{"record":{"id":"7d41947bced245ab","repo":"pulumi/pulumi","slug":"getting-stack-configuration-w-7d4194","errorCode":null,"errorMessage":"getting stack configuration: %w","messagePattern":"getting stack configuration: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/operations/refresh.go","lineNumber":242,"sourceCode":"\t\t\t\tcmdutil.Diag(),\n\t\t\t\tws,\n\t\t\t\tcmdBackend.DefaultLoginManager,\n\t\t\t\tstackName,\n\t\t\t\tcmdStack.OfferNew,\n\t\t\t\topts.Display,\n\t\t\t\tconfigFile,\n\t\t\t)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tif err := parseAndSaveConfigArray(ctx, cmdutil.Diag(), ws, s, configArray, path, configFile); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tcfg, sm, err := config.GetStackConfiguration(ctx, cmdutil.Diag(), ssml, s, proj, configFile, envOverrides)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"getting stack configuration: %w\", err)\n\t\t\t}\n\n\t\t\tm, err := metadata.GetUpdateMetadata(message, root, execKind, execAgent, false, cfg, cmd.Flags())\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"gathering environment metadata: %w\", err)\n\t\t\t}\n\t\t\tcmdutil.SetStringSpanAttributes(ctx, m.Environment)\n\n\t\t\tdecrypter := sm.Decrypter()\n\t\t\tencrypter := sm.Encrypter()\n\n\t\t\tstackName := s.Ref().Name().String()\n\t\t\t// Skip config validation when the program is not being run (the default for refresh),\n\t\t\t// or when explicitly requested via --skip-config-validation. This allows stacks with\n\t\t\t// missing or invalid config to be refreshed in scenarios such as ephemeral PR environments\n\t\t\t// where config may diverge between branches.\n\t\t\tif runProgram && !skipConfigValidation {\n\t\t\t\t// Running the program: validate the stack config (and apply project defaults).","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/operations/refresh.go#L224-L260","documentation":"During refresh setup, the CLI loads the stack's full configuration via config.GetStackConfiguration (project + stack config + secrets manager). If loading fails — bad config file, unreadable secrets provider, malformed Pulumi.yaml — the error is wrapped as \"getting stack configuration\" and the refresh aborts.","triggerScenarios":"Running `pulumi refresh` when the stack's config file is missing/corrupt, the secrets provider cannot be initialized (bad passphrase, inaccessible key vault), or Pulumi.yaml is invalid YAML/schema.","commonSituations":"Wrong PULUMI_CONFIG_PASSPHRASE in CI; secrets provider (e.g. Azure KV, AWS KMS) credentials expired; a malformed Pulumi.<stack>.yaml after a manual edit; running from a directory without Pulumi.yaml and no --config-file.","solutions":["Read the wrapped inner error: fix the specific file or secrets provider it names","Verify PULUMI_CONFIG_PASSPHRASE (or cloud credentials) is set correctly in the environment","Run `pulumi config` to confirm the stack config loads before refreshing","Validate Pulumi.yaml parses as YAML and matches the project schema"],"exampleFix":"// before (CI)\npulumi refresh\n// after (CI)\nexport PULUMI_CONFIG_PASSPHRASE=\"$SECRET\"\npulumi refresh","handlingStrategy":"try-catch","validationCode":"# pre-flight: confirm config loads before refresh\npulumi config || exit 1","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"getting stack configuration:\") {\n    // check secrets provider credentials and Pulumi.yaml before retrying\n}","preventionTips":["Export PULUMI_CONFIG_PASSPHRASE or cloud credentials in every environment that runs pulumi","Never hand-edit Pulumi.<stack>.yaml without validating with `pulumi config`","Run refresh from the project directory or pass --config-file explicitly"],"tags":["cli","refresh","config","secrets"],"backgroundTag":"stack-config-load-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}