feature/add-public-key-status-field: add public key field for asymmetric KMS keys

config/crd/bases/kms.services.k8s.aws_keys.yaml

@@ -489,6 +489,12 @@ spec:
                   to PendingDeletion and the deletion date appears in the DeletionDate field.
                 format: int64
                 type: integer
+              publicKey:
+                description: |-
+                  The public key material for asymmetric KMS keys, base64-encoded DER format.
+                  This field is only populated for asymmetric keys (e.g., ECC_SECG_P256K1, RSA_2048).
+                  For symmetric keys, this field is nil.
+                type: string
               signingAlgorithms:
                 description: |-
                   The signing algorithms that the KMS key supports. You cannot use the KMS

helm/crds/kms.services.k8s.aws_keys.yaml

@@ -489,6 +489,12 @@ spec:
                   to PendingDeletion and the deletion date appears in the DeletionDate field.
                 format: int64
                 type: integer
+              publicKey:
+                description: |-
+                  The public key material for asymmetric KMS keys, base64-encoded DER format.
+                  This field is only populated for asymmetric keys (e.g., ECC_SECG_P256K1, RSA_2048).
+                  For symmetric keys, this field is nil.
+                type: string
               signingAlgorithms:
                 description: |-
                   The signing algorithms that the KMS key supports. You cannot use the KMS

pkg/resource/key/hooks.go

@@ -15,11 +15,14 @@ package key
 
 import (
 	"context"
+	"encoding/base64"
+	"errors"
 	"strconv"
 
 	ackcompare "github.com/aws-controllers-k8s/runtime/pkg/compare"
 	ackrtlog "github.com/aws-controllers-k8s/runtime/pkg/runtime/log"
 	svcsdk "github.com/aws/aws-sdk-go-v2/service/kms"
+	smithy "github.com/aws/smithy-go"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	svcapitypes "github.com/aws-controllers-k8s/kms-controller/apis/v1alpha1"
@@ -167,3 +170,41 @@ func (rm *resourceManager) disableKeyRotation(ctx context.Context, keyId *string
 	}
 	return nil
 }
+
+// getPublicKey retrieves the public key for asymmetric KMS keys.
+// Returns nil for symmetric keys or keys that don't support GetPublicKey.
+func (rm *resourceManager) getPublicKey(ctx context.Context, r *resource) (*string, error) {
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.getPublicKey")
+	defer func() { exit(nil) }()
+
+	if r.ko.Status.KeyID == nil {
+		return nil, nil
+	}
+
+	input := &svcsdk.GetPublicKeyInput{
+		KeyId: r.ko.Status.KeyID,
+	}
+	resp, err := rm.sdkapi.GetPublicKey(ctx, input)
+	rm.metrics.RecordAPICall("GET", "GetPublicKey", err)
+	if err != nil {
+		// Symmetric keys and some key types don't support GetPublicKey
+		// Return nil gracefully instead of error
+		var apiErr smithy.APIError
+		if errors.As(err, &apiErr) {
+			if apiErr.ErrorCode() == "UnsupportedOperationException" ||
+				apiErr.ErrorCode() == "DisabledException" {
+				return nil, nil
+			}
+		}
+		return nil, err
+	}
+
+	if resp.PublicKey == nil {
+		return nil, nil
+	}
+
+	// Return base64-encoded DER format
+	encoded := base64.StdEncoding.EncodeToString(resp.PublicKey)
+	return &encoded, nil
+}

templates/hooks/key/sdk_create_post_set_output.go.tpl

@@ -6,4 +6,9 @@
     err = rm.updateKeyRotation(ctx, &resource{ko})
     if err != nil {
         return &resource{ko}, err
-    }
+    }
+    publicKey, err := rm.getPublicKey(ctx, &resource{ko})
+    if err != nil {
+        return &resource{ko}, err
+    }
+    ko.Status.PublicKey = publicKey

templates/hooks/key/sdk_read_one_post_set_output.go.tpl

@@ -13,4 +13,9 @@
 		return &resource{ko}, err
 	}
 	enabled := keyRotationStatus.KeyRotationEnabled
-	ko.Spec.EnableKeyRotation = &enabled
+	ko.Spec.EnableKeyRotation = &enabled
+    publicKey, err := rm.getPublicKey(ctx, &resource{ko})
+    if err != nil {
+        return &resource{ko}, err
+    }
+    ko.Status.PublicKey = publicKey