Export issued cert into AWS ACM

[sylr]

Is your feature request related to a problem? Please describe.

We'd like to use ALB load balancer with certificates issued to cert-manager by other CA (like let's encrypt).

Describe the solution you'd like

Have cert manager export the issued certs to AWS ACM in addition to k8s secret.

Describe alternatives you've considered

Additional context

There are issues about issuing certificates from ACM, this issue is about doing the opposite.

Environment details (remove if not applicable):

• Kubernetes version: 1.19
• Cloud-provider/provisioner: aws
• cert-manager version: 1.2.0
• Install method: e.g. helm/static manifests

/kind feature

[EronWright]

This would be a great feature.

May I suggest that the imported ACM certificate be tagged to associate it with the Certificate resource. e.g. cert-manager.io/certificate-name: namespace/name. Consider recording the cert revision too.

For now, a possible workaround is to import the certificate into ACM from the Secret that is created by cert-manager. Here's a snippet of go code that converts the secret into the input data needed by the ACM API (ImportCertificate):

import (
	"encoding/pem"
	"errors"
	"github.com/aws/aws-sdk-go/service/acm"
	corev1 "k8s.io/api/core/v1"
)

func makeImportCertificateInput(secret *corev1.Secret) (input acm.ImportCertificateInput, err error) {
	raw := secret.Data["tls.crt"]
	block, _ := pem.Decode(raw) // extract the first certificate from the `tls.crt` key
	if block == nil || !(block.Type == "PUBLIC KEY" || block.Type == "CERTIFICATE") {
		return input, errors.New("failed to decode PEM block")
	}
	input.Certificate = pem.EncodeToMemory(block)
	input.CertificateChain = secret.Data["tls.crt"]
	input.PrivateKey = secret.Data["tls.key"]
	return input, nil
}

[EronWright]

Related issue: kubernetes-sigs/aws-load-balancer-controller#1084

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[lawliet89]

/remove-lifecycle stale

[jetstack-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle stale

[jetstack-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Send feedback to jetstack.
/lifecycle rotten
/remove-lifecycle stale

[jetstack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@jetstack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[lawliet89]

/reopen

[jetstack-bot]

@lawliet89: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sylr]

/reopen

[jetstack-bot]

@sylr: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jetstack-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

[jetstack-bot]

@jetstack-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Send feedback to jetstack.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[bacek]

Any chances on getting this implemented?