diff --git a/sdk/go/vault/ad/getAccessCredentials.go b/sdk/go/vault/ad/getAccessCredentials.go
index bd3aed028..3e4667651 100644
--- a/sdk/go/vault/ad/getAccessCredentials.go
+++ b/sdk/go/vault/ad/getAccessCredentials.go
@@ -54,14 +54,20 @@ type GetAccessCredentialsResult struct {
 
 func GetAccessCredentialsOutput(ctx *pulumi.Context, args GetAccessCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetAccessCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetAccessCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetAccessCredentialsResultOutput, error) {
 			args := v.(GetAccessCredentialsArgs)
-			r, err := GetAccessCredentials(ctx, &args, opts...)
-			var s GetAccessCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetAccessCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:ad/getAccessCredentials:getAccessCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetAccessCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetAccessCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetAccessCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetAccessCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/approle/getAuthBackendRoleId.go b/sdk/go/vault/approle/getAuthBackendRoleId.go
index fd82e5b4b..6dcc342f4 100644
--- a/sdk/go/vault/approle/getAuthBackendRoleId.go
+++ b/sdk/go/vault/approle/getAuthBackendRoleId.go
@@ -77,14 +77,20 @@ type GetAuthBackendRoleIdResult struct {
 
 func GetAuthBackendRoleIdOutput(ctx *pulumi.Context, args GetAuthBackendRoleIdOutputArgs, opts ...pulumi.InvokeOption) GetAuthBackendRoleIdResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetAuthBackendRoleIdResult, error) {
+		ApplyT(func(v interface{}) (GetAuthBackendRoleIdResultOutput, error) {
 			args := v.(GetAuthBackendRoleIdArgs)
-			r, err := GetAuthBackendRoleId(ctx, &args, opts...)
-			var s GetAuthBackendRoleIdResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetAuthBackendRoleIdResult
+			secret, err := ctx.InvokePackageRaw("vault:appRole/getAuthBackendRoleId:getAuthBackendRoleId", args, &rv, "", opts...)
+			if err != nil {
+				return GetAuthBackendRoleIdResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetAuthBackendRoleIdResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetAuthBackendRoleIdResultOutput), nil
+			}
+			return output, nil
 		}).(GetAuthBackendRoleIdResultOutput)
 }
 
diff --git a/sdk/go/vault/aws/getAccessCredentials.go b/sdk/go/vault/aws/getAccessCredentials.go
index 4dcba35ef..2cf71c394 100644
--- a/sdk/go/vault/aws/getAccessCredentials.go
+++ b/sdk/go/vault/aws/getAccessCredentials.go
@@ -81,14 +81,20 @@ type GetAccessCredentialsResult struct {
 
 func GetAccessCredentialsOutput(ctx *pulumi.Context, args GetAccessCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetAccessCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetAccessCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetAccessCredentialsResultOutput, error) {
 			args := v.(GetAccessCredentialsArgs)
-			r, err := GetAccessCredentials(ctx, &args, opts...)
-			var s GetAccessCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetAccessCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:aws/getAccessCredentials:getAccessCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetAccessCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetAccessCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetAccessCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetAccessCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/aws/getStaticAccessCredentials.go b/sdk/go/vault/aws/getStaticAccessCredentials.go
index ebb2640e8..973bd591d 100644
--- a/sdk/go/vault/aws/getStaticAccessCredentials.go
+++ b/sdk/go/vault/aws/getStaticAccessCredentials.go
@@ -41,14 +41,20 @@ type GetStaticAccessCredentialsResult struct {
 
 func GetStaticAccessCredentialsOutput(ctx *pulumi.Context, args GetStaticAccessCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetStaticAccessCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetStaticAccessCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetStaticAccessCredentialsResultOutput, error) {
 			args := v.(GetStaticAccessCredentialsArgs)
-			r, err := GetStaticAccessCredentials(ctx, &args, opts...)
-			var s GetStaticAccessCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetStaticAccessCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:aws/getStaticAccessCredentials:getStaticAccessCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetStaticAccessCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetStaticAccessCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetStaticAccessCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetStaticAccessCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/azure/getAccessCredentials.go b/sdk/go/vault/azure/getAccessCredentials.go
index 025123281..aeca766e0 100644
--- a/sdk/go/vault/azure/getAccessCredentials.go
+++ b/sdk/go/vault/azure/getAccessCredentials.go
@@ -131,14 +131,20 @@ type GetAccessCredentialsResult struct {
 
 func GetAccessCredentialsOutput(ctx *pulumi.Context, args GetAccessCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetAccessCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetAccessCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetAccessCredentialsResultOutput, error) {
 			args := v.(GetAccessCredentialsArgs)
-			r, err := GetAccessCredentials(ctx, &args, opts...)
-			var s GetAccessCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetAccessCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:azure/getAccessCredentials:getAccessCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetAccessCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetAccessCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetAccessCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetAccessCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/gcp/getAuthBackendRole.go b/sdk/go/vault/gcp/getAuthBackendRole.go
index f98516b2d..448d4d10e 100644
--- a/sdk/go/vault/gcp/getAuthBackendRole.go
+++ b/sdk/go/vault/gcp/getAuthBackendRole.go
@@ -162,14 +162,20 @@ type LookupAuthBackendRoleResult struct {
 
 func LookupAuthBackendRoleOutput(ctx *pulumi.Context, args LookupAuthBackendRoleOutputArgs, opts ...pulumi.InvokeOption) LookupAuthBackendRoleResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupAuthBackendRoleResult, error) {
+		ApplyT(func(v interface{}) (LookupAuthBackendRoleResultOutput, error) {
 			args := v.(LookupAuthBackendRoleArgs)
-			r, err := LookupAuthBackendRole(ctx, &args, opts...)
-			var s LookupAuthBackendRoleResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupAuthBackendRoleResult
+			secret, err := ctx.InvokePackageRaw("vault:gcp/getAuthBackendRole:getAuthBackendRole", args, &rv, "", opts...)
+			if err != nil {
+				return LookupAuthBackendRoleResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupAuthBackendRoleResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupAuthBackendRoleResultOutput), nil
+			}
+			return output, nil
 		}).(LookupAuthBackendRoleResultOutput)
 }
 
diff --git a/sdk/go/vault/generic/getSecret.go b/sdk/go/vault/generic/getSecret.go
index 85e0bcf99..f2959a951 100644
--- a/sdk/go/vault/generic/getSecret.go
+++ b/sdk/go/vault/generic/getSecret.go
@@ -136,14 +136,20 @@ type LookupSecretResult struct {
 
 func LookupSecretOutput(ctx *pulumi.Context, args LookupSecretOutputArgs, opts ...pulumi.InvokeOption) LookupSecretResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupSecretResult, error) {
+		ApplyT(func(v interface{}) (LookupSecretResultOutput, error) {
 			args := v.(LookupSecretArgs)
-			r, err := LookupSecret(ctx, &args, opts...)
-			var s LookupSecretResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupSecretResult
+			secret, err := ctx.InvokePackageRaw("vault:generic/getSecret:getSecret", args, &rv, "", opts...)
+			if err != nil {
+				return LookupSecretResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupSecretResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupSecretResultOutput), nil
+			}
+			return output, nil
 		}).(LookupSecretResultOutput)
 }
 
diff --git a/sdk/go/vault/getAuthBackend.go b/sdk/go/vault/getAuthBackend.go
index 9f3646332..10adbf42c 100644
--- a/sdk/go/vault/getAuthBackend.go
+++ b/sdk/go/vault/getAuthBackend.go
@@ -81,14 +81,20 @@ type LookupAuthBackendResult struct {
 
 func LookupAuthBackendOutput(ctx *pulumi.Context, args LookupAuthBackendOutputArgs, opts ...pulumi.InvokeOption) LookupAuthBackendResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupAuthBackendResult, error) {
+		ApplyT(func(v interface{}) (LookupAuthBackendResultOutput, error) {
 			args := v.(LookupAuthBackendArgs)
-			r, err := LookupAuthBackend(ctx, &args, opts...)
-			var s LookupAuthBackendResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupAuthBackendResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getAuthBackend:getAuthBackend", args, &rv, "", opts...)
+			if err != nil {
+				return LookupAuthBackendResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupAuthBackendResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupAuthBackendResultOutput), nil
+			}
+			return output, nil
 		}).(LookupAuthBackendResultOutput)
 }
 
diff --git a/sdk/go/vault/getAuthBackends.go b/sdk/go/vault/getAuthBackends.go
index da35d14d9..962c9efe4 100644
--- a/sdk/go/vault/getAuthBackends.go
+++ b/sdk/go/vault/getAuthBackends.go
@@ -93,14 +93,20 @@ type GetAuthBackendsResult struct {
 
 func GetAuthBackendsOutput(ctx *pulumi.Context, args GetAuthBackendsOutputArgs, opts ...pulumi.InvokeOption) GetAuthBackendsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetAuthBackendsResult, error) {
+		ApplyT(func(v interface{}) (GetAuthBackendsResultOutput, error) {
 			args := v.(GetAuthBackendsArgs)
-			r, err := GetAuthBackends(ctx, &args, opts...)
-			var s GetAuthBackendsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetAuthBackendsResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getAuthBackends:getAuthBackends", args, &rv, "", opts...)
+			if err != nil {
+				return GetAuthBackendsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetAuthBackendsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetAuthBackendsResultOutput), nil
+			}
+			return output, nil
 		}).(GetAuthBackendsResultOutput)
 }
 
diff --git a/sdk/go/vault/getNamespace.go b/sdk/go/vault/getNamespace.go
index 49da3620f..fc42e3e51 100644
--- a/sdk/go/vault/getNamespace.go
+++ b/sdk/go/vault/getNamespace.go
@@ -135,14 +135,20 @@ type LookupNamespaceResult struct {
 
 func LookupNamespaceOutput(ctx *pulumi.Context, args LookupNamespaceOutputArgs, opts ...pulumi.InvokeOption) LookupNamespaceResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupNamespaceResult, error) {
+		ApplyT(func(v interface{}) (LookupNamespaceResultOutput, error) {
 			args := v.(LookupNamespaceArgs)
-			r, err := LookupNamespace(ctx, &args, opts...)
-			var s LookupNamespaceResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupNamespaceResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getNamespace:getNamespace", args, &rv, "", opts...)
+			if err != nil {
+				return LookupNamespaceResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupNamespaceResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupNamespaceResultOutput), nil
+			}
+			return output, nil
 		}).(LookupNamespaceResultOutput)
 }
 
diff --git a/sdk/go/vault/getNamespaces.go b/sdk/go/vault/getNamespaces.go
index 54f1147bd..2cd80214e 100644
--- a/sdk/go/vault/getNamespaces.go
+++ b/sdk/go/vault/getNamespaces.go
@@ -65,14 +65,20 @@ type GetNamespacesResult struct {
 
 func GetNamespacesOutput(ctx *pulumi.Context, args GetNamespacesOutputArgs, opts ...pulumi.InvokeOption) GetNamespacesResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetNamespacesResult, error) {
+		ApplyT(func(v interface{}) (GetNamespacesResultOutput, error) {
 			args := v.(GetNamespacesArgs)
-			r, err := GetNamespaces(ctx, &args, opts...)
-			var s GetNamespacesResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetNamespacesResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getNamespaces:getNamespaces", args, &rv, "", opts...)
+			if err != nil {
+				return GetNamespacesResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetNamespacesResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetNamespacesResultOutput), nil
+			}
+			return output, nil
 		}).(GetNamespacesResultOutput)
 }
 
diff --git a/sdk/go/vault/getNomadAccessToken.go b/sdk/go/vault/getNomadAccessToken.go
index e7aaea1c3..b763a4f8e 100644
--- a/sdk/go/vault/getNomadAccessToken.go
+++ b/sdk/go/vault/getNomadAccessToken.go
@@ -101,14 +101,20 @@ type GetNomadAccessTokenResult struct {
 
 func GetNomadAccessTokenOutput(ctx *pulumi.Context, args GetNomadAccessTokenOutputArgs, opts ...pulumi.InvokeOption) GetNomadAccessTokenResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetNomadAccessTokenResult, error) {
+		ApplyT(func(v interface{}) (GetNomadAccessTokenResultOutput, error) {
 			args := v.(GetNomadAccessTokenArgs)
-			r, err := GetNomadAccessToken(ctx, &args, opts...)
-			var s GetNomadAccessTokenResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetNomadAccessTokenResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getNomadAccessToken:getNomadAccessToken", args, &rv, "", opts...)
+			if err != nil {
+				return GetNomadAccessTokenResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetNomadAccessTokenResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetNomadAccessTokenResultOutput), nil
+			}
+			return output, nil
 		}).(GetNomadAccessTokenResultOutput)
 }
 
diff --git a/sdk/go/vault/getPolicyDocument.go b/sdk/go/vault/getPolicyDocument.go
index 1ca4cf176..f1bf8f77c 100644
--- a/sdk/go/vault/getPolicyDocument.go
+++ b/sdk/go/vault/getPolicyDocument.go
@@ -85,14 +85,20 @@ type GetPolicyDocumentResult struct {
 
 func GetPolicyDocumentOutput(ctx *pulumi.Context, args GetPolicyDocumentOutputArgs, opts ...pulumi.InvokeOption) GetPolicyDocumentResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetPolicyDocumentResult, error) {
+		ApplyT(func(v interface{}) (GetPolicyDocumentResultOutput, error) {
 			args := v.(GetPolicyDocumentArgs)
-			r, err := GetPolicyDocument(ctx, &args, opts...)
-			var s GetPolicyDocumentResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetPolicyDocumentResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getPolicyDocument:getPolicyDocument", args, &rv, "", opts...)
+			if err != nil {
+				return GetPolicyDocumentResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetPolicyDocumentResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetPolicyDocumentResultOutput), nil
+			}
+			return output, nil
 		}).(GetPolicyDocumentResultOutput)
 }
 
diff --git a/sdk/go/vault/getRaftAutopilotState.go b/sdk/go/vault/getRaftAutopilotState.go
index 1ebc80630..911f1c4e8 100644
--- a/sdk/go/vault/getRaftAutopilotState.go
+++ b/sdk/go/vault/getRaftAutopilotState.go
@@ -85,14 +85,20 @@ type GetRaftAutopilotStateResult struct {
 
 func GetRaftAutopilotStateOutput(ctx *pulumi.Context, args GetRaftAutopilotStateOutputArgs, opts ...pulumi.InvokeOption) GetRaftAutopilotStateResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetRaftAutopilotStateResult, error) {
+		ApplyT(func(v interface{}) (GetRaftAutopilotStateResultOutput, error) {
 			args := v.(GetRaftAutopilotStateArgs)
-			r, err := GetRaftAutopilotState(ctx, &args, opts...)
-			var s GetRaftAutopilotStateResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetRaftAutopilotStateResult
+			secret, err := ctx.InvokePackageRaw("vault:index/getRaftAutopilotState:getRaftAutopilotState", args, &rv, "", opts...)
+			if err != nil {
+				return GetRaftAutopilotStateResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetRaftAutopilotStateResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetRaftAutopilotStateResultOutput), nil
+			}
+			return output, nil
 		}).(GetRaftAutopilotStateResultOutput)
 }
 
diff --git a/sdk/go/vault/identity/getEntity.go b/sdk/go/vault/identity/getEntity.go
index a548148bc..c57e895e3 100644
--- a/sdk/go/vault/identity/getEntity.go
+++ b/sdk/go/vault/identity/getEntity.go
@@ -113,14 +113,20 @@ type LookupEntityResult struct {
 
 func LookupEntityOutput(ctx *pulumi.Context, args LookupEntityOutputArgs, opts ...pulumi.InvokeOption) LookupEntityResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupEntityResult, error) {
+		ApplyT(func(v interface{}) (LookupEntityResultOutput, error) {
 			args := v.(LookupEntityArgs)
-			r, err := LookupEntity(ctx, &args, opts...)
-			var s LookupEntityResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupEntityResult
+			secret, err := ctx.InvokePackageRaw("vault:identity/getEntity:getEntity", args, &rv, "", opts...)
+			if err != nil {
+				return LookupEntityResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupEntityResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupEntityResultOutput), nil
+			}
+			return output, nil
 		}).(LookupEntityResultOutput)
 }
 
diff --git a/sdk/go/vault/identity/getGroup.go b/sdk/go/vault/identity/getGroup.go
index 4f3a3f2d2..c30ffd49f 100644
--- a/sdk/go/vault/identity/getGroup.go
+++ b/sdk/go/vault/identity/getGroup.go
@@ -125,14 +125,20 @@ type LookupGroupResult struct {
 
 func LookupGroupOutput(ctx *pulumi.Context, args LookupGroupOutputArgs, opts ...pulumi.InvokeOption) LookupGroupResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupGroupResult, error) {
+		ApplyT(func(v interface{}) (LookupGroupResultOutput, error) {
 			args := v.(LookupGroupArgs)
-			r, err := LookupGroup(ctx, &args, opts...)
-			var s LookupGroupResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupGroupResult
+			secret, err := ctx.InvokePackageRaw("vault:identity/getGroup:getGroup", args, &rv, "", opts...)
+			if err != nil {
+				return LookupGroupResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupGroupResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupGroupResultOutput), nil
+			}
+			return output, nil
 		}).(LookupGroupResultOutput)
 }
 
diff --git a/sdk/go/vault/identity/getOidcClientCreds.go b/sdk/go/vault/identity/getOidcClientCreds.go
index b6c11aaad..477288e6a 100644
--- a/sdk/go/vault/identity/getOidcClientCreds.go
+++ b/sdk/go/vault/identity/getOidcClientCreds.go
@@ -82,14 +82,20 @@ type GetOidcClientCredsResult struct {
 
 func GetOidcClientCredsOutput(ctx *pulumi.Context, args GetOidcClientCredsOutputArgs, opts ...pulumi.InvokeOption) GetOidcClientCredsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetOidcClientCredsResult, error) {
+		ApplyT(func(v interface{}) (GetOidcClientCredsResultOutput, error) {
 			args := v.(GetOidcClientCredsArgs)
-			r, err := GetOidcClientCreds(ctx, &args, opts...)
-			var s GetOidcClientCredsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetOidcClientCredsResult
+			secret, err := ctx.InvokePackageRaw("vault:identity/getOidcClientCreds:getOidcClientCreds", args, &rv, "", opts...)
+			if err != nil {
+				return GetOidcClientCredsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetOidcClientCredsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetOidcClientCredsResultOutput), nil
+			}
+			return output, nil
 		}).(GetOidcClientCredsResultOutput)
 }
 
diff --git a/sdk/go/vault/identity/getOidcOpenidConfig.go b/sdk/go/vault/identity/getOidcOpenidConfig.go
index f5a61998a..3bcb61ec2 100644
--- a/sdk/go/vault/identity/getOidcOpenidConfig.go
+++ b/sdk/go/vault/identity/getOidcOpenidConfig.go
@@ -124,14 +124,20 @@ type GetOidcOpenidConfigResult struct {
 
 func GetOidcOpenidConfigOutput(ctx *pulumi.Context, args GetOidcOpenidConfigOutputArgs, opts ...pulumi.InvokeOption) GetOidcOpenidConfigResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetOidcOpenidConfigResult, error) {
+		ApplyT(func(v interface{}) (GetOidcOpenidConfigResultOutput, error) {
 			args := v.(GetOidcOpenidConfigArgs)
-			r, err := GetOidcOpenidConfig(ctx, &args, opts...)
-			var s GetOidcOpenidConfigResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetOidcOpenidConfigResult
+			secret, err := ctx.InvokePackageRaw("vault:identity/getOidcOpenidConfig:getOidcOpenidConfig", args, &rv, "", opts...)
+			if err != nil {
+				return GetOidcOpenidConfigResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetOidcOpenidConfigResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetOidcOpenidConfigResultOutput), nil
+			}
+			return output, nil
 		}).(GetOidcOpenidConfigResultOutput)
 }
 
diff --git a/sdk/go/vault/identity/getOidcPublicKeys.go b/sdk/go/vault/identity/getOidcPublicKeys.go
index 010de707c..28c0437fb 100644
--- a/sdk/go/vault/identity/getOidcPublicKeys.go
+++ b/sdk/go/vault/identity/getOidcPublicKeys.go
@@ -101,14 +101,20 @@ type GetOidcPublicKeysResult struct {
 
 func GetOidcPublicKeysOutput(ctx *pulumi.Context, args GetOidcPublicKeysOutputArgs, opts ...pulumi.InvokeOption) GetOidcPublicKeysResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetOidcPublicKeysResult, error) {
+		ApplyT(func(v interface{}) (GetOidcPublicKeysResultOutput, error) {
 			args := v.(GetOidcPublicKeysArgs)
-			r, err := GetOidcPublicKeys(ctx, &args, opts...)
-			var s GetOidcPublicKeysResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetOidcPublicKeysResult
+			secret, err := ctx.InvokePackageRaw("vault:identity/getOidcPublicKeys:getOidcPublicKeys", args, &rv, "", opts...)
+			if err != nil {
+				return GetOidcPublicKeysResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetOidcPublicKeysResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetOidcPublicKeysResultOutput), nil
+			}
+			return output, nil
 		}).(GetOidcPublicKeysResultOutput)
 }
 
diff --git a/sdk/go/vault/kubernetes/getAuthBackendConfig.go b/sdk/go/vault/kubernetes/getAuthBackendConfig.go
index 96c6b28d1..8956cac4e 100644
--- a/sdk/go/vault/kubernetes/getAuthBackendConfig.go
+++ b/sdk/go/vault/kubernetes/getAuthBackendConfig.go
@@ -66,14 +66,20 @@ type LookupAuthBackendConfigResult struct {
 
 func LookupAuthBackendConfigOutput(ctx *pulumi.Context, args LookupAuthBackendConfigOutputArgs, opts ...pulumi.InvokeOption) LookupAuthBackendConfigResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupAuthBackendConfigResult, error) {
+		ApplyT(func(v interface{}) (LookupAuthBackendConfigResultOutput, error) {
 			args := v.(LookupAuthBackendConfigArgs)
-			r, err := LookupAuthBackendConfig(ctx, &args, opts...)
-			var s LookupAuthBackendConfigResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupAuthBackendConfigResult
+			secret, err := ctx.InvokePackageRaw("vault:kubernetes/getAuthBackendConfig:getAuthBackendConfig", args, &rv, "", opts...)
+			if err != nil {
+				return LookupAuthBackendConfigResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupAuthBackendConfigResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupAuthBackendConfigResultOutput), nil
+			}
+			return output, nil
 		}).(LookupAuthBackendConfigResultOutput)
 }
 
diff --git a/sdk/go/vault/kubernetes/getAuthBackendRole.go b/sdk/go/vault/kubernetes/getAuthBackendRole.go
index 24a8e2859..9773fff27 100644
--- a/sdk/go/vault/kubernetes/getAuthBackendRole.go
+++ b/sdk/go/vault/kubernetes/getAuthBackendRole.go
@@ -131,14 +131,20 @@ type LookupAuthBackendRoleResult struct {
 
 func LookupAuthBackendRoleOutput(ctx *pulumi.Context, args LookupAuthBackendRoleOutputArgs, opts ...pulumi.InvokeOption) LookupAuthBackendRoleResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupAuthBackendRoleResult, error) {
+		ApplyT(func(v interface{}) (LookupAuthBackendRoleResultOutput, error) {
 			args := v.(LookupAuthBackendRoleArgs)
-			r, err := LookupAuthBackendRole(ctx, &args, opts...)
-			var s LookupAuthBackendRoleResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupAuthBackendRoleResult
+			secret, err := ctx.InvokePackageRaw("vault:kubernetes/getAuthBackendRole:getAuthBackendRole", args, &rv, "", opts...)
+			if err != nil {
+				return LookupAuthBackendRoleResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupAuthBackendRoleResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupAuthBackendRoleResultOutput), nil
+			}
+			return output, nil
 		}).(LookupAuthBackendRoleResultOutput)
 }
 
diff --git a/sdk/go/vault/kubernetes/getServiceAccountToken.go b/sdk/go/vault/kubernetes/getServiceAccountToken.go
index df920f9c5..d215d7062 100644
--- a/sdk/go/vault/kubernetes/getServiceAccountToken.go
+++ b/sdk/go/vault/kubernetes/getServiceAccountToken.go
@@ -142,14 +142,20 @@ type GetServiceAccountTokenResult struct {
 
 func GetServiceAccountTokenOutput(ctx *pulumi.Context, args GetServiceAccountTokenOutputArgs, opts ...pulumi.InvokeOption) GetServiceAccountTokenResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetServiceAccountTokenResult, error) {
+		ApplyT(func(v interface{}) (GetServiceAccountTokenResultOutput, error) {
 			args := v.(GetServiceAccountTokenArgs)
-			r, err := GetServiceAccountToken(ctx, &args, opts...)
-			var s GetServiceAccountTokenResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetServiceAccountTokenResult
+			secret, err := ctx.InvokePackageRaw("vault:kubernetes/getServiceAccountToken:getServiceAccountToken", args, &rv, "", opts...)
+			if err != nil {
+				return GetServiceAccountTokenResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetServiceAccountTokenResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetServiceAccountTokenResultOutput), nil
+			}
+			return output, nil
 		}).(GetServiceAccountTokenResultOutput)
 }
 
diff --git a/sdk/go/vault/kv/getSecret.go b/sdk/go/vault/kv/getSecret.go
index 218e15259..2f0839a3e 100644
--- a/sdk/go/vault/kv/getSecret.go
+++ b/sdk/go/vault/kv/getSecret.go
@@ -116,14 +116,20 @@ type LookupSecretResult struct {
 
 func LookupSecretOutput(ctx *pulumi.Context, args LookupSecretOutputArgs, opts ...pulumi.InvokeOption) LookupSecretResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupSecretResult, error) {
+		ApplyT(func(v interface{}) (LookupSecretResultOutput, error) {
 			args := v.(LookupSecretArgs)
-			r, err := LookupSecret(ctx, &args, opts...)
-			var s LookupSecretResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupSecretResult
+			secret, err := ctx.InvokePackageRaw("vault:kv/getSecret:getSecret", args, &rv, "", opts...)
+			if err != nil {
+				return LookupSecretResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupSecretResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupSecretResultOutput), nil
+			}
+			return output, nil
 		}).(LookupSecretResultOutput)
 }
 
diff --git a/sdk/go/vault/kv/getSecretSubkeysV2.go b/sdk/go/vault/kv/getSecretSubkeysV2.go
index b49c7f580..2e845ca53 100644
--- a/sdk/go/vault/kv/getSecretSubkeysV2.go
+++ b/sdk/go/vault/kv/getSecretSubkeysV2.go
@@ -121,14 +121,20 @@ type GetSecretSubkeysV2Result struct {
 
 func GetSecretSubkeysV2Output(ctx *pulumi.Context, args GetSecretSubkeysV2OutputArgs, opts ...pulumi.InvokeOption) GetSecretSubkeysV2ResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetSecretSubkeysV2Result, error) {
+		ApplyT(func(v interface{}) (GetSecretSubkeysV2ResultOutput, error) {
 			args := v.(GetSecretSubkeysV2Args)
-			r, err := GetSecretSubkeysV2(ctx, &args, opts...)
-			var s GetSecretSubkeysV2Result
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetSecretSubkeysV2Result
+			secret, err := ctx.InvokePackageRaw("vault:kv/getSecretSubkeysV2:getSecretSubkeysV2", args, &rv, "", opts...)
+			if err != nil {
+				return GetSecretSubkeysV2ResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetSecretSubkeysV2ResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetSecretSubkeysV2ResultOutput), nil
+			}
+			return output, nil
 		}).(GetSecretSubkeysV2ResultOutput)
 }
 
diff --git a/sdk/go/vault/kv/getSecretV2.go b/sdk/go/vault/kv/getSecretV2.go
index 2892c5aba..e9ee4d7a6 100644
--- a/sdk/go/vault/kv/getSecretV2.go
+++ b/sdk/go/vault/kv/getSecretV2.go
@@ -129,14 +129,20 @@ type LookupSecretV2Result struct {
 
 func LookupSecretV2Output(ctx *pulumi.Context, args LookupSecretV2OutputArgs, opts ...pulumi.InvokeOption) LookupSecretV2ResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupSecretV2Result, error) {
+		ApplyT(func(v interface{}) (LookupSecretV2ResultOutput, error) {
 			args := v.(LookupSecretV2Args)
-			r, err := LookupSecretV2(ctx, &args, opts...)
-			var s LookupSecretV2Result
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupSecretV2Result
+			secret, err := ctx.InvokePackageRaw("vault:kv/getSecretV2:getSecretV2", args, &rv, "", opts...)
+			if err != nil {
+				return LookupSecretV2ResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupSecretV2ResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupSecretV2ResultOutput), nil
+			}
+			return output, nil
 		}).(LookupSecretV2ResultOutput)
 }
 
diff --git a/sdk/go/vault/kv/getSecretsList.go b/sdk/go/vault/kv/getSecretsList.go
index c3e9e9f67..8d7c7c74f 100644
--- a/sdk/go/vault/kv/getSecretsList.go
+++ b/sdk/go/vault/kv/getSecretsList.go
@@ -117,14 +117,20 @@ type GetSecretsListResult struct {
 
 func GetSecretsListOutput(ctx *pulumi.Context, args GetSecretsListOutputArgs, opts ...pulumi.InvokeOption) GetSecretsListResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetSecretsListResult, error) {
+		ApplyT(func(v interface{}) (GetSecretsListResultOutput, error) {
 			args := v.(GetSecretsListArgs)
-			r, err := GetSecretsList(ctx, &args, opts...)
-			var s GetSecretsListResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetSecretsListResult
+			secret, err := ctx.InvokePackageRaw("vault:kv/getSecretsList:getSecretsList", args, &rv, "", opts...)
+			if err != nil {
+				return GetSecretsListResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetSecretsListResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetSecretsListResultOutput), nil
+			}
+			return output, nil
 		}).(GetSecretsListResultOutput)
 }
 
diff --git a/sdk/go/vault/kv/getSecretsListV2.go b/sdk/go/vault/kv/getSecretsListV2.go
index 528c16676..58309d101 100644
--- a/sdk/go/vault/kv/getSecretsListV2.go
+++ b/sdk/go/vault/kv/getSecretsListV2.go
@@ -146,14 +146,20 @@ type GetSecretsListV2Result struct {
 
 func GetSecretsListV2Output(ctx *pulumi.Context, args GetSecretsListV2OutputArgs, opts ...pulumi.InvokeOption) GetSecretsListV2ResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetSecretsListV2Result, error) {
+		ApplyT(func(v interface{}) (GetSecretsListV2ResultOutput, error) {
 			args := v.(GetSecretsListV2Args)
-			r, err := GetSecretsListV2(ctx, &args, opts...)
-			var s GetSecretsListV2Result
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetSecretsListV2Result
+			secret, err := ctx.InvokePackageRaw("vault:kv/getSecretsListV2:getSecretsListV2", args, &rv, "", opts...)
+			if err != nil {
+				return GetSecretsListV2ResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetSecretsListV2ResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetSecretsListV2ResultOutput), nil
+			}
+			return output, nil
 		}).(GetSecretsListV2ResultOutput)
 }
 
diff --git a/sdk/go/vault/ldap/getDynamicCredentials.go b/sdk/go/vault/ldap/getDynamicCredentials.go
index d0ecbc9bf..efa1f1d37 100644
--- a/sdk/go/vault/ldap/getDynamicCredentials.go
+++ b/sdk/go/vault/ldap/getDynamicCredentials.go
@@ -45,14 +45,20 @@ type GetDynamicCredentialsResult struct {
 
 func GetDynamicCredentialsOutput(ctx *pulumi.Context, args GetDynamicCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetDynamicCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetDynamicCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetDynamicCredentialsResultOutput, error) {
 			args := v.(GetDynamicCredentialsArgs)
-			r, err := GetDynamicCredentials(ctx, &args, opts...)
-			var s GetDynamicCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetDynamicCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:ldap/getDynamicCredentials:getDynamicCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetDynamicCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetDynamicCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetDynamicCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetDynamicCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/ldap/getStaticCredentials.go b/sdk/go/vault/ldap/getStaticCredentials.go
index 24d97e62b..cd33fda1a 100644
--- a/sdk/go/vault/ldap/getStaticCredentials.go
+++ b/sdk/go/vault/ldap/getStaticCredentials.go
@@ -46,14 +46,20 @@ type GetStaticCredentialsResult struct {
 
 func GetStaticCredentialsOutput(ctx *pulumi.Context, args GetStaticCredentialsOutputArgs, opts ...pulumi.InvokeOption) GetStaticCredentialsResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetStaticCredentialsResult, error) {
+		ApplyT(func(v interface{}) (GetStaticCredentialsResultOutput, error) {
 			args := v.(GetStaticCredentialsArgs)
-			r, err := GetStaticCredentials(ctx, &args, opts...)
-			var s GetStaticCredentialsResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetStaticCredentialsResult
+			secret, err := ctx.InvokePackageRaw("vault:ldap/getStaticCredentials:getStaticCredentials", args, &rv, "", opts...)
+			if err != nil {
+				return GetStaticCredentialsResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetStaticCredentialsResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetStaticCredentialsResultOutput), nil
+			}
+			return output, nil
 		}).(GetStaticCredentialsResultOutput)
 }
 
diff --git a/sdk/go/vault/pkisecret/getBackendConfigEst.go b/sdk/go/vault/pkisecret/getBackendConfigEst.go
index 47f548ad8..a867be357 100644
--- a/sdk/go/vault/pkisecret/getBackendConfigEst.go
+++ b/sdk/go/vault/pkisecret/getBackendConfigEst.go
@@ -90,14 +90,20 @@ type LookupBackendConfigEstResult struct {
 
 func LookupBackendConfigEstOutput(ctx *pulumi.Context, args LookupBackendConfigEstOutputArgs, opts ...pulumi.InvokeOption) LookupBackendConfigEstResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (LookupBackendConfigEstResult, error) {
+		ApplyT(func(v interface{}) (LookupBackendConfigEstResultOutput, error) {
 			args := v.(LookupBackendConfigEstArgs)
-			r, err := LookupBackendConfigEst(ctx, &args, opts...)
-			var s LookupBackendConfigEstResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv LookupBackendConfigEstResult
+			secret, err := ctx.InvokePackageRaw("vault:pkiSecret/getBackendConfigEst:getBackendConfigEst", args, &rv, "", opts...)
+			if err != nil {
+				return LookupBackendConfigEstResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(LookupBackendConfigEstResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(LookupBackendConfigEstResultOutput), nil
+			}
+			return output, nil
 		}).(LookupBackendConfigEstResultOutput)
 }
 
diff --git a/sdk/go/vault/pkisecret/getBackendIssuer.go b/sdk/go/vault/pkisecret/getBackendIssuer.go
index b551247fa..7cbd05572 100644
--- a/sdk/go/vault/pkisecret/getBackendIssuer.go
+++ b/sdk/go/vault/pkisecret/getBackendIssuer.go
@@ -107,14 +107,20 @@ type GetBackendIssuerResult struct {
 
 func GetBackendIssuerOutput(ctx *pulumi.Context, args GetBackendIssuerOutputArgs, opts ...pulumi.InvokeOption) GetBackendIssuerResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetBackendIssuerResult, error) {
+		ApplyT(func(v interface{}) (GetBackendIssuerResultOutput, error) {
 			args := v.(GetBackendIssuerArgs)
-			r, err := GetBackendIssuer(ctx, &args, opts...)
-			var s GetBackendIssuerResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetBackendIssuerResult
+			secret, err := ctx.InvokePackageRaw("vault:pkiSecret/getBackendIssuer:getBackendIssuer", args, &rv, "", opts...)
+			if err != nil {
+				return GetBackendIssuerResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetBackendIssuerResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetBackendIssuerResultOutput), nil
+			}
+			return output, nil
 		}).(GetBackendIssuerResultOutput)
 }
 
diff --git a/sdk/go/vault/pkisecret/getBackendIssuers.go b/sdk/go/vault/pkisecret/getBackendIssuers.go
index 5030babd9..8235c2686 100644
--- a/sdk/go/vault/pkisecret/getBackendIssuers.go
+++ b/sdk/go/vault/pkisecret/getBackendIssuers.go
@@ -90,14 +90,20 @@ type GetBackendIssuersResult struct {
 
 func GetBackendIssuersOutput(ctx *pulumi.Context, args GetBackendIssuersOutputArgs, opts ...pulumi.InvokeOption) GetBackendIssuersResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetBackendIssuersResult, error) {
+		ApplyT(func(v interface{}) (GetBackendIssuersResultOutput, error) {
 			args := v.(GetBackendIssuersArgs)
-			r, err := GetBackendIssuers(ctx, &args, opts...)
-			var s GetBackendIssuersResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetBackendIssuersResult
+			secret, err := ctx.InvokePackageRaw("vault:pkiSecret/getBackendIssuers:getBackendIssuers", args, &rv, "", opts...)
+			if err != nil {
+				return GetBackendIssuersResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetBackendIssuersResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetBackendIssuersResultOutput), nil
+			}
+			return output, nil
 		}).(GetBackendIssuersResultOutput)
 }
 
diff --git a/sdk/go/vault/pkisecret/getBackendKey.go b/sdk/go/vault/pkisecret/getBackendKey.go
index 158eef260..295db4fd9 100644
--- a/sdk/go/vault/pkisecret/getBackendKey.go
+++ b/sdk/go/vault/pkisecret/getBackendKey.go
@@ -96,14 +96,20 @@ type GetBackendKeyResult struct {
 
 func GetBackendKeyOutput(ctx *pulumi.Context, args GetBackendKeyOutputArgs, opts ...pulumi.InvokeOption) GetBackendKeyResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetBackendKeyResult, error) {
+		ApplyT(func(v interface{}) (GetBackendKeyResultOutput, error) {
 			args := v.(GetBackendKeyArgs)
-			r, err := GetBackendKey(ctx, &args, opts...)
-			var s GetBackendKeyResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetBackendKeyResult
+			secret, err := ctx.InvokePackageRaw("vault:pkiSecret/getBackendKey:getBackendKey", args, &rv, "", opts...)
+			if err != nil {
+				return GetBackendKeyResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetBackendKeyResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetBackendKeyResultOutput), nil
+			}
+			return output, nil
 		}).(GetBackendKeyResultOutput)
 }
 
diff --git a/sdk/go/vault/pkisecret/getBackendKeys.go b/sdk/go/vault/pkisecret/getBackendKeys.go
index 8318bb906..1cecd27bb 100644
--- a/sdk/go/vault/pkisecret/getBackendKeys.go
+++ b/sdk/go/vault/pkisecret/getBackendKeys.go
@@ -90,14 +90,20 @@ type GetBackendKeysResult struct {
 
 func GetBackendKeysOutput(ctx *pulumi.Context, args GetBackendKeysOutputArgs, opts ...pulumi.InvokeOption) GetBackendKeysResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetBackendKeysResult, error) {
+		ApplyT(func(v interface{}) (GetBackendKeysResultOutput, error) {
 			args := v.(GetBackendKeysArgs)
-			r, err := GetBackendKeys(ctx, &args, opts...)
-			var s GetBackendKeysResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetBackendKeysResult
+			secret, err := ctx.InvokePackageRaw("vault:pkiSecret/getBackendKeys:getBackendKeys", args, &rv, "", opts...)
+			if err != nil {
+				return GetBackendKeysResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetBackendKeysResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetBackendKeysResultOutput), nil
+			}
+			return output, nil
 		}).(GetBackendKeysResultOutput)
 }
 
diff --git a/sdk/go/vault/transform/getDecode.go b/sdk/go/vault/transform/getDecode.go
index cd46ec39b..bf85cc643 100644
--- a/sdk/go/vault/transform/getDecode.go
+++ b/sdk/go/vault/transform/getDecode.go
@@ -122,14 +122,20 @@ type GetDecodeResult struct {
 
 func GetDecodeOutput(ctx *pulumi.Context, args GetDecodeOutputArgs, opts ...pulumi.InvokeOption) GetDecodeResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetDecodeResult, error) {
+		ApplyT(func(v interface{}) (GetDecodeResultOutput, error) {
 			args := v.(GetDecodeArgs)
-			r, err := GetDecode(ctx, &args, opts...)
-			var s GetDecodeResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetDecodeResult
+			secret, err := ctx.InvokePackageRaw("vault:transform/getDecode:getDecode", args, &rv, "", opts...)
+			if err != nil {
+				return GetDecodeResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetDecodeResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetDecodeResultOutput), nil
+			}
+			return output, nil
 		}).(GetDecodeResultOutput)
 }
 
diff --git a/sdk/go/vault/transform/getEncode.go b/sdk/go/vault/transform/getEncode.go
index 91d47c8d0..5d7f6bd16 100644
--- a/sdk/go/vault/transform/getEncode.go
+++ b/sdk/go/vault/transform/getEncode.go
@@ -126,14 +126,20 @@ type GetEncodeResult struct {
 
 func GetEncodeOutput(ctx *pulumi.Context, args GetEncodeOutputArgs, opts ...pulumi.InvokeOption) GetEncodeResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetEncodeResult, error) {
+		ApplyT(func(v interface{}) (GetEncodeResultOutput, error) {
 			args := v.(GetEncodeArgs)
-			r, err := GetEncode(ctx, &args, opts...)
-			var s GetEncodeResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetEncodeResult
+			secret, err := ctx.InvokePackageRaw("vault:transform/getEncode:getEncode", args, &rv, "", opts...)
+			if err != nil {
+				return GetEncodeResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetEncodeResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetEncodeResultOutput), nil
+			}
+			return output, nil
 		}).(GetEncodeResultOutput)
 }
 
diff --git a/sdk/go/vault/transit/getDecrypt.go b/sdk/go/vault/transit/getDecrypt.go
index f3160f463..2e0491a1f 100644
--- a/sdk/go/vault/transit/getDecrypt.go
+++ b/sdk/go/vault/transit/getDecrypt.go
@@ -74,14 +74,20 @@ type GetDecryptResult struct {
 
 func GetDecryptOutput(ctx *pulumi.Context, args GetDecryptOutputArgs, opts ...pulumi.InvokeOption) GetDecryptResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetDecryptResult, error) {
+		ApplyT(func(v interface{}) (GetDecryptResultOutput, error) {
 			args := v.(GetDecryptArgs)
-			r, err := GetDecrypt(ctx, &args, opts...)
-			var s GetDecryptResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetDecryptResult
+			secret, err := ctx.InvokePackageRaw("vault:transit/getDecrypt:getDecrypt", args, &rv, "", opts...)
+			if err != nil {
+				return GetDecryptResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetDecryptResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetDecryptResultOutput), nil
+			}
+			return output, nil
 		}).(GetDecryptResultOutput)
 }
 
diff --git a/sdk/go/vault/transit/getEncrypt.go b/sdk/go/vault/transit/getEncrypt.go
index d6be21398..6fc8fbcc6 100644
--- a/sdk/go/vault/transit/getEncrypt.go
+++ b/sdk/go/vault/transit/getEncrypt.go
@@ -48,14 +48,20 @@ type GetEncryptResult struct {
 
 func GetEncryptOutput(ctx *pulumi.Context, args GetEncryptOutputArgs, opts ...pulumi.InvokeOption) GetEncryptResultOutput {
 	return pulumi.ToOutputWithContext(context.Background(), args).
-		ApplyT(func(v interface{}) (GetEncryptResult, error) {
+		ApplyT(func(v interface{}) (GetEncryptResultOutput, error) {
 			args := v.(GetEncryptArgs)
-			r, err := GetEncrypt(ctx, &args, opts...)
-			var s GetEncryptResult
-			if r != nil {
-				s = *r
+			opts = internal.PkgInvokeDefaultOpts(opts)
+			var rv GetEncryptResult
+			secret, err := ctx.InvokePackageRaw("vault:transit/getEncrypt:getEncrypt", args, &rv, "", opts...)
+			if err != nil {
+				return GetEncryptResultOutput{}, err
 			}
-			return s, err
+
+			output := pulumi.ToOutput(rv).(GetEncryptResultOutput)
+			if secret {
+				return pulumi.ToSecret(output).(GetEncryptResultOutput), nil
+			}
+			return output, nil
 		}).(GetEncryptResultOutput)
 }
 
diff --git a/sdk/java/build.gradle b/sdk/java/build.gradle
index 6a3811c74..825e3dc58 100644
--- a/sdk/java/build.gradle
+++ b/sdk/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
     implementation("com.google.code.gson:gson:2.8.9")
-    implementation("com.pulumi:pulumi:0.15.0")
+    implementation("com.pulumi:pulumi:0.16.1")
 }
 
 task sourcesJar(type: Jar) {
diff --git a/sdk/nodejs/ad/getAccessCredentials.ts b/sdk/nodejs/ad/getAccessCredentials.ts
index 8d5488584..0cac72722 100644
--- a/sdk/nodejs/ad/getAccessCredentials.ts
+++ b/sdk/nodejs/ad/getAccessCredentials.ts
@@ -8,7 +8,6 @@ import * as utilities from "../utilities";
  * ## Example Usage
  */
 export function getAccessCredentials(args: GetAccessCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetAccessCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:ad/getAccessCredentials:getAccessCredentials", {
         "backend": args.backend,
@@ -68,7 +67,12 @@ export interface GetAccessCredentialsResult {
  * ## Example Usage
  */
 export function getAccessCredentialsOutput(args: GetAccessCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAccessCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getAccessCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:ad/getAccessCredentials:getAccessCredentials", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "role": args.role,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/approle/getAuthBackendRoleId.ts b/sdk/nodejs/approle/getAuthBackendRoleId.ts
index 102725c9e..8512a02eb 100644
--- a/sdk/nodejs/approle/getAuthBackendRoleId.ts
+++ b/sdk/nodejs/approle/getAuthBackendRoleId.ts
@@ -25,7 +25,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getAuthBackendRoleId(args: GetAuthBackendRoleIdArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendRoleIdResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:appRole/getAuthBackendRoleId:getAuthBackendRoleId", {
         "backend": args.backend,
@@ -93,7 +92,12 @@ export interface GetAuthBackendRoleIdResult {
  * ```
  */
 export function getAuthBackendRoleIdOutput(args: GetAuthBackendRoleIdOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendRoleIdResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackendRoleId(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:appRole/getAuthBackendRoleId:getAuthBackendRoleId", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "roleName": args.roleName,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/aws/getAccessCredentials.ts b/sdk/nodejs/aws/getAccessCredentials.ts
index a7d78fa33..81780ffdd 100644
--- a/sdk/nodejs/aws/getAccessCredentials.ts
+++ b/sdk/nodejs/aws/getAccessCredentials.ts
@@ -8,7 +8,6 @@ import * as utilities from "../utilities";
  * ## Example Usage
  */
 export function getAccessCredentials(args: GetAccessCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetAccessCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:aws/getAccessCredentials:getAccessCredentials", {
         "backend": args.backend,
@@ -111,7 +110,16 @@ export interface GetAccessCredentialsResult {
  * ## Example Usage
  */
 export function getAccessCredentialsOutput(args: GetAccessCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAccessCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getAccessCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:aws/getAccessCredentials:getAccessCredentials", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "region": args.region,
+        "role": args.role,
+        "roleArn": args.roleArn,
+        "ttl": args.ttl,
+        "type": args.type,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/aws/getStaticAccessCredentials.ts b/sdk/nodejs/aws/getStaticAccessCredentials.ts
index 266caa01c..58b6c621c 100644
--- a/sdk/nodejs/aws/getStaticAccessCredentials.ts
+++ b/sdk/nodejs/aws/getStaticAccessCredentials.ts
@@ -5,7 +5,6 @@ import * as pulumi from "@pulumi/pulumi";
 import * as utilities from "../utilities";
 
 export function getStaticAccessCredentials(args: GetStaticAccessCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetStaticAccessCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:aws/getStaticAccessCredentials:getStaticAccessCredentials", {
         "backend": args.backend,
@@ -38,7 +37,12 @@ export interface GetStaticAccessCredentialsResult {
     readonly secretKey: string;
 }
 export function getStaticAccessCredentialsOutput(args: GetStaticAccessCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetStaticAccessCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getStaticAccessCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:aws/getStaticAccessCredentials:getStaticAccessCredentials", {
+        "backend": args.backend,
+        "name": args.name,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/azure/getAccessCredentials.ts b/sdk/nodejs/azure/getAccessCredentials.ts
index 89f4a89ca..50006ee9f 100644
--- a/sdk/nodejs/azure/getAccessCredentials.ts
+++ b/sdk/nodejs/azure/getAccessCredentials.ts
@@ -27,7 +27,6 @@ import * as utilities from "../utilities";
  * are required to be set for: `subscriptionId`, `tenantId`, `environment`.
  */
 export function getAccessCredentials(args: GetAccessCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetAccessCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:azure/getAccessCredentials:getAccessCredentials", {
         "backend": args.backend,
@@ -172,7 +171,19 @@ export interface GetAccessCredentialsResult {
  * are required to be set for: `subscriptionId`, `tenantId`, `environment`.
  */
 export function getAccessCredentialsOutput(args: GetAccessCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAccessCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getAccessCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:azure/getAccessCredentials:getAccessCredentials", {
+        "backend": args.backend,
+        "environment": args.environment,
+        "maxCredValidationSeconds": args.maxCredValidationSeconds,
+        "namespace": args.namespace,
+        "numSecondsBetweenTests": args.numSecondsBetweenTests,
+        "numSequentialSuccesses": args.numSequentialSuccesses,
+        "role": args.role,
+        "subscriptionId": args.subscriptionId,
+        "tenantId": args.tenantId,
+        "validateCreds": args.validateCreds,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/gcp/getAuthBackendRole.ts b/sdk/nodejs/gcp/getAuthBackendRole.ts
index 9a1ded225..94f0e0a31 100644
--- a/sdk/nodejs/gcp/getAuthBackendRole.ts
+++ b/sdk/nodejs/gcp/getAuthBackendRole.ts
@@ -25,7 +25,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getAuthBackendRole(args: GetAuthBackendRoleArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendRoleResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:gcp/getAuthBackendRole:getAuthBackendRole", {
         "backend": args.backend,
@@ -237,7 +236,21 @@ export interface GetAuthBackendRoleResult {
  * ```
  */
 export function getAuthBackendRoleOutput(args: GetAuthBackendRoleOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendRoleResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackendRole(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:gcp/getAuthBackendRole:getAuthBackendRole", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "roleName": args.roleName,
+        "tokenBoundCidrs": args.tokenBoundCidrs,
+        "tokenExplicitMaxTtl": args.tokenExplicitMaxTtl,
+        "tokenMaxTtl": args.tokenMaxTtl,
+        "tokenNoDefaultPolicy": args.tokenNoDefaultPolicy,
+        "tokenNumUses": args.tokenNumUses,
+        "tokenPeriod": args.tokenPeriod,
+        "tokenPolicies": args.tokenPolicies,
+        "tokenTtl": args.tokenTtl,
+        "tokenType": args.tokenType,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/generic/getSecret.ts b/sdk/nodejs/generic/getSecret.ts
index 2e22b234c..54e93cda0 100644
--- a/sdk/nodejs/generic/getSecret.ts
+++ b/sdk/nodejs/generic/getSecret.ts
@@ -41,7 +41,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecret(args: GetSecretArgs, opts?: pulumi.InvokeOptions): Promise<GetSecretResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:generic/getSecret:getSecret", {
         "namespace": args.namespace,
@@ -158,7 +157,13 @@ export interface GetSecretResult {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretOutput(args: GetSecretOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretResult> {
-    return pulumi.output(args).apply((a: any) => getSecret(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:generic/getSecret:getSecret", {
+        "namespace": args.namespace,
+        "path": args.path,
+        "version": args.version,
+        "withLeaseStartTime": args.withLeaseStartTime,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getAuthBackend.ts b/sdk/nodejs/getAuthBackend.ts
index e9a163da3..6710508e5 100644
--- a/sdk/nodejs/getAuthBackend.ts
+++ b/sdk/nodejs/getAuthBackend.ts
@@ -17,7 +17,6 @@ import * as utilities from "./utilities";
  * ```
  */
 export function getAuthBackend(args: GetAuthBackendArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getAuthBackend:getAuthBackend", {
         "namespace": args.namespace,
@@ -94,7 +93,11 @@ export interface GetAuthBackendResult {
  * ```
  */
 export function getAuthBackendOutput(args: GetAuthBackendOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackend(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getAuthBackend:getAuthBackend", {
+        "namespace": args.namespace,
+        "path": args.path,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getAuthBackends.ts b/sdk/nodejs/getAuthBackends.ts
index 7de9d661a..64017ffc1 100644
--- a/sdk/nodejs/getAuthBackends.ts
+++ b/sdk/nodejs/getAuthBackends.ts
@@ -25,7 +25,6 @@ import * as utilities from "./utilities";
  */
 export function getAuthBackends(args?: GetAuthBackendsArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendsResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getAuthBackends:getAuthBackends", {
         "namespace": args.namespace,
@@ -89,7 +88,12 @@ export interface GetAuthBackendsResult {
  * ```
  */
 export function getAuthBackendsOutput(args?: GetAuthBackendsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendsResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackends(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getAuthBackends:getAuthBackends", {
+        "namespace": args.namespace,
+        "type": args.type,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getNamespace.ts b/sdk/nodejs/getNamespace.ts
index a024e1b61..a7962c56d 100644
--- a/sdk/nodejs/getNamespace.ts
+++ b/sdk/nodejs/getNamespace.ts
@@ -44,7 +44,6 @@ import * as utilities from "./utilities";
  */
 export function getNamespace(args?: GetNamespaceArgs, opts?: pulumi.InvokeOptions): Promise<GetNamespaceResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getNamespace:getNamespace", {
         "namespace": args.namespace,
@@ -137,7 +136,12 @@ export interface GetNamespaceResult {
  * ```
  */
 export function getNamespaceOutput(args?: GetNamespaceOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetNamespaceResult> {
-    return pulumi.output(args).apply((a: any) => getNamespace(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getNamespace:getNamespace", {
+        "namespace": args.namespace,
+        "path": args.path,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getNamespaces.ts b/sdk/nodejs/getNamespaces.ts
index 8ae5927d7..f5d70024d 100644
--- a/sdk/nodejs/getNamespaces.ts
+++ b/sdk/nodejs/getNamespaces.ts
@@ -35,7 +35,6 @@ import * as utilities from "./utilities";
  */
 export function getNamespaces(args?: GetNamespacesArgs, opts?: pulumi.InvokeOptions): Promise<GetNamespacesResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getNamespaces:getNamespaces", {
         "namespace": args.namespace,
@@ -98,7 +97,11 @@ export interface GetNamespacesResult {
  * ```
  */
 export function getNamespacesOutput(args?: GetNamespacesOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetNamespacesResult> {
-    return pulumi.output(args).apply((a: any) => getNamespaces(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getNamespaces:getNamespaces", {
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getNomadAccessToken.ts b/sdk/nodejs/getNomadAccessToken.ts
index c8dd5c24a..e85ee567a 100644
--- a/sdk/nodejs/getNomadAccessToken.ts
+++ b/sdk/nodejs/getNomadAccessToken.ts
@@ -32,7 +32,6 @@ import * as utilities from "./utilities";
  * ```
  */
 export function getNomadAccessToken(args: GetNomadAccessTokenArgs, opts?: pulumi.InvokeOptions): Promise<GetNomadAccessTokenResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getNomadAccessToken:getNomadAccessToken", {
         "backend": args.backend,
@@ -113,7 +112,12 @@ export interface GetNomadAccessTokenResult {
  * ```
  */
 export function getNomadAccessTokenOutput(args: GetNomadAccessTokenOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetNomadAccessTokenResult> {
-    return pulumi.output(args).apply((a: any) => getNomadAccessToken(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getNomadAccessToken:getNomadAccessToken", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "role": args.role,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getPolicyDocument.ts b/sdk/nodejs/getPolicyDocument.ts
index 6b5846a3b..5beca3a9e 100644
--- a/sdk/nodejs/getPolicyDocument.ts
+++ b/sdk/nodejs/getPolicyDocument.ts
@@ -36,7 +36,6 @@ import * as utilities from "./utilities";
  */
 export function getPolicyDocument(args?: GetPolicyDocumentArgs, opts?: pulumi.InvokeOptions): Promise<GetPolicyDocumentResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getPolicyDocument:getPolicyDocument", {
         "namespace": args.namespace,
@@ -96,7 +95,12 @@ export interface GetPolicyDocumentResult {
  * ```
  */
 export function getPolicyDocumentOutput(args?: GetPolicyDocumentOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetPolicyDocumentResult> {
-    return pulumi.output(args).apply((a: any) => getPolicyDocument(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getPolicyDocument:getPolicyDocument", {
+        "namespace": args.namespace,
+        "rules": args.rules,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/getRaftAutopilotState.ts b/sdk/nodejs/getRaftAutopilotState.ts
index 194fafa47..285771b73 100644
--- a/sdk/nodejs/getRaftAutopilotState.ts
+++ b/sdk/nodejs/getRaftAutopilotState.ts
@@ -21,7 +21,6 @@ import * as utilities from "./utilities";
  */
 export function getRaftAutopilotState(args?: GetRaftAutopilotStateArgs, opts?: pulumi.InvokeOptions): Promise<GetRaftAutopilotStateResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:index/getRaftAutopilotState:getRaftAutopilotState", {
         "namespace": args.namespace,
@@ -111,7 +110,11 @@ export interface GetRaftAutopilotStateResult {
  * ```
  */
 export function getRaftAutopilotStateOutput(args?: GetRaftAutopilotStateOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetRaftAutopilotStateResult> {
-    return pulumi.output(args).apply((a: any) => getRaftAutopilotState(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:index/getRaftAutopilotState:getRaftAutopilotState", {
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/identity/getEntity.ts b/sdk/nodejs/identity/getEntity.ts
index 198aa2112..da4d05a32 100644
--- a/sdk/nodejs/identity/getEntity.ts
+++ b/sdk/nodejs/identity/getEntity.ts
@@ -24,7 +24,6 @@ import * as utilities from "../utilities";
  */
 export function getEntity(args?: GetEntityArgs, opts?: pulumi.InvokeOptions): Promise<GetEntityResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:identity/getEntity:getEntity", {
         "aliasId": args.aliasId,
@@ -155,7 +154,16 @@ export interface GetEntityResult {
  * Use of this resource requires the `update` capability on `/identity/lookup/entity`.
  */
 export function getEntityOutput(args?: GetEntityOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetEntityResult> {
-    return pulumi.output(args).apply((a: any) => getEntity(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:identity/getEntity:getEntity", {
+        "aliasId": args.aliasId,
+        "aliasMountAccessor": args.aliasMountAccessor,
+        "aliasName": args.aliasName,
+        "entityId": args.entityId,
+        "entityName": args.entityName,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/identity/getGroup.ts b/sdk/nodejs/identity/getGroup.ts
index 650edf66d..ce649d687 100644
--- a/sdk/nodejs/identity/getGroup.ts
+++ b/sdk/nodejs/identity/getGroup.ts
@@ -22,7 +22,6 @@ import * as utilities from "../utilities";
  */
 export function getGroup(args?: GetGroupArgs, opts?: pulumi.InvokeOptions): Promise<GetGroupResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:identity/getGroup:getGroup", {
         "aliasId": args.aliasId,
@@ -177,7 +176,16 @@ export interface GetGroupResult {
  * Use of this resource requires the `create` capability on `/identity/lookup/group`.
  */
 export function getGroupOutput(args?: GetGroupOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetGroupResult> {
-    return pulumi.output(args).apply((a: any) => getGroup(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:identity/getGroup:getGroup", {
+        "aliasId": args.aliasId,
+        "aliasMountAccessor": args.aliasMountAccessor,
+        "aliasName": args.aliasName,
+        "groupId": args.groupId,
+        "groupName": args.groupName,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/identity/getOidcClientCreds.ts b/sdk/nodejs/identity/getOidcClientCreds.ts
index dbaa4e4cc..829270f4a 100644
--- a/sdk/nodejs/identity/getOidcClientCreds.ts
+++ b/sdk/nodejs/identity/getOidcClientCreds.ts
@@ -27,7 +27,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getOidcClientCreds(args: GetOidcClientCredsArgs, opts?: pulumi.InvokeOptions): Promise<GetOidcClientCredsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:identity/getOidcClientCreds:getOidcClientCreds", {
         "name": args.name,
@@ -95,7 +94,11 @@ export interface GetOidcClientCredsResult {
  * ```
  */
 export function getOidcClientCredsOutput(args: GetOidcClientCredsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetOidcClientCredsResult> {
-    return pulumi.output(args).apply((a: any) => getOidcClientCreds(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:identity/getOidcClientCreds:getOidcClientCreds", {
+        "name": args.name,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/identity/getOidcOpenidConfig.ts b/sdk/nodejs/identity/getOidcOpenidConfig.ts
index 9b206cc86..d64febe6c 100644
--- a/sdk/nodejs/identity/getOidcOpenidConfig.ts
+++ b/sdk/nodejs/identity/getOidcOpenidConfig.ts
@@ -38,7 +38,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getOidcOpenidConfig(args: GetOidcOpenidConfigArgs, opts?: pulumi.InvokeOptions): Promise<GetOidcOpenidConfigResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:identity/getOidcOpenidConfig:getOidcOpenidConfig", {
         "name": args.name,
@@ -158,7 +157,11 @@ export interface GetOidcOpenidConfigResult {
  * ```
  */
 export function getOidcOpenidConfigOutput(args: GetOidcOpenidConfigOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetOidcOpenidConfigResult> {
-    return pulumi.output(args).apply((a: any) => getOidcOpenidConfig(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:identity/getOidcOpenidConfig:getOidcOpenidConfig", {
+        "name": args.name,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/identity/getOidcPublicKeys.ts b/sdk/nodejs/identity/getOidcPublicKeys.ts
index f5846708a..5dbafdff7 100644
--- a/sdk/nodejs/identity/getOidcPublicKeys.ts
+++ b/sdk/nodejs/identity/getOidcPublicKeys.ts
@@ -38,7 +38,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getOidcPublicKeys(args: GetOidcPublicKeysArgs, opts?: pulumi.InvokeOptions): Promise<GetOidcPublicKeysResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:identity/getOidcPublicKeys:getOidcPublicKeys", {
         "name": args.name,
@@ -113,7 +112,11 @@ export interface GetOidcPublicKeysResult {
  * ```
  */
 export function getOidcPublicKeysOutput(args: GetOidcPublicKeysOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetOidcPublicKeysResult> {
-    return pulumi.output(args).apply((a: any) => getOidcPublicKeys(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:identity/getOidcPublicKeys:getOidcPublicKeys", {
+        "name": args.name,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kubernetes/getAuthBackendConfig.ts b/sdk/nodejs/kubernetes/getAuthBackendConfig.ts
index 89f741914..c49177bbb 100644
--- a/sdk/nodejs/kubernetes/getAuthBackendConfig.ts
+++ b/sdk/nodejs/kubernetes/getAuthBackendConfig.ts
@@ -11,7 +11,6 @@ import * as utilities from "../utilities";
  */
 export function getAuthBackendConfig(args?: GetAuthBackendConfigArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendConfigResult> {
     args = args || {};
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kubernetes/getAuthBackendConfig:getAuthBackendConfig", {
         "backend": args.backend,
@@ -96,7 +95,18 @@ export interface GetAuthBackendConfigResult {
  * information.
  */
 export function getAuthBackendConfigOutput(args?: GetAuthBackendConfigOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendConfigResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackendConfig(a, opts))
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kubernetes/getAuthBackendConfig:getAuthBackendConfig", {
+        "backend": args.backend,
+        "disableIssValidation": args.disableIssValidation,
+        "disableLocalCaJwt": args.disableLocalCaJwt,
+        "issuer": args.issuer,
+        "kubernetesCaCert": args.kubernetesCaCert,
+        "kubernetesHost": args.kubernetesHost,
+        "namespace": args.namespace,
+        "pemKeys": args.pemKeys,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kubernetes/getAuthBackendRole.ts b/sdk/nodejs/kubernetes/getAuthBackendRole.ts
index e25905603..6d96061bd 100644
--- a/sdk/nodejs/kubernetes/getAuthBackendRole.ts
+++ b/sdk/nodejs/kubernetes/getAuthBackendRole.ts
@@ -10,7 +10,6 @@ import * as utilities from "../utilities";
  * information.
  */
 export function getAuthBackendRole(args: GetAuthBackendRoleArgs, opts?: pulumi.InvokeOptions): Promise<GetAuthBackendRoleResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kubernetes/getAuthBackendRole:getAuthBackendRole", {
         "audience": args.audience,
@@ -197,7 +196,22 @@ export interface GetAuthBackendRoleResult {
  * information.
  */
 export function getAuthBackendRoleOutput(args: GetAuthBackendRoleOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetAuthBackendRoleResult> {
-    return pulumi.output(args).apply((a: any) => getAuthBackendRole(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kubernetes/getAuthBackendRole:getAuthBackendRole", {
+        "audience": args.audience,
+        "backend": args.backend,
+        "namespace": args.namespace,
+        "roleName": args.roleName,
+        "tokenBoundCidrs": args.tokenBoundCidrs,
+        "tokenExplicitMaxTtl": args.tokenExplicitMaxTtl,
+        "tokenMaxTtl": args.tokenMaxTtl,
+        "tokenNoDefaultPolicy": args.tokenNoDefaultPolicy,
+        "tokenNumUses": args.tokenNumUses,
+        "tokenPeriod": args.tokenPeriod,
+        "tokenPolicies": args.tokenPolicies,
+        "tokenTtl": args.tokenTtl,
+        "tokenType": args.tokenType,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kubernetes/getServiceAccountToken.ts b/sdk/nodejs/kubernetes/getServiceAccountToken.ts
index a143ad63d..e81d8b72d 100644
--- a/sdk/nodejs/kubernetes/getServiceAccountToken.ts
+++ b/sdk/nodejs/kubernetes/getServiceAccountToken.ts
@@ -50,7 +50,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getServiceAccountToken(args: GetServiceAccountTokenArgs, opts?: pulumi.InvokeOptions): Promise<GetServiceAccountTokenResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kubernetes/getServiceAccountToken:getServiceAccountToken", {
         "backend": args.backend,
@@ -185,7 +184,15 @@ export interface GetServiceAccountTokenResult {
  * ```
  */
 export function getServiceAccountTokenOutput(args: GetServiceAccountTokenOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetServiceAccountTokenResult> {
-    return pulumi.output(args).apply((a: any) => getServiceAccountToken(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kubernetes/getServiceAccountToken:getServiceAccountToken", {
+        "backend": args.backend,
+        "clusterRoleBinding": args.clusterRoleBinding,
+        "kubernetesNamespace": args.kubernetesNamespace,
+        "namespace": args.namespace,
+        "role": args.role,
+        "ttl": args.ttl,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kv/getSecret.ts b/sdk/nodejs/kv/getSecret.ts
index 2aa434db7..311b68d77 100644
--- a/sdk/nodejs/kv/getSecret.ts
+++ b/sdk/nodejs/kv/getSecret.ts
@@ -36,7 +36,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecret(args: GetSecretArgs, opts?: pulumi.InvokeOptions): Promise<GetSecretResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kv/getSecret:getSecret", {
         "namespace": args.namespace,
@@ -130,7 +129,11 @@ export interface GetSecretResult {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretOutput(args: GetSecretOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretResult> {
-    return pulumi.output(args).apply((a: any) => getSecret(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kv/getSecret:getSecret", {
+        "namespace": args.namespace,
+        "path": args.path,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kv/getSecretSubkeysV2.ts b/sdk/nodejs/kv/getSecretSubkeysV2.ts
index b9e00cc9d..ac1a8d672 100644
--- a/sdk/nodejs/kv/getSecretSubkeysV2.ts
+++ b/sdk/nodejs/kv/getSecretSubkeysV2.ts
@@ -38,7 +38,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretSubkeysV2(args: GetSecretSubkeysV2Args, opts?: pulumi.InvokeOptions): Promise<GetSecretSubkeysV2Result> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kv/getSecretSubkeysV2:getSecretSubkeysV2", {
         "depth": args.depth,
@@ -145,7 +144,14 @@ export interface GetSecretSubkeysV2Result {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretSubkeysV2Output(args: GetSecretSubkeysV2OutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretSubkeysV2Result> {
-    return pulumi.output(args).apply((a: any) => getSecretSubkeysV2(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kv/getSecretSubkeysV2:getSecretSubkeysV2", {
+        "depth": args.depth,
+        "mount": args.mount,
+        "name": args.name,
+        "namespace": args.namespace,
+        "version": args.version,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kv/getSecretV2.ts b/sdk/nodejs/kv/getSecretV2.ts
index 4a3a619fb..4c9f0322e 100644
--- a/sdk/nodejs/kv/getSecretV2.ts
+++ b/sdk/nodejs/kv/getSecretV2.ts
@@ -40,7 +40,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretV2(args: GetSecretV2Args, opts?: pulumi.InvokeOptions): Promise<GetSecretV2Result> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kv/getSecretV2:getSecretV2", {
         "mount": args.mount,
@@ -162,7 +161,13 @@ export interface GetSecretV2Result {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretV2Output(args: GetSecretV2OutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretV2Result> {
-    return pulumi.output(args).apply((a: any) => getSecretV2(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kv/getSecretV2:getSecretV2", {
+        "mount": args.mount,
+        "name": args.name,
+        "namespace": args.namespace,
+        "version": args.version,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kv/getSecretsList.ts b/sdk/nodejs/kv/getSecretsList.ts
index 36f32f358..e0bfd3f1b 100644
--- a/sdk/nodejs/kv/getSecretsList.ts
+++ b/sdk/nodejs/kv/getSecretsList.ts
@@ -41,7 +41,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretsList(args: GetSecretsListArgs, opts?: pulumi.InvokeOptions): Promise<GetSecretsListResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kv/getSecretsList:getSecretsList", {
         "namespace": args.namespace,
@@ -118,7 +117,11 @@ export interface GetSecretsListResult {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretsListOutput(args: GetSecretsListOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretsListResult> {
-    return pulumi.output(args).apply((a: any) => getSecretsList(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kv/getSecretsList:getSecretsList", {
+        "namespace": args.namespace,
+        "path": args.path,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/kv/getSecretsListV2.ts b/sdk/nodejs/kv/getSecretsListV2.ts
index c5e177c35..f77497297 100644
--- a/sdk/nodejs/kv/getSecretsListV2.ts
+++ b/sdk/nodejs/kv/getSecretsListV2.ts
@@ -54,7 +54,6 @@ import * as utilities from "../utilities";
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretsListV2(args: GetSecretsListV2Args, opts?: pulumi.InvokeOptions): Promise<GetSecretsListV2Result> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:kv/getSecretsListV2:getSecretsListV2", {
         "mount": args.mount,
@@ -157,7 +156,12 @@ export interface GetSecretsListV2Result {
  * Use of this resource requires the `read` capability on the given path.
  */
 export function getSecretsListV2Output(args: GetSecretsListV2OutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetSecretsListV2Result> {
-    return pulumi.output(args).apply((a: any) => getSecretsListV2(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:kv/getSecretsListV2:getSecretsListV2", {
+        "mount": args.mount,
+        "name": args.name,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/ldap/getDynamicCredentials.ts b/sdk/nodejs/ldap/getDynamicCredentials.ts
index 66a1441bc..67fecd181 100644
--- a/sdk/nodejs/ldap/getDynamicCredentials.ts
+++ b/sdk/nodejs/ldap/getDynamicCredentials.ts
@@ -5,7 +5,6 @@ import * as pulumi from "@pulumi/pulumi";
 import * as utilities from "../utilities";
 
 export function getDynamicCredentials(args: GetDynamicCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetDynamicCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:ldap/getDynamicCredentials:getDynamicCredentials", {
         "mount": args.mount,
@@ -42,7 +41,12 @@ export interface GetDynamicCredentialsResult {
     readonly username: string;
 }
 export function getDynamicCredentialsOutput(args: GetDynamicCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetDynamicCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getDynamicCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:ldap/getDynamicCredentials:getDynamicCredentials", {
+        "mount": args.mount,
+        "namespace": args.namespace,
+        "roleName": args.roleName,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/ldap/getStaticCredentials.ts b/sdk/nodejs/ldap/getStaticCredentials.ts
index 83c08bcc9..568136020 100644
--- a/sdk/nodejs/ldap/getStaticCredentials.ts
+++ b/sdk/nodejs/ldap/getStaticCredentials.ts
@@ -5,7 +5,6 @@ import * as pulumi from "@pulumi/pulumi";
 import * as utilities from "../utilities";
 
 export function getStaticCredentials(args: GetStaticCredentialsArgs, opts?: pulumi.InvokeOptions): Promise<GetStaticCredentialsResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:ldap/getStaticCredentials:getStaticCredentials", {
         "mount": args.mount,
@@ -43,7 +42,12 @@ export interface GetStaticCredentialsResult {
     readonly username: string;
 }
 export function getStaticCredentialsOutput(args: GetStaticCredentialsOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetStaticCredentialsResult> {
-    return pulumi.output(args).apply((a: any) => getStaticCredentials(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:ldap/getStaticCredentials:getStaticCredentials", {
+        "mount": args.mount,
+        "namespace": args.namespace,
+        "roleName": args.roleName,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/pkisecret/getBackendConfigEst.ts b/sdk/nodejs/pkisecret/getBackendConfigEst.ts
index 398cb0136..53bf881a6 100644
--- a/sdk/nodejs/pkisecret/getBackendConfigEst.ts
+++ b/sdk/nodejs/pkisecret/getBackendConfigEst.ts
@@ -24,7 +24,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getBackendConfigEst(args: GetBackendConfigEstArgs, opts?: pulumi.InvokeOptions): Promise<GetBackendConfigEstResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:pkiSecret/getBackendConfigEst:getBackendConfigEst", {
         "backend": args.backend,
@@ -111,7 +110,11 @@ export interface GetBackendConfigEstResult {
  * ```
  */
 export function getBackendConfigEstOutput(args: GetBackendConfigEstOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetBackendConfigEstResult> {
-    return pulumi.output(args).apply((a: any) => getBackendConfigEst(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:pkiSecret/getBackendConfigEst:getBackendConfigEst", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/pkisecret/getBackendIssuer.ts b/sdk/nodejs/pkisecret/getBackendIssuer.ts
index cd5bc8bf5..934bec6a6 100644
--- a/sdk/nodejs/pkisecret/getBackendIssuer.ts
+++ b/sdk/nodejs/pkisecret/getBackendIssuer.ts
@@ -30,7 +30,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getBackendIssuer(args: GetBackendIssuerArgs, opts?: pulumi.InvokeOptions): Promise<GetBackendIssuerResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:pkiSecret/getBackendIssuer:getBackendIssuer", {
         "backend": args.backend,
@@ -132,7 +131,12 @@ export interface GetBackendIssuerResult {
  * ```
  */
 export function getBackendIssuerOutput(args: GetBackendIssuerOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetBackendIssuerResult> {
-    return pulumi.output(args).apply((a: any) => getBackendIssuer(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:pkiSecret/getBackendIssuer:getBackendIssuer", {
+        "backend": args.backend,
+        "issuerRef": args.issuerRef,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/pkisecret/getBackendIssuers.ts b/sdk/nodejs/pkisecret/getBackendIssuers.ts
index 01ab5a43f..fa0a16e25 100644
--- a/sdk/nodejs/pkisecret/getBackendIssuers.ts
+++ b/sdk/nodejs/pkisecret/getBackendIssuers.ts
@@ -29,7 +29,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getBackendIssuers(args: GetBackendIssuersArgs, opts?: pulumi.InvokeOptions): Promise<GetBackendIssuersResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:pkiSecret/getBackendIssuers:getBackendIssuers", {
         "backend": args.backend,
@@ -103,7 +102,11 @@ export interface GetBackendIssuersResult {
  * ```
  */
 export function getBackendIssuersOutput(args: GetBackendIssuersOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetBackendIssuersResult> {
-    return pulumi.output(args).apply((a: any) => getBackendIssuers(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:pkiSecret/getBackendIssuers:getBackendIssuers", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/pkisecret/getBackendKey.ts b/sdk/nodejs/pkisecret/getBackendKey.ts
index 2dba781d8..299ea0e9f 100644
--- a/sdk/nodejs/pkisecret/getBackendKey.ts
+++ b/sdk/nodejs/pkisecret/getBackendKey.ts
@@ -30,7 +30,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getBackendKey(args: GetBackendKeyArgs, opts?: pulumi.InvokeOptions): Promise<GetBackendKeyResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:pkiSecret/getBackendKey:getBackendKey", {
         "backend": args.backend,
@@ -111,7 +110,12 @@ export interface GetBackendKeyResult {
  * ```
  */
 export function getBackendKeyOutput(args: GetBackendKeyOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetBackendKeyResult> {
-    return pulumi.output(args).apply((a: any) => getBackendKey(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:pkiSecret/getBackendKey:getBackendKey", {
+        "backend": args.backend,
+        "keyRef": args.keyRef,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/pkisecret/getBackendKeys.ts b/sdk/nodejs/pkisecret/getBackendKeys.ts
index a721ddd20..b5199edf3 100644
--- a/sdk/nodejs/pkisecret/getBackendKeys.ts
+++ b/sdk/nodejs/pkisecret/getBackendKeys.ts
@@ -29,7 +29,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getBackendKeys(args: GetBackendKeysArgs, opts?: pulumi.InvokeOptions): Promise<GetBackendKeysResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:pkiSecret/getBackendKeys:getBackendKeys", {
         "backend": args.backend,
@@ -103,7 +102,11 @@ export interface GetBackendKeysResult {
  * ```
  */
 export function getBackendKeysOutput(args: GetBackendKeysOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetBackendKeysResult> {
-    return pulumi.output(args).apply((a: any) => getBackendKeys(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:pkiSecret/getBackendKeys:getBackendKeys", {
+        "backend": args.backend,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/transform/getDecode.ts b/sdk/nodejs/transform/getDecode.ts
index b4124f494..ccfda7e32 100644
--- a/sdk/nodejs/transform/getDecode.ts
+++ b/sdk/nodejs/transform/getDecode.ts
@@ -40,7 +40,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getDecode(args: GetDecodeArgs, opts?: pulumi.InvokeOptions): Promise<GetDecodeResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:transform/getDecode:getDecode", {
         "batchInputs": args.batchInputs,
@@ -154,7 +153,18 @@ export interface GetDecodeResult {
  * ```
  */
 export function getDecodeOutput(args: GetDecodeOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetDecodeResult> {
-    return pulumi.output(args).apply((a: any) => getDecode(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:transform/getDecode:getDecode", {
+        "batchInputs": args.batchInputs,
+        "batchResults": args.batchResults,
+        "decodedValue": args.decodedValue,
+        "namespace": args.namespace,
+        "path": args.path,
+        "roleName": args.roleName,
+        "transformation": args.transformation,
+        "tweak": args.tweak,
+        "value": args.value,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/transform/getEncode.ts b/sdk/nodejs/transform/getEncode.ts
index 6670967cd..7fdc2d9fb 100644
--- a/sdk/nodejs/transform/getEncode.ts
+++ b/sdk/nodejs/transform/getEncode.ts
@@ -42,7 +42,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getEncode(args: GetEncodeArgs, opts?: pulumi.InvokeOptions): Promise<GetEncodeResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:transform/getEncode:getEncode", {
         "batchInputs": args.batchInputs,
@@ -158,7 +157,18 @@ export interface GetEncodeResult {
  * ```
  */
 export function getEncodeOutput(args: GetEncodeOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetEncodeResult> {
-    return pulumi.output(args).apply((a: any) => getEncode(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:transform/getEncode:getEncode", {
+        "batchInputs": args.batchInputs,
+        "batchResults": args.batchResults,
+        "encodedValue": args.encodedValue,
+        "namespace": args.namespace,
+        "path": args.path,
+        "roleName": args.roleName,
+        "transformation": args.transformation,
+        "tweak": args.tweak,
+        "value": args.value,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/transit/getDecrypt.ts b/sdk/nodejs/transit/getDecrypt.ts
index 7b57a0e7e..21e1ad7cc 100644
--- a/sdk/nodejs/transit/getDecrypt.ts
+++ b/sdk/nodejs/transit/getDecrypt.ts
@@ -21,7 +21,6 @@ import * as utilities from "../utilities";
  * ```
  */
 export function getDecrypt(args: GetDecryptArgs, opts?: pulumi.InvokeOptions): Promise<GetDecryptResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:transit/getDecrypt:getDecrypt", {
         "backend": args.backend,
@@ -78,7 +77,14 @@ export interface GetDecryptResult {
  * ```
  */
 export function getDecryptOutput(args: GetDecryptOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetDecryptResult> {
-    return pulumi.output(args).apply((a: any) => getDecrypt(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:transit/getDecrypt:getDecrypt", {
+        "backend": args.backend,
+        "ciphertext": args.ciphertext,
+        "context": args.context,
+        "key": args.key,
+        "namespace": args.namespace,
+    }, opts);
 }
 
 /**
diff --git a/sdk/nodejs/transit/getEncrypt.ts b/sdk/nodejs/transit/getEncrypt.ts
index d87a2c62e..2117dd4d6 100644
--- a/sdk/nodejs/transit/getEncrypt.ts
+++ b/sdk/nodejs/transit/getEncrypt.ts
@@ -8,7 +8,6 @@ import * as utilities from "../utilities";
  * This is a data source which can be used to encrypt plaintext using a Vault Transit key.
  */
 export function getEncrypt(args: GetEncryptArgs, opts?: pulumi.InvokeOptions): Promise<GetEncryptResult> {
-
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
     return pulumi.runtime.invoke("vault:transit/getEncrypt:getEncrypt", {
         "backend": args.backend,
@@ -55,7 +54,15 @@ export interface GetEncryptResult {
  * This is a data source which can be used to encrypt plaintext using a Vault Transit key.
  */
 export function getEncryptOutput(args: GetEncryptOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetEncryptResult> {
-    return pulumi.output(args).apply((a: any) => getEncrypt(a, opts))
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("vault:transit/getEncrypt:getEncrypt", {
+        "backend": args.backend,
+        "context": args.context,
+        "key": args.key,
+        "keyVersion": args.keyVersion,
+        "namespace": args.namespace,
+        "plaintext": args.plaintext,
+    }, opts);
 }
 
 /**