SecretsManager - can create cannot update

[nicraMarcin]

Describe the bug
I can create secretmanager's secret from kubernetes secret but I when I update k8s secret it is not updated :(

Steps to reproduce

apiVersion: v1
kind: Secret
metadata:
  name: poc-secret
stringData:
  data: |
    {
      "username": "exampleUser",
      "password": "examplePass123",
      "host": "examplehost.com",
      "region": "eu-central-1",
      "edited": "TRUE",
      "manual": "true",
      "changed": "after appply poc2"
    }

---
apiVersion: secretsmanager.services.k8s.aws/v1alpha1
kind: Secret
metadata:
  name: ack-test-secret-poc
  annotations:
    services.k8s.aws/deletion-policy: delete
spec:
  name: ack-dev-secret-poc-2
  forceOverwriteReplicaSecret: true
  secretString:
    key: data
    name: poc-secret

Expected outcome
secret to be updated when kubernetes secret is changed.

Environment

• Kubernetes version 1.29
• Using EKS (yes/no), if so version? yes, 1.29
• AWS service targeted (S3, RDS, etc.) SecretManager v0.0.11

BTW. Why we cannot set secretString directly into secretmanager's secret? for example it would be easier to:

apiVersion: secretsmanager.services.k8s.aws/v1alpha1
kind: Secret
metadata:
  name: ack-test-secret-poc
  annotations:
    services.k8s.aws/deletion-policy: delete
spec:
  name: ack-dev-secret-poc-2
  forceOverwriteReplicaSecret: true
  secretString: | 
    {
      "username": "exampleUser",
      "password": "examplePass123",
      "host": "examplehost.com",
      "region": "eu-central-1",
      "edited": "TRUE",
      "manual": "true",
      "changed": "after appply poc2"
    }

This gives confusing error:

The Secret "ack-test-secret-poc" is invalid: spec.secretString: Invalid value: "string": spec.secretString in body must be of type object: "string"

In documentation

secretStringOptional | object. The text data to encrypt and store in this new version of the secret. Werecommend you use a JSON structure of key/value pairs for your secret value.

Must it be object or string?

[omri-shilton]

I would also like to know if its possible to enter the secret data directly from the ack secret manifest. we need to create mock data. because of this issue external-secrets/external-secrets#3478

[allamand]

Effectively, the controller should be able to update the secrets when change occurs, here it simply try to create it and it fails:

{"level":"error","ts":"2025-01-31T16:44:59.767Z","msg":"Reconciler error","controller":"secret","controllerGroup":"secretsmanager.services.k8s.aws","controllerKind":"Secret","Secret":{"name":"secret-name","namespace":"workload-cluster3"},"namespace":"default","name":"secret-name","reconcileID":"9cdbb494-5eae-4cb9-a4b0-ca1834c0d66f","error":"ResourceExistsException: The operation failed because the secret secret-name already exists.","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:224"}

[ack-bot]

Issues go stale after 180d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 60d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/aws-controllers-k8s/community.
/lifecycle stale