Add support for ACM ACME resources#108
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: KyleBS The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ack-prow
Bot
added
the
needs-ok-to-test
|
Hi @KyleBS. Thanks for your PR. I'm waiting for a aws-controllers-k8s member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
0f5d21c to
29981e6
Compare
…ainValidation Add support for ACM's ACME protocol resources. This enables Kubernetes users to manage ACME endpoints, domain validations, and external account bindings as native Kubernetes resources. New CRDs: - AcmeEndpoint: managed ACME server with unique endpoint URL - AcmeExternalAccountBinding: EAB credentials for ACME client auth - AcmeDomainValidation: DNS prevalidation for domain authorization Key features: - EAB credentials are retrieved via GetAcmeExternalAccountBindingCredentials and written into a user-specified, pre-existing Secret. The sensitive macKey is written under the user-provided key (defaulting to macKey), and the keyId under a fixed keyId key, following the same pattern as the Certificate resource's exportTo field. The Secret must exist first. - The non-sensitive key identifier is also surfaced in status.keyID so ACME clients can reference it without reading the Secret - Cross-resource references between EAB/DomainValidation and Endpoint - Status fields expose endpointURL for ACME client configuration SDK bumped from v1.33.0 to v1.42.0 to include ACME operations added in the 2026-06-30 SDK release.
29981e6 to
9d12bfa
Compare
| is_ignored: true No newline at end of file | ||
| is_ignored: true | ||
|
|
||
| AcmeEndpoint: |
There was a problem hiding this comment.
Looks like we are missing proper tag support for all the new resources. We follow the existing Certificate convention for tag support(I.E sync.go contains logic for fetching an updating tags).
In each resource's hooks.go add var syncTags = tags.SyncTags and var listTags = tags.ListTags; add a sdk_update_pre_build_request hook that calls syncTags when delta.DifferentAt("Spec.Tags") and short-circuits with !delta.DifferentExcept("Spec.Tags"); and add a sdk_read_one_post_set_output hook that populates tags via listTags.
| @@ -0,0 +1,258 @@ | |||
| # Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | |||
There was a problem hiding this comment.
Looks like we only did create and delete test for AcmeEndpoint and AcmeDomainValidation. Can we add update operation as well in e2e test?
| @@ -0,0 +1,258 @@ | |||
| # Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | |||
| # | |||
There was a problem hiding this comment.
Worth mentioning I notice in some of the test we don't validate the state of the resource in AWS, instead we rely solely on whats in the CR spec/status.
I'd suggest we make AWS describe api calls after resource is synced to verify that the source of truth(aws) matches what's in the spec/status.
We've had issues in the past with e2e test missing bugs/regressions because e2e test did not verify against AWS.
| go_version: go1.26.4 | ||
| version: v0.61.0 | ||
| api_directory_checksum: 1f8c794be4a652f9a9cbd936b859e8f103e9291e | ||
| build_date: No Build Date Provided. |
There was a problem hiding this comment.
Just an FYI, make sure when you build the controller locally you have latest changes on main branch runtime and code-gen packages in your workspace.
Followed by running make build-controller SERVICE=ACM. This metadata.yaml file seems incorrect as it is right now. You may have had out of date runtime and code-gen packages in your local workspace when you built the controller.
2 participants
Issue #, if available: N/A
Description of changes:
Add support for ACM's ACME protocol resources. This enables Kubernetes users to manage ACME endpoints, domain validations, and external account bindings as native Kubernetes resources.
New CRDs:
Key features:
SDK bumped from v1.33.0 to v1.42.0 to include ACME operations added in the 2026-06-30 SDK release.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.