Support importing certificates into ACM (#40)

Description of changes:

Adds support for [importing certificates](https://docs.aws.amazon.com/acm/latest/APIReference/API_ImportCertificate.html) into ACM. When `Spec.Certificate` is set, the controller attempts to import a certificate into ACM, otherwise it requests a certificate. It is an error to set fields used to request a certificate when importing a certificate and vice versa. The two fields required for importing a certificate (`Certificate` and `PrivateKey`) are both secret references. While the certificate portion may not be private information, it’s common to store TLS certificates as secrets in Kubernetes. The ACK runtime currently only supports resolving `Opaque` secrets and not TLS certificates, so users wanting to import existing TLS secrets into ACM will have to migrate them first.

The `late_initialize_post_read_one` hook is used to allow late initialization of optional fields, otherwise the controller will keep retrying `DescribeCertificate` for setting fields that will never be returned from the API.

`GoCodeSetSDKForStruct` in code-generator does not support resolving secret references for custom `[]byte` fields, so a wrapper type `importCertificateInput` has been introduced as a workaround.

Issue #, if available: aws-controllers-k8s/community#2043


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Author: cPu1

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2024-10-10T03:56:31Z"
+  build_date: "2024-11-06T19:23:27Z"
   build_hash: 36c2d234498c2bc4f60773ab8df632af4067f43b
-  go_version: go1.23.2
+  go_version: go1.22.4
   version: v0.39.1
-api_directory_checksum: e337526dd1438ddb861e06bd92b5f640ba9ed537
+api_directory_checksum: b055cc57ac2cc8b07e374803c280b65d1a72f3bf
 api_version: v1alpha1
 aws_sdk_go_version: v1.49.0
 generator_config_info:
-  file_checksum: 910047b7946c5968bbc58b6334099deb005e95cc
+  file_checksum: df0b4d7fe83a679c01131dc4af1844b5ff8105b3
   original_file_name: generator.yaml
 last_modification:
   reason: API generation

apis/v1alpha1/certificate.go

@@ -35,24 +35,55 @@ resources:
         code: input.SetValidationMethod("DNS")
       sdk_read_one_pre_set_output:
         template_path: hooks/certificate/sdk_read_one_pre_set_output.go.tpl
+      sdk_file_end:
+        template_path: hooks/certificate/sdk_file_end.go.tpl
+      late_initialize_post_read_one:
+        template_path: hooks/certificate/late_initialize_post_read_one.go.tpl
     exceptions:
       terminal_codes:
         - InvalidParameter
         - InvalidDomainValidationOptionsException 
         - InvalidTagException
         - TagPolicyException
         - TooManyTagsException 
+        - InvalidArnException
     reconcile:
       requeue_on_success_seconds: 60
     fields:
-      DomainValidationOptions:
+      DomainName:
+        is_primary_key: false
+        is_required: false
+      Certificate:
+        type: "bytes"
+        is_secret: true
+        is_immutable: true
+        compare:
+          is_ignored: true
+      PrivateKey:
+        type: "bytes"
+        is_secret: true
+        is_immutable: true
+        compare:
+          is_ignored: true
+      CertificateArn:
+        type: string
+        is_immutable: true
+      CertificateChain:
+        type: "bytes"
+        is_immutable: true
+        is_secret: true
+        compare:
+          is_ignored: true
+      CertificateAuthorityARN:
+        references:
+          service_name: acmpca
+          resource: CertificateAuthority
+          path: Status.ACKResourceMetadata.ARN
+        is_immutable: true
+      KeyAlgorithm:
         late_initialize: {}
       Options:
         late_initialize: {}
-      SubjectAlternativeNames:
-        late_initialize: {}
-      KeyAlgorithm:
-        late_initialize: {}
       # NOTE(jaypipes): The Create operation (RequestCertificate) has a
       # response with only a single field (certificateArn). All of the status
       # fields for the certificate are in the ReadOne operation

apis/v1alpha1/generator.yaml

@@ -39,6 +39,31 @@ spec:
           spec:
             description: CertificateSpec defines the desired state of Certificate.
             properties:
+              certificate:
+                description: |-
+                  The Certificate to import into AWS Certificate Manager (ACM) to use with services that are integrated with ACM.
+                  This field is only valid when importing an existing certificate into ACM.
+                properties:
+                  key:
+                    description: Key is the key within the secret
+                    type: string
+                  name:
+                    description: name is unique within a namespace to reference a
+                      secret resource.
+                    type: string
+                  namespace:
+                    description: namespace defines the space within which the secret
+                      name must be unique.
+                    type: string
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
+              certificateARN:
+                description: |-
+                  The Amazon Resource Name (ARN) of an imported certificate to replace. This field is only valid when importing
+                  an existing certificate into ACM.
+                type: string
               certificateAuthorityARN:
                 description: |-
                   The Amazon Resource Name (ARN) of the private certificate authority (CA)
@@ -50,6 +75,43 @@ spec:
 
                   arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012
                 type: string
+              certificateAuthorityRef:
+                description: "AWSResourceReferenceWrapper provides a wrapper around
+                  *AWSResourceReference\ntype to provide more user friendly syntax
+                  for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t
+                  \ name: my-api"
+                properties:
+                  from:
+                    description: |-
+                      AWSResourceReference provides all the values necessary to reference another
+                      k8s resource for finding the identifier(Id/ARN/Name)
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    type: object
+                type: object
+              certificateChain:
+                description: |-
+                  SecretKeyReference combines a k8s corev1.SecretReference with a
+                  specific key within the referred-to Secret
+                properties:
+                  key:
+                    description: Key is the key within the secret
+                    type: string
+                  name:
+                    description: name is unique within a namespace to reference a
+                      secret resource.
+                    type: string
+                  namespace:
+                    description: namespace defines the space within which the secret
+                      name must be unique.
+                    type: string
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               domainName:
                 description: |-
                   Fully qualified domain name (FQDN), such as www.example.com, that you want
@@ -104,6 +166,26 @@ spec:
                   certificateTransparencyLoggingPreference:
                     type: string
                 type: object
+              privateKey:
+                description: |-
+                  The private key that matches the public key in the certificate. This field is only valid when importing
+                  an existing certificate into ACM.
+                properties:
+                  key:
+                    description: Key is the key within the secret
+                    type: string
+                  name:
+                    description: name is unique within a namespace to reference a
+                      secret resource.
+                    type: string
+                  namespace:
+                    description: namespace defines the space within which the secret
+                      name must be unique.
+                    type: string
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               subjectAlternativeNames:
                 description: |-
                   Additional FQDNs to be included in the Subject Alternative Name extension
@@ -143,8 +225,6 @@ spec:
                       type: string
                   type: object
                 type: array
-            required:
-            - domainName
             type: object
           status:
             description: CertificateStatus defines the observed state of Certificate

apis/v1alpha1/zz_generated.deepcopy.go

@@ -42,6 +42,14 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - acmpca.services.k8s.aws
+  resources:
+  - certificateauthorities
+  - certificateauthorities/status
+  verbs:
+  - get
+  - list
 - apiGroups:
   - services.k8s.aws
   resources:

cmd/controller/main.go

@@ -0,0 +1,15 @@
+resources:
+  Certificate:
+    fields:
+      Certificate:
+        prepend: |
+          The Certificate to import into AWS Certificate Manager (ACM) to use with services that are integrated with ACM.
+          This field is only valid when importing an existing certificate into ACM.
+      PrivateKey:
+        prepend: |
+          The private key that matches the public key in the certificate. This field is only valid when importing
+          an existing certificate into ACM.
+      CertificateARN:
+        prepend: |
+          The Amazon Resource Name (ARN) of an imported certificate to replace. This field is only valid when importing
+          an existing certificate into ACM.

config/crd/bases/acm.services.k8s.aws_certificates.yaml

@@ -35,24 +35,55 @@ resources:
         code: input.SetValidationMethod("DNS")
       sdk_read_one_pre_set_output:
         template_path: hooks/certificate/sdk_read_one_pre_set_output.go.tpl
+      sdk_file_end:
+        template_path: hooks/certificate/sdk_file_end.go.tpl
+      late_initialize_post_read_one:
+        template_path: hooks/certificate/late_initialize_post_read_one.go.tpl
     exceptions:
       terminal_codes:
         - InvalidParameter
         - InvalidDomainValidationOptionsException 
         - InvalidTagException
         - TagPolicyException
         - TooManyTagsException 
+        - InvalidArnException
     reconcile:
       requeue_on_success_seconds: 60
     fields:
-      DomainValidationOptions:
+      DomainName:
+        is_primary_key: false
+        is_required: false
+      Certificate:
+        type: "bytes"
+        is_secret: true
+        is_immutable: true
+        compare:
+          is_ignored: true
+      PrivateKey:
+        type: "bytes"
+        is_secret: true
+        is_immutable: true
+        compare:
+          is_ignored: true
+      CertificateArn:
+        type: string
+        is_immutable: true
+      CertificateChain:
+        type: "bytes"
+        is_immutable: true
+        is_secret: true
+        compare:
+          is_ignored: true
+      CertificateAuthorityARN:
+        references:
+          service_name: acmpca
+          resource: CertificateAuthority
+          path: Status.ACKResourceMetadata.ARN
+        is_immutable: true
+      KeyAlgorithm:
         late_initialize: {}
       Options:
         late_initialize: {}
-      SubjectAlternativeNames:
-        late_initialize: {}
-      KeyAlgorithm:
-        late_initialize: {}
       # NOTE(jaypipes): The Create operation (RequestCertificate) has a
       # response with only a single field (certificateArn). All of the status
       # fields for the certificate are in the ReadOne operation

config/rbac/cluster-role-controller.yaml

@@ -5,8 +5,9 @@ go 1.22.0
 toolchain go1.22.5
 
 require (
+	github.com/aws-controllers-k8s/acmpca-controller v0.0.17
 	github.com/aws-controllers-k8s/runtime v0.39.0
-	github.com/aws/aws-sdk-go v1.49.0
+	github.com/aws/aws-sdk-go v1.49.6
 	github.com/go-logr/logr v1.4.2
 	github.com/spf13/pflag v1.0.5
 	k8s.io/api v0.31.0