According to the source code, pulumi.automation is just a wrapper around the command line tools. So I looked at how a list is handled in the config:

$ yq '.config."gke-cluster:master-authorized-networks"' < Pulumi.dev.yaml
[
  "10.0.0.0/8"
]
$ pulumi config get gke-cluster:master-authorized-networks
["10.0.0.0/8"]
$ pulumi config get gke-cluster:master-authorized-networks --json
{
  "value": "[\"10.0.0.0/8\"]",
  "objectValue": [
    "10.0.0.0/8"
  ],
  "secret": false
}

Guess that explains why ConfigValue only takes strings. I need to JSON-serialize non-string values before calling it. Shouldn't we do this serialization transparently?

Related: https://github.com/pulumi/pulumi/issues/5506