search

aws / secrets-store-csi-driver-provider-aws

The AWS provider for the Secrets Store CSI Driver allows you to fetch secrets from AWS Secrets Manager and AWS Systems Manager Parameter Store, and mount them into Kubernetes pods.
Apache License 2.0
438 stars 123 forks source link

Please consider changing the object parameter format. #339

Closed johncuyle closed 2 months ago

johncuyle commented 3 months ago

The object parameter's format is a constant headache to work with. It looks like yaml encoded as a string but the yaml-like format in the string is non-conformant. Neither yq nor PyYaml nor ruamel yaml seem to be able to be coerced into outputting JUST the children of jmesPath in '""' quote format while forcing unnecessary double quotes around the objectName/Type/Alias. Manually constructing a string is also a huge headache due to the tabbing/spacing requirements.

Recommendations:

Preferred: Don't make it a string at all. Yaml documents allow yaml in them. Just make objects yaml, like secretObjects.

Second best option: Many of the error messages when the format isn't quite required indicate that the yaml document just gets converted to json anyway. Make it a json-formatted string. json generators/parsers tend to work much more consistently.

Third best option: Fix the yaml processing to not require irregular quoting. The string values provided to objectName, etc. would not require quotes in an actual yaml document encoded as a string, for instance.

jbct commented 2 months ago

Hi @johncuyle, thank you for reporting this issue. Can you provide some reproduction steps for us to assist?

johncuyle commented 2 months ago

@jbct On further review, never mind. This request was prompted because I was under the (apparently mistaken) impression that the definition for kind: SecretProviderClass was part of the aws provider. It appears that it's actually defined as part of the Secrets Store CSI CRD.

Sorry about that!