Feat: Add support to export ACM certificates #82

alexwang0311 · 2025-11-30T00:41:11Z

Add support to export ACM certificates to Kubernetes TLS Secrets for ACM private and public certificates.

…bernetes secret

…rtificate

ack-prow · 2025-11-30T00:41:22Z

Hi @alexwang0311. Thanks for your PR.

I'm waiting for a aws-controllers-k8s member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

michaelhtm · 2025-12-01T19:39:37Z

/ok-to-test

michaelhtm

Thanks @alexwang0311
left a few comments below

apis/v1alpha1/generator.yaml

pkg/resource/certificate/hooks.go

apis/v1alpha1/ack-generate-metadata.yaml

ack-prow · 2025-12-01T23:57:06Z

@alexwang0311: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
acm-verify-attribution	`4d15d96`	link	false	`/test acm-verify-attribution`
acm-verify-code-gen	`4d15d96`	link	false	`/test acm-verify-code-gen`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

michaelhtm

Thanks again @alexwang0311
/lgtm

ack-prow · 2025-12-01T23:58:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alexwang0311, michaelhtm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [michaelhtm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

divyansh-gupta · 2025-12-02T16:01:21Z

config/iam/recommended-inline-policy

+            "Action": [
+                "acm-pca:IssueCertificate",
+                "acm-pca:GetCertificate",
+                "acm-pca:ListPermissions"


Why is ListPermissions needed?

https://awscli.amazonaws.com/v2/documentation/api/2.1.30/reference/acm-pca/list-permissions.html

Permissions designate which private CA actions can be performed by an AWS service or entity. In order for ACM to automatically renew private certificates, you must give the ACM service principal all available permissions (IssueCertificate , GetCertificate , and ListPermissions ). Permissions can be assigned with the CreatePermission action, removed with the DeletePermission action, and listed with the ListPermissions action.

divyansh-gupta · 2025-12-02T16:02:31Z

helm/values.schema.json

          "type": "string"
        },
-        "endpoint": {
+        "endpoint_url": {


I don't understand why we added allow_unsafe_aws_endpoint_urls? What does this do?

This was something added by the latest commit from the code generator repo

divyansh-gupta · 2025-12-02T16:04:12Z

pkg/resource/certificate/hooks.go

+func generateRandomString(length int) (string, error) {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?"
+	b := make([]byte, length)
+	if _, err := io.ReadFull(rand.Reader, b); err != nil {


Thoughts on using crypto/rand.Int()? Something like:

num, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))

divyansh-gupta · 2025-12-02T16:05:22Z

pkg/resource/certificate/hooks.go

+		return nil, errors.New("failed to decrypt PEM block")
+	}
+
+	// NOTE: Algorithms supported for an ACM certificate request include: RSA_2048, EC_prime256v1, EC_secp384r1


Are there plans to add more algorithms? If so, how do we keep this up to date?

alexwang0311 added 29 commits October 16, 2025 00:36

feat: Add support to export ACM public exportable certificate to a Ku…

cc96c7f

…bernetes secret

Update tag

245eb55

Remove examples

f77bcea

Update README and use tls.crt instead of key

239cb24

Use delta_pre_compare hook to export cert

6b4aa6a

Update IAM policy to include ExportCertificate

88c2e56

Only set exportPreference for public certificates

0188425

Remove delta_pre_compare and update export to also support private ce…

048b8f2

…rtificate

Re-generated files

7110954

Removed sample file

61b55b9

Update recommended IAM permissions to include private certificates

c242720

Fix typo

465d0f7

Merged upstream

8f7efb8

Re-generated files

773dc95

Use delta_pre_compare hook

d5edc67

Fix update logic

f831c2c

Fix IssuedAt update logic

25aaecc

Update compareIssuedAt logic

ad92aa5

Add NOTEs

92c1be8

Merge branch 'main' into main

c3ff541

Re-generated files

5e0cf6e

Use Serial to detect renewal in delta comparison

688926f

Fix name and update logic

21c68d6

Fix update logic

ea00555

Fix update logic

de56d78

Only create IssuedAt delta for exported certs

572c6ba

Generate random passphrase

dd279d4

Merge main

2bed52d

Re-generated files

4f831a6

ack-prow bot requested a review from knottnt November 30, 2025 00:41

ack-prow bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Nov 30, 2025

alexwang0311 added 2 commits November 29, 2025 16:56

Update tags

e63f3a0

Fix tag version

5cb15ee

alexwang0311 marked this pull request as draft November 30, 2025 01:31

ack-prow bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 30, 2025

alexwang0311 marked this pull request as ready for review November 30, 2025 01:31

ack-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 30, 2025

ack-prow bot requested review from a-hilaly and rushmash91 November 30, 2025 01:31

alexwang0311 added 2 commits November 29, 2025 17:42

Update README

2b838d6

Fix README

ea86f0b

ack-prow bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 1, 2025

re-generated and removed adoptedresource CRD

2b6e62a

michaelhtm reviewed Dec 1, 2025

View reviewed changes

apis/v1alpha1/generator.yaml Show resolved Hide resolved

pkg/resource/certificate/hooks.go Outdated Show resolved Hide resolved

pkg/resource/certificate/hooks.go Show resolved Hide resolved

apis/v1alpha1/ack-generate-metadata.yaml Outdated Show resolved Hide resolved

alexwang0311 added 2 commits December 1, 2025 15:26

Fix code generator version

16cb1aa

Remove TerminalError

4d15d96

michaelhtm approved these changes Dec 1, 2025

View reviewed changes

ack-prow bot assigned michaelhtm Dec 1, 2025

ack-prow bot added the lgtm Indicates that a PR is ready to be merged. label Dec 1, 2025

ack-prow bot added the approved label Dec 1, 2025

ack-prow bot merged commit 22a7f2b into aws-controllers-k8s:main Dec 1, 2025
6 of 8 checks passed

divyansh-gupta reviewed Dec 2, 2025

View reviewed changes

Feat: Add support to export ACM certificates #82

Feat: Add support to export ACM certificates #82

Uh oh!

Conversation

alexwang0311 commented Nov 30, 2025

Uh oh!

ack-prow bot commented Nov 30, 2025

Uh oh!

michaelhtm commented Dec 1, 2025

Uh oh!

michaelhtm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ack-prow bot commented Dec 1, 2025

Uh oh!

michaelhtm left a comment

Choose a reason for hiding this comment

Uh oh!

ack-prow bot commented Dec 1, 2025

Uh oh!

Uh oh!

divyansh-gupta Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

alexwang0311 Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

divyansh-gupta Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

alexwang0311 Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

divyansh-gupta Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

divyansh-gupta Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

divyansh-gupta Dec 2, 2025 •

edited

Loading