Control Plane v0.0.73, Oct 23 25

Control Plane v0.0.73 published on Thursday, Oct 23, 2025 by pulumiverse

pulumiverse/pulumi-cpln

cpln.getSecret

Control Plane v0.0.73 published on Thursday, Oct 23, 2025 by pulumiverse

Schema (JSON)

pulumiverse/pulumi-cpln

Required

name (String) Name of the secret.

Outputs

The following attributes are exported:

cpln_id (String) The ID, in GUID format, of the secret.
name (String) Name of the secret.
description (String) Description of the secret.
tags (Map of String) Key-value map of resource tags.
self_link (String) Full link to this resource. Can be referenced by other resources.
secret_link (String) Output used when linking a secret to an environment variable or volume, in the format: cpln://secret/SECRET_NAME.
dictionary_as_envs (Map of String) If a dictionary secret is defined, this output will be a key-value map in the following format: key = cpln://secret/SECRET_NAME.key.
aws (Block List, Max: 1) (see below) Reference Page.
azure_connector (Block List, Max: 1) (see below) Reference Page.
azure_sdk (String, Sensitive) JSON string containing the Docker secret. Reference Page.
dictionary (Map of String) List of unique key-value pairs. Reference Page.
docker (String, Sensitive) JSON string containing the Docker secret. Reference Page.
ecr (Block List, Max: 1) (see below).
gcp (String, Sensitive) JSON string containing the GCP secret. Reference Page
keypair (Block List, Max: 1) (see below) Reference Page.
nats_account (Block List, Max: 1) (see below) Reference Page.
opaque (Block List, Max: 1) (see below) Reference Page.
tls (Block List, Max: 1) (see below) Reference Page.
userpass (Block List, Max: 1) (see below) Reference Page.

`aws`

Optional:

access_key (String, Sensitive) Access Key provided by AWS.
role_arn (String) Role ARN provided by AWS.
secret_key (String, Sensitive) Secret Key provided by AWS.
external_id (String) AWS IAM Role External ID.

`azure_connector`

Optional:

code (String, Sensitive) Code/Key to authenticate to deployment URL.
url (String, Sensitive) Deployment URL.

`ecr`

Reference Page

Optional:

access_key (String) Access Key provided by AWS.
repos (Set of String) List of ECR repositories.
role_arn (String) Role ARN provided by AWS.
secret_key (String, Sensitive) Secret Key provided by AWS.
external_id (String) AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

`keypair`

Optional:

passphrase (String, Sensitive) Passphrase for private key.
public_key (String) Public Key.
secret_key (String, Sensitive) Secret/Private Key.

`nats_account`

Required:

account_id (String) Account ID.
private_key (String) Private Key.

`opaque`

Optional:

encoding (String) Available encodings: plain, base64. Default: plain.
payload (String, Sensitive) Plain text or base64 encoded string. Use encoding attribute to specify encoding.

`tls`

Optional:

cert (String) Public Certificate.
chain (String) Chain Certificate.
key (String, Sensitive) Private Certificate.

`userpass`

Optional:

encoding (String) Available encodings: plain, base64. Default: plain.
password (String, Sensitive) Password.
username (String) Username.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as cpln from "@pulumiverse/cpln";

export = async () => {
    const example = await cpln.getSecret({
        name: "example-secret-opaque",
    });
    return {
        "example-secret-payload": example.opaques?.payload,
    };
}

import pulumi
import pulumi_cpln as cpln

example = cpln.get_secret(name="example-secret-opaque")
pulumi.export("example-secret-payload", example.opaques.payload)

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-cpln/sdk/go/cpln"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := cpln.LookupSecret(ctx, &cpln.LookupSecretArgs{
			Name: "example-secret-opaque",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("example-secret-payload", example.Opaques.Payload)
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cpln = Pulumi.Cpln;

return await Deployment.RunAsync(() => 
{
    var example = Cpln.GetSecret.Invoke(new()
    {
        Name = "example-secret-opaque",
    });

    return new Dictionary<string, object?>
    {
        ["example-secret-payload"] = example.Apply(getSecretResult => getSecretResult.Opaques?.Payload),
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cpln.CplnFunctions;
import com.pulumi.cpln.inputs.GetSecretArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = CplnFunctions.getSecret(GetSecretArgs.builder()
            .name("example-secret-opaque")
            .build());

        ctx.export("example-secret-payload", example.opaques().payload());
    }
}

variables:
  example:
    fn::invoke:
      function: cpln:getSecret
      arguments:
        name: example-secret-opaque
outputs:
  example-secret-payload: ${example.opaques.payload}

Using getSecret

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getSecret(args: GetSecretArgs, opts?: InvokeOptions): Promise<GetSecretResult>
function getSecretOutput(args: GetSecretOutputArgs, opts?: InvokeOptions): Output<GetSecretResult>

def get_secret(aws: Optional[Sequence[GetSecretAw]] = None,
               azure_connectors: Optional[Sequence[GetSecretAzureConnector]] = None,
               ecrs: Optional[Sequence[GetSecretEcr]] = None,
               keypairs: Optional[Sequence[GetSecretKeypair]] = None,
               name: Optional[str] = None,
               nats_accounts: Optional[Sequence[GetSecretNatsAccount]] = None,
               opaques: Optional[Sequence[GetSecretOpaque]] = None,
               tls: Optional[Sequence[GetSecretTl]] = None,
               userpasses: Optional[Sequence[GetSecretUserpass]] = None,
               opts: Optional[InvokeOptions] = None) -> GetSecretResult
def get_secret_output(aws: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretAwArgs]]]] = None,
               azure_connectors: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretAzureConnectorArgs]]]] = None,
               ecrs: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretEcrArgs]]]] = None,
               keypairs: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretKeypairArgs]]]] = None,
               name: Optional[pulumi.Input[str]] = None,
               nats_accounts: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretNatsAccountArgs]]]] = None,
               opaques: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretOpaqueArgs]]]] = None,
               tls: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretTlArgs]]]] = None,
               userpasses: Optional[pulumi.Input[Sequence[pulumi.Input[GetSecretUserpassArgs]]]] = None,
               opts: Optional[InvokeOptions] = None) -> Output[GetSecretResult]

func LookupSecret(ctx *Context, args *LookupSecretArgs, opts ...InvokeOption) (*LookupSecretResult, error)
func LookupSecretOutput(ctx *Context, args *LookupSecretOutputArgs, opts ...InvokeOption) LookupSecretResultOutput

> Note: This function is named LookupSecret in the Go SDK.

public static class GetSecret 
{
    public static Task<GetSecretResult> InvokeAsync(GetSecretArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretResult> Invoke(GetSecretInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)
public static Output<GetSecretResult> getSecret(GetSecretArgs args, InvokeOptions options)

fn::invoke:
  function: cpln:index/getSecret:getSecret
  arguments:
    # arguments dictionary

The following arguments are supported:

Name string
Aws List<Pulumiverse.Cpln.Inputs.GetSecretAw>
AzureConnectors List<Pulumiverse.Cpln.Inputs.GetSecretAzureConnector>
Ecrs List<Pulumiverse.Cpln.Inputs.GetSecretEcr>
Keypairs List<Pulumiverse.Cpln.Inputs.GetSecretKeypair>
NatsAccounts List<Pulumiverse.Cpln.Inputs.GetSecretNatsAccount>
Opaques List<Pulumiverse.Cpln.Inputs.GetSecretOpaque>
Tls List<Pulumiverse.Cpln.Inputs.GetSecretTl>
Userpasses List<Pulumiverse.Cpln.Inputs.GetSecretUserpass>

Name string
Aws []GetSecretAw
AzureConnectors []GetSecretAzureConnector
Ecrs []GetSecretEcr
Keypairs []GetSecretKeypair
NatsAccounts []GetSecretNatsAccount
Opaques []GetSecretOpaque
Tls []GetSecretTl
Userpasses []GetSecretUserpass

name String
aws List<GetSecretAw>
azureConnectors List<GetSecretAzureConnector>
ecrs List<GetSecretEcr>
keypairs List<GetSecretKeypair>
natsAccounts List<GetSecretNatsAccount>
opaques List<GetSecretOpaque>
tls List<GetSecretTl>
userpasses List<GetSecretUserpass>

name string
aws GetSecretAw[]
azureConnectors GetSecretAzureConnector[]
ecrs GetSecretEcr[]
keypairs GetSecretKeypair[]
natsAccounts GetSecretNatsAccount[]
opaques GetSecretOpaque[]
tls GetSecretTl[]
userpasses GetSecretUserpass[]

name str
aws Sequence[GetSecretAw]
azure_connectors Sequence[GetSecretAzureConnector]
ecrs Sequence[GetSecretEcr]
keypairs Sequence[GetSecretKeypair]
nats_accounts Sequence[GetSecretNatsAccount]
opaques Sequence[GetSecretOpaque]
tls Sequence[GetSecretTl]
userpasses Sequence[GetSecretUserpass]

name String
aws List<Property Map>
azureConnectors List<Property Map>
ecrs List<Property Map>
keypairs List<Property Map>
natsAccounts List<Property Map>
opaques List<Property Map>
tls List<Property Map>
userpasses List<Property Map>

getSecret Result

The following output properties are available:

AzureSdk string
CplnId string
Description string
Dictionary Dictionary<string, string>
DictionaryAsEnvs Dictionary<string, string>
Docker string
Gcp string
Id string
Name string
SecretLink string
SelfLink string
Tags Dictionary<string, string>
Aws List<Pulumiverse.Cpln.Outputs.GetSecretAw>
AzureConnectors List<Pulumiverse.Cpln.Outputs.GetSecretAzureConnector>
Ecrs List<Pulumiverse.Cpln.Outputs.GetSecretEcr>
Keypairs List<Pulumiverse.Cpln.Outputs.GetSecretKeypair>
NatsAccounts List<Pulumiverse.Cpln.Outputs.GetSecretNatsAccount>
Opaques List<Pulumiverse.Cpln.Outputs.GetSecretOpaque>
Tls List<Pulumiverse.Cpln.Outputs.GetSecretTl>
Userpasses List<Pulumiverse.Cpln.Outputs.GetSecretUserpass>

AzureSdk string
CplnId string
Description string
Dictionary map[string]string
DictionaryAsEnvs map[string]string
Docker string
Gcp string
Id string
Name string
SecretLink string
SelfLink string
Tags map[string]string
Aws []GetSecretAw
AzureConnectors []GetSecretAzureConnector
Ecrs []GetSecretEcr
Keypairs []GetSecretKeypair
NatsAccounts []GetSecretNatsAccount
Opaques []GetSecretOpaque
Tls []GetSecretTl
Userpasses []GetSecretUserpass

azureSdk String
cplnId String
description String
dictionary Map<String,String>
dictionaryAsEnvs Map<String,String>
docker String
gcp String
id String
name String
secretLink String
selfLink String
tags Map<String,String>
aws List<GetSecretAw>
azureConnectors List<GetSecretAzureConnector>
ecrs List<GetSecretEcr>
keypairs List<GetSecretKeypair>
natsAccounts List<GetSecretNatsAccount>
opaques List<GetSecretOpaque>
tls List<GetSecretTl>
userpasses List<GetSecretUserpass>

azureSdk string
cplnId string
description string
dictionary {[key: string]: string}
dictionaryAsEnvs {[key: string]: string}
docker string
gcp string
id string
name string
secretLink string
selfLink string
tags {[key: string]: string}
aws GetSecretAw[]
azureConnectors GetSecretAzureConnector[]
ecrs GetSecretEcr[]
keypairs GetSecretKeypair[]
natsAccounts GetSecretNatsAccount[]
opaques GetSecretOpaque[]
tls GetSecretTl[]
userpasses GetSecretUserpass[]

azure_sdk str
cpln_id str
description str
dictionary Mapping[str, str]
dictionary_as_envs Mapping[str, str]
docker str
gcp str
id str
name str
secret_link str
self_link str
tags Mapping[str, str]
aws Sequence[GetSecretAw]
azure_connectors Sequence[GetSecretAzureConnector]
ecrs Sequence[GetSecretEcr]
keypairs Sequence[GetSecretKeypair]
nats_accounts Sequence[GetSecretNatsAccount]
opaques Sequence[GetSecretOpaque]
tls Sequence[GetSecretTl]
userpasses Sequence[GetSecretUserpass]

azureSdk String
cplnId String
description String
dictionary Map<String>
dictionaryAsEnvs Map<String>
docker String
gcp String
id String
name String
secretLink String
selfLink String
tags Map<String>
aws List<Property Map>
azureConnectors List<Property Map>
ecrs List<Property Map>
keypairs List<Property Map>
natsAccounts List<Property Map>
opaques List<Property Map>
tls List<Property Map>
userpasses List<Property Map>

Supporting Types

GetSecretAw

AccessKey string: Access Key provided by AWS.
ExternalId string: AWS IAM Role External ID.
RoleArn string: Role ARN provided by AWS.
SecretKey string: Secret Key provided by AWS.

AccessKey string: Access Key provided by AWS.
ExternalId string: AWS IAM Role External ID.
RoleArn string: Role ARN provided by AWS.
SecretKey string: Secret Key provided by AWS.

accessKey String: Access Key provided by AWS.
externalId String: AWS IAM Role External ID.
roleArn String: Role ARN provided by AWS.
secretKey String: Secret Key provided by AWS.

accessKey string: Access Key provided by AWS.
externalId string: AWS IAM Role External ID.
roleArn string: Role ARN provided by AWS.
secretKey string: Secret Key provided by AWS.

access_key str: Access Key provided by AWS.
external_id str: AWS IAM Role External ID.
role_arn str: Role ARN provided by AWS.
secret_key str: Secret Key provided by AWS.

accessKey String: Access Key provided by AWS.
externalId String: AWS IAM Role External ID.
roleArn String: Role ARN provided by AWS.
secretKey String: Secret Key provided by AWS.

GetSecretAzureConnector

Code string: Code/Key to authenticate to deployment URL.
Url string: Deployment URL.

Code string: Code/Key to authenticate to deployment URL.
Url string: Deployment URL.

code String: Code/Key to authenticate to deployment URL.
url String: Deployment URL.

code string: Code/Key to authenticate to deployment URL.
url string: Deployment URL.

code str: Code/Key to authenticate to deployment URL.
url str: Deployment URL.

code String: Code/Key to authenticate to deployment URL.
url String: Deployment URL.

GetSecretEcr

AccessKey string: Access Key provided by AWS.
Repos List<string>: List of ECR repositories.
RoleArn string: Role ARN provided by AWS.
SecretKey string: Secret Key provided by AWS.
ExternalId string: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

AccessKey string: Access Key provided by AWS.
Repos []string: List of ECR repositories.
RoleArn string: Role ARN provided by AWS.
SecretKey string: Secret Key provided by AWS.
ExternalId string: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

accessKey String: Access Key provided by AWS.
repos List<String>: List of ECR repositories.
roleArn String: Role ARN provided by AWS.
secretKey String: Secret Key provided by AWS.
externalId String: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

accessKey string: Access Key provided by AWS.
repos string[]: List of ECR repositories.
roleArn string: Role ARN provided by AWS.
secretKey string: Secret Key provided by AWS.
externalId string: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

access_key str: Access Key provided by AWS.
repos Sequence[str]: List of ECR repositories.
role_arn str: Role ARN provided by AWS.
secret_key str: Secret Key provided by AWS.
external_id str: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

accessKey String: Access Key provided by AWS.
repos List<String>: List of ECR repositories.
roleArn String: Role ARN provided by AWS.
secretKey String: Secret Key provided by AWS.
externalId String: AWS IAM Role External ID. Used when setting up cross-account access to your ECR repositories.

GetSecretKeypair

Passphrase string: Passphrase for private key.
PublicKey string: Public Key.
SecretKey string: Secret/Private Key.

Passphrase string: Passphrase for private key.
PublicKey string: Public Key.
SecretKey string: Secret/Private Key.

passphrase String: Passphrase for private key.
publicKey String: Public Key.
secretKey String: Secret/Private Key.

passphrase string: Passphrase for private key.
publicKey string: Public Key.
secretKey string: Secret/Private Key.

passphrase str: Passphrase for private key.
public_key str: Public Key.
secret_key str: Secret/Private Key.

passphrase String: Passphrase for private key.
publicKey String: Public Key.
secretKey String: Secret/Private Key.

GetSecretNatsAccount

AccountId string: Account ID.
PrivateKey string: Private Key.

AccountId string: Account ID.
PrivateKey string: Private Key.

accountId String: Account ID.
privateKey String: Private Key.

accountId string: Account ID.
privateKey string: Private Key.

account_id str: Account ID.
private_key str: Private Key.

accountId String: Account ID.
privateKey String: Private Key.

GetSecretOpaque

Encoding string: Available encodings: plain, base64. Default: plain.
Payload string: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

Encoding string: Available encodings: plain, base64. Default: plain.
Payload string: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

encoding String: Available encodings: plain, base64. Default: plain.
payload String: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

encoding string: Available encodings: plain, base64. Default: plain.
payload string: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

encoding str: Available encodings: plain, base64. Default: plain.
payload str: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

encoding String: Available encodings: plain, base64. Default: plain.
payload String: Plain text or base64 encoded string. Use encoding attribute to specify encoding.

GetSecretTl

Cert string: Public Certificate.
Chain string: Chain Certificate.
Key string: Private Certificate.

Cert string: Public Certificate.
Chain string: Chain Certificate.
Key string: Private Certificate.

cert String: Public Certificate.
chain String: Chain Certificate.
key String: Private Certificate.

cert string: Public Certificate.
chain string: Chain Certificate.
key string: Private Certificate.

cert str: Public Certificate.
chain str: Chain Certificate.
key str: Private Certificate.

cert String: Public Certificate.
chain String: Chain Certificate.
key String: Private Certificate.

GetSecretUserpass

Encoding string: Available encodings: plain, base64. Default: plain.
Password string: Password.
Username string: Username.

Encoding string: Available encodings: plain, base64. Default: plain.
Password string: Password.
Username string: Username.

encoding String: Available encodings: plain, base64. Default: plain.
password String: Password.
username String: Username.

encoding string: Available encodings: plain, base64. Default: plain.
password string: Password.
username string: Username.

encoding str: Available encodings: plain, base64. Default: plain.
password str: Password.
username str: Username.

encoding String: Available encodings: plain, base64. Default: plain.
password String: Password.
username String: Username.

Package Details

Repository: cpln pulumiverse/pulumi-cpln
License: Apache-2.0
Notes: This Pulumi package is based on the cpln Terraform Provider.

Control Plane v0.0.73 published on Thursday, Oct 23, 2025 by pulumiverse

Schema (JSON)

pulumiverse/pulumi-cpln

cpln.getSecret

On this page

On this page

Required

Outputs

`aws`

`azure_connector`

`ecr`

`keypair`

`nats_account`

`opaque`

`tls`

`userpass`

Example Usage

Using getSecret

getSecret Result

Supporting Types

GetSecretAw

GetSecretAzureConnector

GetSecretEcr

GetSecretKeypair

GetSecretNatsAccount

GetSecretOpaque

GetSecretTl

GetSecretUserpass

Package Details

On this page

On this page