Cannot specify secretObjects of SecretProviderClass that reference ASM values of integer type

[jfmeachum]

Describe the bug
A SecretProviderClass specifying a secretObject that references an integer value stored in an ASM Secret fails to create a K8s Secret.

To Reproduce

Steps to reproduce the behavior:

Given an ASM Secret will-fail with the following structure:

{
    "fails": 123
}

And a SecretProviderClass resource declaration:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: does-not-work
  namespace: example
spec:
  parameters:
    objects: |-
      - objectName: will-fail
        objectType: secretsmanager
        jmesPath:
        - path: fails
          objectAlias: fails
  provider: aws
  secretObjects:
  - data:
    - key: fails
      objectName: fails
    secretName: will-fail
    type: Opaque

Workloads that depend on the above will fail with the following error:

Failure getting secret values from provider type secretsmanager: Failed to fetch secret from all regions: will-fail

The inclusion of a jmesPath reference within .spec.parameters.objects causes this issue. The provider will succeed if the explicit reference to a key of an integer value is removed.

Expected behavior

Workload containers start and are able to consume the K8s Secret as well as access the CSI driver-managed volume data.

[jbct]

Hi jfmeachum. This was an intentional design decision, but we will flag this as an enhancement request.

[ajthyng]

@jbct Can you provide details on the basis for this intentional design decision? It feels very counter-intuitive.

[jbct]

Hi @ajthyng. The upstream Secret Store CSI Driver requires this to be returned as a byte array. Since there are numerous native JSON object types, some of which require binary encoding/correct native ordering, we made the intentional decision to restrict this to string values at this time. We recognize that this may not work for all customers and have noted this enhancement.

[Doc94]

Hi i has the same issue but my question is... the warning/error cannot be more detailed? i need to change the version to a OLD for know this was the error.