
    Public Certificate.
    chain String
    Chain Certificate.
    key String
    Private Certificate.
    cert string
    Public Certificate.
    chain string
    Chain Certificate.
    key string
    Private Certificate.
    cert str
    Public Certificate.
    chain str
    Chain Certificate.
    key str
    Private Certificate.
    cert String
    Public Certificate.
    chain String
    Chain Certificate.
    key String
    Private Certificate.

    GetSecretUserpass

    Encoding string
    Available encodings: plain, base64. Default: plain.
    Password string
    Password.
    Username string
    Username.
    Encoding string
    Available encodings: plain, base64. Default: plain.
    Password string
    Password.
    Username string
    Username.
    encoding String
    Available encodings: plain, base64. Default: plain.
    password String
    Password.
    username String
    Username.
    encoding string
    Available encodings: plain, base64. Default: plain.
    password string
    Password.
    username string
    Username.
    encoding str
    Available encodings: plain, base64. Default: plain.
    password str
    Password.
    username str
    Username.
    encoding String
    Available encodings: plain, base64. Default: plain.
    password String
    Password.
    username String
    Username.

    Package Details

    Repository
    cpln pulumiverse/pulumi-cpln
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cpln Terraform Provider.
    cpln logo
    Control Plane v0.0.62 published on Wednesday, Jul 9, 2025 by pulumiverse
    pulumiverse/pulumi-cpln