Add ACME resources: AcmeEndpoint, AcmeExternalAccountBinding, AcmeDomainValidation

Add support for ACM's ACME protocol resources. This enables Kubernetes
users to manage ACME endpoints, domain validations, and external account
bindings as native Kubernetes resources.

New CRDs:
- AcmeEndpoint: managed ACME server with unique endpoint URL
- AcmeExternalAccountBinding: EAB credentials for ACME client auth
- AcmeDomainValidation: DNS prevalidation for domain authorization

Key features:
- EAB credentials are retrieved via GetAcmeExternalAccountBindingCredentials
  and written into a user-specified, pre-existing Secret (keyId and macKey);
  the Secret must exist first, following the same pattern as the Certificate
  resource's exportTo field
- The non-sensitive key identifier is also surfaced in status.keyID so ACME
  clients can reference it without reading the Secret
- Cross-resource references between EAB/DomainValidation and Endpoint
- Status fields expose endpointURL for ACME client configuration

SDK bumped from v1.33.0 to v1.42.0 to include ACME operations added
in the 2026-06-30 SDK release.

Author: Kyle Schultheiss

README.md

@@ -83,6 +83,80 @@ spec:
 ```
 If you are issuing a privately trusted certificate, please also consider using this cert-manager plugin: https://github.com/cert-manager/aws-privateca-issuer/.
 
+## ACME Resources
+
+This controller also manages ACME (Automatic Certificate Management Environment) resources for ACM. ACME enables standards-based certificate automation using any ACME-compatible client (cert-manager, Certbot, acme.sh, etc.).
+
+### AcmeEndpoint
+
+Creates a managed ACME server endpoint with a unique URL for certificate automation.
+
+```yaml
+apiVersion: acm.services.k8s.aws/v1alpha1
+kind: AcmeEndpoint
+metadata:
+  name: my-acme-endpoint
+spec:
+  authorizationBehavior: PRE_APPROVED
+  certificateAuthority:
+    publicCertificateAuthority: {}
+  contact: NOT_REQUIRED
+```
+
+After creation, `status.endpointURL` contains the ACME directory URL (e.g., `https://acm-acme-enroll.us-east-1.api.aws/<id>/directory`).
+
+### AcmeDomainValidation
+
+Authorizes an ACME endpoint to issue certificates for specific domain names.
+
+```yaml
+apiVersion: acm.services.k8s.aws/v1alpha1
+kind: AcmeDomainValidation
+metadata:
+  name: my-domain-validation
+spec:
+  acmeEndpointARN: arn:aws:acm:us-east-1:123456789012:acme-endpoint/abc-123
+  domainName: example.com
+  prevalidationOptions:
+    dnsPrevalidation:
+      hostedZoneId: Z0123456789ABC
+      domainScope:
+        exactDomain: ENABLED
+        subdomains: ENABLED
+        wildcards: ENABLED
+```
+
+### AcmeExternalAccountBinding
+
+Creates EAB credentials that authorize ACME clients to register accounts with the endpoint.
+
+You must create the target Secret before creating the resource — the controller
+populates an existing Secret rather than creating one (the same pattern as the
+`Certificate` resource's `exportTo` field).
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-eab-credentials
+  namespace: default
+type: Opaque
+---
+apiVersion: acm.services.k8s.aws/v1alpha1
+kind: AcmeExternalAccountBinding
+metadata:
+  name: my-eab
+spec:
+  acmeEndpointARN: arn:aws:acm:us-east-1:123456789012:acme-endpoint/abc-123
+  roleARN: arn:aws:iam::123456789012:role/AcmeAccountRole
+  credentialsOutput:
+    namespace: default
+    name: my-eab-credentials
+    key: keyId
+```
+
+After creation, the controller writes the EAB credentials (`keyId` and `macKey`) into the specified Kubernetes Secret. The Secret must already exist. If `namespace` is omitted, the resource's namespace is used.
+
 ## Contributing
 
 We welcome community contributions and pull requests.

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2026-07-07T21:56:48Z"
-  build_hash: 0a6b791fa10a6140d862be334a6891868ee588eb
-  go_version: go1.26.4
-  version: v0.61.0
-api_directory_checksum: 1f8c794be4a652f9a9cbd936b859e8f103e9291e
+  build_date: No Build Date Provided.
+  build_hash: No Git-hash Provided.
+  go_version: go1.26.1
+  version: (Unknown Version)
+api_directory_checksum: eb74a11e81b7bc3881f7b72f37cc9c196330da3d
 api_version: v1alpha1
-aws_sdk_go_version: v1.32.6
+aws_service_sdk_version: v1.42.0
 generator_config_info:
-  file_checksum: bd0a12d0529ef1e66f351dc61be00f8956aa966e
+  file_checksum: 0865847350405478d479fc3feafc9f92aeb6ff61
   original_file_name: generator.yaml
 last_modification:
   reason: API generation