diff --git a/apis/v1alpha1/ack-generate-metadata.yaml b/apis/v1alpha1/ack-generate-metadata.yaml index 583c534..ba5e6dd 100755 --- a/apis/v1alpha1/ack-generate-metadata.yaml +++ b/apis/v1alpha1/ack-generate-metadata.yaml @@ -1,13 +1,13 @@ ack_generate_info: - build_date: "2026-07-07T21:56:48Z" - build_hash: 0a6b791fa10a6140d862be334a6891868ee588eb - go_version: go1.26.4 - version: v0.61.0 -api_directory_checksum: 1f8c794be4a652f9a9cbd936b859e8f103e9291e + build_date: "2026-07-20T18:08:54Z" + build_hash: ab6940f9c532e013d284f670e50b727102b4126d + go_version: go1.26.1 + version: v0.61.0-2-gab6940f +api_directory_checksum: b63f5ff80e2d5be0938672b26850bebb37c52e2d api_version: v1alpha1 -aws_sdk_go_version: v1.32.6 +aws_service_sdk_version: v1.42.0 generator_config_info: - file_checksum: bd0a12d0529ef1e66f351dc61be00f8956aa966e + file_checksum: 62bab3af6e2593684f08cf0cb88206e0a6cd627c original_file_name: generator.yaml last_modification: reason: API generation diff --git a/apis/v1alpha1/certificate.go b/apis/v1alpha1/certificate.go index bc9bd00..12232e1 100644 --- a/apis/v1alpha1/certificate.go +++ b/apis/v1alpha1/certificate.go @@ -74,7 +74,7 @@ type CertificateSpec struct { // others allow the use of either RSA and ECDSA keys to ensure that compatibility // is not broken. Check the requirements for the Amazon Web Services service // where you plan to deploy your certificate. For more information about selecting - // an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html#algorithms). + // an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate-characteristics.html#algorithms-term). // // Algorithms supported for an ACM certificate request include: // @@ -93,12 +93,19 @@ type CertificateSpec struct { // Default: RSA_2048 // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable once set" KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` - // Currently, you can use this parameter to specify whether to add the certificate - // to a certificate transparency log. Certificate transparency makes it possible - // to detect SSL/TLS certificates that have been mistakenly or maliciously issued. - // Certificates that have not been logged typically produce an error message - // in a browser. For more information, see Opting Out of Certificate Transparency - // Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency). + // Identifies the Amazon Web Services service that manages the certificate issued + // by ACM. + // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable once set" + ManagedBy *string `json:"managedBy,omitempty"` + // You can use this parameter to specify whether to export your certificate. + // + // Certificate transparency logging opt-out is no longer available. All public + // certificates are recorded in a certificate transparency log. For more information, + // see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). + // + // You can export public ACM certificates to use with Amazon Web Services services + // as well as outside the Amazon Web Services Cloud. For more information, see + // Certificate Manager exportable public certificate (https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). Options *CertificateOptions `json:"options,omitempty"` // The private key that matches the public key in the certificate. This field is only valid when importing // an existing certificate into ACM. diff --git a/apis/v1alpha1/enums.go b/apis/v1alpha1/enums.go index 857e815..b4ece33 100644 --- a/apis/v1alpha1/enums.go +++ b/apis/v1alpha1/enums.go @@ -15,6 +15,80 @@ package v1alpha1 +type AcmeAccountStatus string + +const ( + AcmeAccountStatus_DEACTIVATED AcmeAccountStatus = "DEACTIVATED" + AcmeAccountStatus_REVOKED AcmeAccountStatus = "REVOKED" + AcmeAccountStatus_VALID AcmeAccountStatus = "VALID" +) + +type AcmeAuthorizationBehavior string + +const ( + AcmeAuthorizationBehavior_PRE_APPROVED AcmeAuthorizationBehavior = "PRE_APPROVED" +) + +type AcmeContact string + +const ( + AcmeContact_NOT_REQUIRED AcmeContact = "NOT_REQUIRED" + AcmeContact_REQUIRED AcmeContact = "REQUIRED" +) + +type AcmeDomainValidationFailureReason string + +const ( + AcmeDomainValidationFailureReason_ACCESS_DENIED AcmeDomainValidationFailureReason = "ACCESS_DENIED" + AcmeDomainValidationFailureReason_DOMAIN_MISMATCH AcmeDomainValidationFailureReason = "DOMAIN_MISMATCH" + AcmeDomainValidationFailureReason_DOMAIN_NOT_ALLOWED AcmeDomainValidationFailureReason = "DOMAIN_NOT_ALLOWED" + AcmeDomainValidationFailureReason_ENDPOINT_NOT_ACTIVE AcmeDomainValidationFailureReason = "ENDPOINT_NOT_ACTIVE" + AcmeDomainValidationFailureReason_HOSTED_ZONE_NOT_FOUND AcmeDomainValidationFailureReason = "HOSTED_ZONE_NOT_FOUND" + AcmeDomainValidationFailureReason_INTERNAL_FAILURE AcmeDomainValidationFailureReason = "INTERNAL_FAILURE" + AcmeDomainValidationFailureReason_INVALID_CHANGE_BATCH AcmeDomainValidationFailureReason = "INVALID_CHANGE_BATCH" + AcmeDomainValidationFailureReason_INVALID_PUBLIC_DOMAIN AcmeDomainValidationFailureReason = "INVALID_PUBLIC_DOMAIN" + AcmeDomainValidationFailureReason_TIMED_OUT AcmeDomainValidationFailureReason = "TIMED_OUT" +) + +type AcmeDomainValidationStatus string + +const ( + AcmeDomainValidationStatus_DELETING AcmeDomainValidationStatus = "DELETING" + AcmeDomainValidationStatus_INVALID AcmeDomainValidationStatus = "INVALID" + AcmeDomainValidationStatus_VALID AcmeDomainValidationStatus = "VALID" + AcmeDomainValidationStatus_VALIDATING AcmeDomainValidationStatus = "VALIDATING" +) + +type AcmeEndpointStatus string + +const ( + AcmeEndpointStatus_ACTIVE AcmeEndpointStatus = "ACTIVE" + AcmeEndpointStatus_CREATING AcmeEndpointStatus = "CREATING" + AcmeEndpointStatus_DELETING AcmeEndpointStatus = "DELETING" + AcmeEndpointStatus_FAILED AcmeEndpointStatus = "FAILED" +) + +type CertificateExport string + +const ( + CertificateExport_DISABLED CertificateExport = "DISABLED" + CertificateExport_ENABLED CertificateExport = "ENABLED" +) + +type CertificateKeyPairOrigin string + +const ( + CertificateKeyPairOrigin_ACME CertificateKeyPairOrigin = "ACME" + CertificateKeyPairOrigin_AWS_MANAGED CertificateKeyPairOrigin = "AWS_MANAGED" + CertificateKeyPairOrigin_CUSTOMER_PROVIDED CertificateKeyPairOrigin = "CUSTOMER_PROVIDED" +) + +type CertificateManagedBy string + +const ( + CertificateManagedBy_CLOUDFRONT CertificateManagedBy = "CLOUDFRONT" +) + type CertificateStatus_SDK string const ( @@ -42,6 +116,20 @@ const ( CertificateType_PRIVATE CertificateType = "PRIVATE" ) +type ComparisonOperator string + +const ( + ComparisonOperator_CONTAINS ComparisonOperator = "CONTAINS" + ComparisonOperator_EQUALS ComparisonOperator = "EQUALS" +) + +type DomainScopeOption string + +const ( + DomainScopeOption_DISABLED DomainScopeOption = "DISABLED" + DomainScopeOption_ENABLED DomainScopeOption = "ENABLED" +) + type DomainStatus string const ( @@ -117,6 +205,20 @@ const ( KeyUsageName_NON_REPUDIATION KeyUsageName = "NON_REPUDIATION" ) +type PrevalidationType string + +const ( + PrevalidationType_DNS_PREVALIDATION PrevalidationType = "DNS_PREVALIDATION" +) + +type PublicKeyAlgorithm string + +const ( + PublicKeyAlgorithm_EC_prime256v1 PublicKeyAlgorithm = "EC_prime256v1" + PublicKeyAlgorithm_EC_secp384r1 PublicKeyAlgorithm = "EC_secp384r1" + PublicKeyAlgorithm_RSA_2048 PublicKeyAlgorithm = "RSA_2048" +) + type RecordType string const ( @@ -151,9 +253,43 @@ const ( RevocationReason_PRIVILEGE_WITHDRAWN RevocationReason = "PRIVILEGE_WITHDRAWN" RevocationReason_REMOVE_FROM_CRL RevocationReason = "REMOVE_FROM_CRL" RevocationReason_SUPERCEDED RevocationReason = "SUPERCEDED" + RevocationReason_SUPERSEDED RevocationReason = "SUPERSEDED" RevocationReason_UNSPECIFIED RevocationReason = "UNSPECIFIED" ) +type SearchCertificatesSortBy string + +const ( + SearchCertificatesSortBy_ACME_ACCOUNT_ID SearchCertificatesSortBy = "ACME_ACCOUNT_ID" + SearchCertificatesSortBy_ACME_ENDPOINT_ARN SearchCertificatesSortBy = "ACME_ENDPOINT_ARN" + SearchCertificatesSortBy_CERTIFICATE_ARN SearchCertificatesSortBy = "CERTIFICATE_ARN" + SearchCertificatesSortBy_CERTIFICATE_KEY_PAIR_ORIGIN SearchCertificatesSortBy = "CERTIFICATE_KEY_PAIR_ORIGIN" + SearchCertificatesSortBy_COMMON_NAME SearchCertificatesSortBy = "COMMON_NAME" + SearchCertificatesSortBy_CREATED_AT SearchCertificatesSortBy = "CREATED_AT" + SearchCertificatesSortBy_EXPORTED SearchCertificatesSortBy = "EXPORTED" + SearchCertificatesSortBy_EXPORT_OPTION SearchCertificatesSortBy = "EXPORT_OPTION" + SearchCertificatesSortBy_IMPORTED_AT SearchCertificatesSortBy = "IMPORTED_AT" + SearchCertificatesSortBy_IN_USE SearchCertificatesSortBy = "IN_USE" + SearchCertificatesSortBy_ISSUED_AT SearchCertificatesSortBy = "ISSUED_AT" + SearchCertificatesSortBy_KEY_ALGORITHM SearchCertificatesSortBy = "KEY_ALGORITHM" + SearchCertificatesSortBy_MANAGED_BY SearchCertificatesSortBy = "MANAGED_BY" + SearchCertificatesSortBy_NOT_AFTER SearchCertificatesSortBy = "NOT_AFTER" + SearchCertificatesSortBy_NOT_BEFORE SearchCertificatesSortBy = "NOT_BEFORE" + SearchCertificatesSortBy_RENEWAL_ELIGIBILITY SearchCertificatesSortBy = "RENEWAL_ELIGIBILITY" + SearchCertificatesSortBy_RENEWAL_STATUS SearchCertificatesSortBy = "RENEWAL_STATUS" + SearchCertificatesSortBy_REVOKED_AT SearchCertificatesSortBy = "REVOKED_AT" + SearchCertificatesSortBy_STATUS SearchCertificatesSortBy = "STATUS" + SearchCertificatesSortBy_TYPE SearchCertificatesSortBy = "TYPE" + SearchCertificatesSortBy_VALIDATION_METHOD SearchCertificatesSortBy = "VALIDATION_METHOD" +) + +type SearchCertificatesSortOrder string + +const ( + SearchCertificatesSortOrder_ASCENDING SearchCertificatesSortOrder = "ASCENDING" + SearchCertificatesSortOrder_DESCENDING SearchCertificatesSortOrder = "DESCENDING" +) + type SortBy string const ( @@ -167,9 +303,18 @@ const ( SortOrder_DESCENDING SortOrder = "DESCENDING" ) +type TimeType string + +const ( + TimeType_DAYS TimeType = "DAYS" + TimeType_HOURS TimeType = "HOURS" + TimeType_MINUTES TimeType = "MINUTES" +) + type ValidationMethod string const ( ValidationMethod_DNS ValidationMethod = "DNS" ValidationMethod_EMAIL ValidationMethod = "EMAIL" + ValidationMethod_HTTP ValidationMethod = "HTTP" ) diff --git a/apis/v1alpha1/generator.yaml b/apis/v1alpha1/generator.yaml index 6216502..58b374b 100644 --- a/apis/v1alpha1/generator.yaml +++ b/apis/v1alpha1/generator.yaml @@ -1,4 +1,8 @@ ignore: + resource_names: + - AcmeEndpoint + - AcmeExternalAccountBinding + - AcmeDomainValidation field_paths: - "RequestCertificateInput.IdempotencyToken" - "RequestCertificateInput.ValidationMethod" @@ -88,8 +92,14 @@ resources: is_immutable: true compare: is_ignored: true + ManagedBy: + is_immutable: true + compare: + is_ignored: true Options: late_initialize: {} + Options.Export: + late_initialize: {} # NOTE(jaypipes): The Create operation (RequestCertificate) has a # response with only a single field (certificateArn). All of the status # fields for the certificate are in the ReadOne operation diff --git a/apis/v1alpha1/types.go b/apis/v1alpha1/types.go index 75f84e1..97697d3 100644 --- a/apis/v1alpha1/types.go +++ b/apis/v1alpha1/types.go @@ -28,31 +28,102 @@ var ( _ = ackv1alpha1.AWSAccountID("") ) +// Contains ACM-specific metadata about a certificate. +type ACMCertificateMetadata struct { + AcmeAccountID *string `json:"acmeAccountID,omitempty"` + AcmeEndpointARN *string `json:"acmeEndpointARN,omitempty"` + // The origin of the certificate's key pair. + CertificateKeyPairOrigin *string `json:"certificateKeyPairOrigin,omitempty"` + CreatedAt *metav1.Time `json:"createdAt,omitempty"` + ExportOption *string `json:"exportOption,omitempty"` + Exported *bool `json:"exported,omitempty"` + ImportedAt *metav1.Time `json:"importedAt,omitempty"` + InUse *bool `json:"inUse,omitempty"` + IssuedAt *metav1.Time `json:"issuedAt,omitempty"` + ManagedBy *string `json:"managedBy,omitempty"` + RenewalEligibility *string `json:"renewalEligibility,omitempty"` + RenewalStatus *string `json:"renewalStatus,omitempty"` + RevokedAt *metav1.Time `json:"revokedAt,omitempty"` + Status *string `json:"status,omitempty"` + Type *string `json:"type_,omitempty"` + ValidationMethod *string `json:"validationMethod,omitempty"` +} + +// Filters certificates by ACM metadata. +type ACMCertificateMetadataFilter struct { + AcmeAccountID *string `json:"acmeAccountID,omitempty"` + AcmeEndpointARN *string `json:"acmeEndpointARN,omitempty"` + // The origin of the certificate's key pair. + CertificateKeyPairOrigin *string `json:"certificateKeyPairOrigin,omitempty"` + ExportOption *string `json:"exportOption,omitempty"` + Exported *bool `json:"exported,omitempty"` + InUse *bool `json:"inUse,omitempty"` + ManagedBy *string `json:"managedBy,omitempty"` + RenewalStatus *string `json:"renewalStatus,omitempty"` + Status *string `json:"status,omitempty"` + Type *string `json:"type_,omitempty"` + ValidationMethod *string `json:"validationMethod,omitempty"` +} + +// Contains detailed information about an ACME account. +type AcmeAccount struct { + AccountURL *string `json:"accountURL,omitempty"` + PublicKeyThumbprint *string `json:"publicKeyThumbprint,omitempty"` +} + +// Contains summary information about an ACME account. +type AcmeAccountSummary struct { + AccountURL *string `json:"accountURL,omitempty"` + PublicKeyThumbprint *string `json:"publicKeyThumbprint,omitempty"` +} + +// Contains detailed information about an ACME endpoint. +type AcmeEndpoint struct { + CertificateTags []*Tag `json:"certificateTags,omitempty"` + EndpointURL *string `json:"endpointURL,omitempty"` + FailureReason *string `json:"failureReason,omitempty"` +} + +// Contains summary information about an ACME endpoint. +type AcmeEndpointSummary struct { + CertificateTags []*Tag `json:"certificateTags,omitempty"` + EndpointURL *string `json:"endpointURL,omitempty"` + FailureReason *string `json:"failureReason,omitempty"` +} + // Contains metadata about an ACM certificate. This structure is returned in // the response to a DescribeCertificate request. type CertificateDetail struct { - CertificateARN *string `json:"certificateARN,omitempty"` - CertificateAuthorityARN *string `json:"certificateAuthorityARN,omitempty"` - CreatedAt *metav1.Time `json:"createdAt,omitempty"` - DomainName *string `json:"domainName,omitempty"` - DomainValidationOptions []*DomainValidation `json:"domainValidationOptions,omitempty"` - ExtendedKeyUsages []*ExtendedKeyUsage `json:"extendedKeyUsages,omitempty"` - FailureReason *string `json:"failureReason,omitempty"` - ImportedAt *metav1.Time `json:"importedAt,omitempty"` - InUseBy []*string `json:"inUseBy,omitempty"` - IssuedAt *metav1.Time `json:"issuedAt,omitempty"` - Issuer *string `json:"issuer,omitempty"` - KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` - KeyUsages []*KeyUsage `json:"keyUsages,omitempty"` - NotAfter *metav1.Time `json:"notAfter,omitempty"` - NotBefore *metav1.Time `json:"notBefore,omitempty"` - // Structure that contains options for your certificate. Currently, you can - // use this only to specify whether to opt in to or out of certificate transparency - // logging. Some browsers require that public certificates issued for your domain - // be recorded in a log. Certificates that are not logged typically generate - // a browser error. Transparency makes it possible for you to detect SSL/TLS - // certificates that have been mistakenly or maliciously issued for your domain. - // For general information, see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). + AcmeAccountID *string `json:"acmeAccountID,omitempty"` + AcmeEndpointARN *string `json:"acmeEndpointARN,omitempty"` + CertificateARN *string `json:"certificateARN,omitempty"` + CertificateAuthorityARN *string `json:"certificateAuthorityARN,omitempty"` + // The origin of the certificate's key pair. + CertificateKeyPairOrigin *string `json:"certificateKeyPairOrigin,omitempty"` + CreatedAt *metav1.Time `json:"createdAt,omitempty"` + DomainName *string `json:"domainName,omitempty"` + DomainValidationOptions []*DomainValidation `json:"domainValidationOptions,omitempty"` + ExtendedKeyUsages []*ExtendedKeyUsage `json:"extendedKeyUsages,omitempty"` + FailureReason *string `json:"failureReason,omitempty"` + ImportedAt *metav1.Time `json:"importedAt,omitempty"` + InUseBy []*string `json:"inUseBy,omitempty"` + IssuedAt *metav1.Time `json:"issuedAt,omitempty"` + Issuer *string `json:"issuer,omitempty"` + KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` + KeyUsages []*KeyUsage `json:"keyUsages,omitempty"` + ManagedBy *string `json:"managedBy,omitempty"` + NotAfter *metav1.Time `json:"notAfter,omitempty"` + NotBefore *metav1.Time `json:"notBefore,omitempty"` + // Structure that contains options for your certificate. You can use this structure + // to specify whether to export your certificate. + // + // Certificate transparency logging opt-out is no longer available. All public + // certificates are recorded in a certificate transparency log. For general + // information, see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). + // + // You can export public ACM certificates to use with Amazon Web Services services + // as well as outside Amazon Web Services Cloud. For more information, see Certificate + // Manager exportable public certificate (https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). Options *CertificateOptions `json:"options,omitempty"` RenewalEligibility *string `json:"renewalEligibility,omitempty"` // Contains information about the status of ACM's managed renewal (https://docs.aws.amazon.com/acm/latest/userguide/acm-renewal.html) @@ -69,22 +140,42 @@ type CertificateDetail struct { Type *string `json:"type_,omitempty"` } -// Structure that contains options for your certificate. Currently, you can -// use this only to specify whether to opt in to or out of certificate transparency -// logging. Some browsers require that public certificates issued for your domain -// be recorded in a log. Certificates that are not logged typically generate -// a browser error. Transparency makes it possible for you to detect SSL/TLS -// certificates that have been mistakenly or maliciously issued for your domain. -// For general information, see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). +// Defines a filter for searching certificates by ARN, X.509 attributes, or +// ACM metadata. +type CertificateFilter struct { + CertificateARN *string `json:"certificateARN,omitempty"` +} + +// Structure that contains options for your certificate. You can use this structure +// to specify whether to export your certificate. +// +// Certificate transparency logging opt-out is no longer available. All public +// certificates are recorded in a certificate transparency log. For general +// information, see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). +// +// You can export public ACM certificates to use with Amazon Web Services services +// as well as outside Amazon Web Services Cloud. For more information, see Certificate +// Manager exportable public certificate (https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). type CertificateOptions struct { CertificateTransparencyLoggingPreference *string `json:"certificateTransparencyLoggingPreference,omitempty"` + Export *string `json:"export,omitempty"` +} + +// Contains information about a certificate returned by the SearchCertificates +// action. This structure includes the certificate ARN, X.509 attributes, and +// ACM metadata. +type CertificateSearchResult struct { + CertificateARN *string `json:"certificateARN,omitempty"` } // This structure is returned in the response object of ListCertificates action. type CertificateSummary struct { - CertificateARN *string `json:"certificateARN,omitempty"` + CertificateARN *string `json:"certificateARN,omitempty"` + // The origin of the certificate's key pair. + CertificateKeyPairOrigin *string `json:"certificateKeyPairOrigin,omitempty"` CreatedAt *metav1.Time `json:"createdAt,omitempty"` DomainName *string `json:"domainName,omitempty"` + ExportOption *string `json:"exportOption,omitempty"` Exported *bool `json:"exported,omitempty"` ExtendedKeyUsages []*string `json:"extendedKeyUsages,omitempty"` HasAdditionalSubjectAlternativeNames *bool `json:"hasAdditionalSubjectAlternativeNames,omitempty"` @@ -93,6 +184,7 @@ type CertificateSummary struct { IssuedAt *metav1.Time `json:"issuedAt,omitempty"` KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` KeyUsages []*string `json:"keyUsages,omitempty"` + ManagedBy *string `json:"managedBy,omitempty"` NotAfter *metav1.Time `json:"notAfter,omitempty"` NotBefore *metav1.Time `json:"notBefore,omitempty"` RenewalEligibility *string `json:"renewalEligibility,omitempty"` @@ -102,9 +194,44 @@ type CertificateSummary struct { Type *string `json:"type_,omitempty"` } +// Defines the X.500 relative distinguished name (RDN). +type CustomAttribute struct { + ObjectIdentifier *string `json:"objectIdentifier,omitempty"` + Value *string `json:"value,omitempty"` +} + +// DNS prevalidation details including the resource record for validation. +type DNSPrevalidationDetails struct { + // Contains a DNS record value that you can use to validate ownership or control + // of a domain. This is used by the DescribeCertificate action. + ResourceRecord *ResourceRecord `json:"resourceRecord,omitempty"` +} + +// Contains X.500 distinguished name information. +type DistinguishedName struct { + CommonName *string `json:"commonName,omitempty"` + Country *string `json:"country,omitempty"` + DistinguishedNameQualifier *string `json:"distinguishedNameQualifier,omitempty"` + GenerationQualifier *string `json:"generationQualifier,omitempty"` + GivenName *string `json:"givenName,omitempty"` + Initials *string `json:"initials,omitempty"` + Locality *string `json:"locality,omitempty"` + Organization *string `json:"organization,omitempty"` + OrganizationalUnit *string `json:"organizationalUnit,omitempty"` + Pseudonym *string `json:"pseudonym,omitempty"` + SerialNumber *string `json:"serialNumber,omitempty"` + State *string `json:"state,omitempty"` + Surname *string `json:"surname,omitempty"` + Title *string `json:"title,omitempty"` +} + // Contains information about the validation of each domain name in the certificate. type DomainValidation struct { DomainName *string `json:"domainName,omitempty"` + // Contains information for HTTP-based domain validation of certificates requested + // through Amazon CloudFront and issued by ACM. This field exists only when + // the certificate type is AMAZON_ISSUED and the validation method is HTTP. + HTTPRedirect *HTTPRedirect `json:"httpRedirect,omitempty"` // Contains a DNS record value that you can use to validate ownership or control // of a domain. This is used by the DescribeCertificate action. ResourceRecord *ResourceRecord `json:"resourceRecord,omitempty"` @@ -129,12 +256,37 @@ type ExtendedKeyUsage struct { OID *string `json:"oid,omitempty"` } +// Contains details about a failure. +type FailureDetails struct { + Message *string `json:"message,omitempty"` +} + // This structure can be used in the ListCertificates action to filter the output // of the certificate list. type Filters struct { + ExportOption *string `json:"exportOption,omitempty"` ExtendedKeyUsage []*string `json:"extendedKeyUsage,omitempty"` KeyTypes []*string `json:"keyTypes,omitempty"` KeyUsage []*string `json:"keyUsage,omitempty"` + ManagedBy *string `json:"managedBy,omitempty"` +} + +// Describes an ASN.1 X.400 GeneralName as defined in RFC 5280 (https://datatracker.ietf.org/doc/html/rfc5280). +// Only one of the following naming options should be provided. +type GeneralName struct { + DNSName *string `json:"dnsName,omitempty"` + IPAddress *string `json:"ipAddress,omitempty"` + RegisteredID *string `json:"registeredID,omitempty"` + RFC822Name *string `json:"rfc822Name,omitempty"` + UniformResourceIdentifier *string `json:"uniformResourceIdentifier,omitempty"` +} + +// Contains information for HTTP-based domain validation of certificates requested +// through Amazon CloudFront and issued by ACM. This field exists only when +// the certificate type is AMAZON_ISSUED and the validation method is HTTP. +type HTTPRedirect struct { + RedirectFrom *string `json:"redirectFrom,omitempty"` + RedirectTo *string `json:"redirectTo,omitempty"` } // The Key Usage X.509 v3 extension defines the purpose of the public key contained @@ -143,6 +295,14 @@ type KeyUsage struct { Name *string `json:"name,omitempty"` } +// Defines a custom ASN.1 X.400 GeneralName using an object identifier (OID) +// and value. For more information, see NIST's definition of Object Identifier +// (OID) (https://csrc.nist.gov/glossary/term/Object_Identifier). +type OtherName struct { + ObjectIdentifier *string `json:"objectIdentifier,omitempty"` + Value *string `json:"value,omitempty"` +} + // Contains information about the status of ACM's managed renewal (https://docs.aws.amazon.com/acm/latest/userguide/acm-renewal.html) // for the certificate. This structure exists only when the certificate type // is AMAZON_ISSUED. @@ -166,3 +326,25 @@ type Tag struct { Key *string `json:"key,omitempty"` Value *string `json:"value,omitempty"` } + +// Specifies a time range for filtering certificates. +type TimestampRange struct { + End *metav1.Time `json:"end,omitempty"` + Start *metav1.Time `json:"start,omitempty"` +} + +// Filters certificates by X.509 attributes. +type X509AttributeFilter struct { + ExtendedKeyUsage *string `json:"extendedKeyUsage,omitempty"` + KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` + KeyUsage *string `json:"keyUsage,omitempty"` +} + +// Contains X.509 certificate attributes extracted from the certificate. +type X509Attributes struct { + ExtendedKeyUsages []*string `json:"extendedKeyUsages,omitempty"` + KeyAlgorithm *string `json:"keyAlgorithm,omitempty"` + KeyUsages []*string `json:"keyUsages,omitempty"` + NotAfter *metav1.Time `json:"notAfter,omitempty"` + NotBefore *metav1.Time `json:"notBefore,omitempty"` +} diff --git a/apis/v1alpha1/zz_generated.deepcopy.go b/apis/v1alpha1/zz_generated.deepcopy.go index e5c431c..b497643 100644 --- a/apis/v1alpha1/zz_generated.deepcopy.go +++ b/apis/v1alpha1/zz_generated.deepcopy.go @@ -24,6 +24,289 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ACMCertificateMetadata) DeepCopyInto(out *ACMCertificateMetadata) { + *out = *in + if in.AcmeAccountID != nil { + in, out := &in.AcmeAccountID, &out.AcmeAccountID + *out = new(string) + **out = **in + } + if in.AcmeEndpointARN != nil { + in, out := &in.AcmeEndpointARN, &out.AcmeEndpointARN + *out = new(string) + **out = **in + } + if in.CertificateKeyPairOrigin != nil { + in, out := &in.CertificateKeyPairOrigin, &out.CertificateKeyPairOrigin + *out = new(string) + **out = **in + } + if in.CreatedAt != nil { + in, out := &in.CreatedAt, &out.CreatedAt + *out = (*in).DeepCopy() + } + if in.ExportOption != nil { + in, out := &in.ExportOption, &out.ExportOption + *out = new(string) + **out = **in + } + if in.Exported != nil { + in, out := &in.Exported, &out.Exported + *out = new(bool) + **out = **in + } + if in.ImportedAt != nil { + in, out := &in.ImportedAt, &out.ImportedAt + *out = (*in).DeepCopy() + } + if in.InUse != nil { + in, out := &in.InUse, &out.InUse + *out = new(bool) + **out = **in + } + if in.IssuedAt != nil { + in, out := &in.IssuedAt, &out.IssuedAt + *out = (*in).DeepCopy() + } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } + if in.RenewalEligibility != nil { + in, out := &in.RenewalEligibility, &out.RenewalEligibility + *out = new(string) + **out = **in + } + if in.RenewalStatus != nil { + in, out := &in.RenewalStatus, &out.RenewalStatus + *out = new(string) + **out = **in + } + if in.RevokedAt != nil { + in, out := &in.RevokedAt, &out.RevokedAt + *out = (*in).DeepCopy() + } + if in.Status != nil { + in, out := &in.Status, &out.Status + *out = new(string) + **out = **in + } + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(string) + **out = **in + } + if in.ValidationMethod != nil { + in, out := &in.ValidationMethod, &out.ValidationMethod + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMCertificateMetadata. +func (in *ACMCertificateMetadata) DeepCopy() *ACMCertificateMetadata { + if in == nil { + return nil + } + out := new(ACMCertificateMetadata) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ACMCertificateMetadataFilter) DeepCopyInto(out *ACMCertificateMetadataFilter) { + *out = *in + if in.AcmeAccountID != nil { + in, out := &in.AcmeAccountID, &out.AcmeAccountID + *out = new(string) + **out = **in + } + if in.AcmeEndpointARN != nil { + in, out := &in.AcmeEndpointARN, &out.AcmeEndpointARN + *out = new(string) + **out = **in + } + if in.CertificateKeyPairOrigin != nil { + in, out := &in.CertificateKeyPairOrigin, &out.CertificateKeyPairOrigin + *out = new(string) + **out = **in + } + if in.ExportOption != nil { + in, out := &in.ExportOption, &out.ExportOption + *out = new(string) + **out = **in + } + if in.Exported != nil { + in, out := &in.Exported, &out.Exported + *out = new(bool) + **out = **in + } + if in.InUse != nil { + in, out := &in.InUse, &out.InUse + *out = new(bool) + **out = **in + } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } + if in.RenewalStatus != nil { + in, out := &in.RenewalStatus, &out.RenewalStatus + *out = new(string) + **out = **in + } + if in.Status != nil { + in, out := &in.Status, &out.Status + *out = new(string) + **out = **in + } + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(string) + **out = **in + } + if in.ValidationMethod != nil { + in, out := &in.ValidationMethod, &out.ValidationMethod + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ACMCertificateMetadataFilter. +func (in *ACMCertificateMetadataFilter) DeepCopy() *ACMCertificateMetadataFilter { + if in == nil { + return nil + } + out := new(ACMCertificateMetadataFilter) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AcmeAccount) DeepCopyInto(out *AcmeAccount) { + *out = *in + if in.AccountURL != nil { + in, out := &in.AccountURL, &out.AccountURL + *out = new(string) + **out = **in + } + if in.PublicKeyThumbprint != nil { + in, out := &in.PublicKeyThumbprint, &out.PublicKeyThumbprint + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcmeAccount. +func (in *AcmeAccount) DeepCopy() *AcmeAccount { + if in == nil { + return nil + } + out := new(AcmeAccount) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AcmeAccountSummary) DeepCopyInto(out *AcmeAccountSummary) { + *out = *in + if in.AccountURL != nil { + in, out := &in.AccountURL, &out.AccountURL + *out = new(string) + **out = **in + } + if in.PublicKeyThumbprint != nil { + in, out := &in.PublicKeyThumbprint, &out.PublicKeyThumbprint + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcmeAccountSummary. +func (in *AcmeAccountSummary) DeepCopy() *AcmeAccountSummary { + if in == nil { + return nil + } + out := new(AcmeAccountSummary) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AcmeEndpoint) DeepCopyInto(out *AcmeEndpoint) { + *out = *in + if in.CertificateTags != nil { + in, out := &in.CertificateTags, &out.CertificateTags + *out = make([]*Tag, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(Tag) + (*in).DeepCopyInto(*out) + } + } + } + if in.EndpointURL != nil { + in, out := &in.EndpointURL, &out.EndpointURL + *out = new(string) + **out = **in + } + if in.FailureReason != nil { + in, out := &in.FailureReason, &out.FailureReason + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcmeEndpoint. +func (in *AcmeEndpoint) DeepCopy() *AcmeEndpoint { + if in == nil { + return nil + } + out := new(AcmeEndpoint) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AcmeEndpointSummary) DeepCopyInto(out *AcmeEndpointSummary) { + *out = *in + if in.CertificateTags != nil { + in, out := &in.CertificateTags, &out.CertificateTags + *out = make([]*Tag, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(Tag) + (*in).DeepCopyInto(*out) + } + } + } + if in.EndpointURL != nil { + in, out := &in.EndpointURL, &out.EndpointURL + *out = new(string) + **out = **in + } + if in.FailureReason != nil { + in, out := &in.FailureReason, &out.FailureReason + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcmeEndpointSummary. +func (in *AcmeEndpointSummary) DeepCopy() *AcmeEndpointSummary { + if in == nil { + return nil + } + out := new(AcmeEndpointSummary) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Certificate) DeepCopyInto(out *Certificate) { *out = *in @@ -54,6 +337,16 @@ func (in *Certificate) DeepCopyObject() runtime.Object { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *CertificateDetail) DeepCopyInto(out *CertificateDetail) { *out = *in + if in.AcmeAccountID != nil { + in, out := &in.AcmeAccountID, &out.AcmeAccountID + *out = new(string) + **out = **in + } + if in.AcmeEndpointARN != nil { + in, out := &in.AcmeEndpointARN, &out.AcmeEndpointARN + *out = new(string) + **out = **in + } if in.CertificateARN != nil { in, out := &in.CertificateARN, &out.CertificateARN *out = new(string) @@ -64,6 +357,11 @@ func (in *CertificateDetail) DeepCopyInto(out *CertificateDetail) { *out = new(string) **out = **in } + if in.CertificateKeyPairOrigin != nil { + in, out := &in.CertificateKeyPairOrigin, &out.CertificateKeyPairOrigin + *out = new(string) + **out = **in + } if in.CreatedAt != nil { in, out := &in.CreatedAt, &out.CreatedAt *out = (*in).DeepCopy() @@ -140,6 +438,11 @@ func (in *CertificateDetail) DeepCopyInto(out *CertificateDetail) { } } } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } if in.NotAfter != nil { in, out := &in.NotAfter, &out.NotAfter *out = (*in).DeepCopy() @@ -220,6 +523,26 @@ func (in *CertificateDetail) DeepCopy() *CertificateDetail { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CertificateFilter) DeepCopyInto(out *CertificateFilter) { + *out = *in + if in.CertificateARN != nil { + in, out := &in.CertificateARN, &out.CertificateARN + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateFilter. +func (in *CertificateFilter) DeepCopy() *CertificateFilter { + if in == nil { + return nil + } + out := new(CertificateFilter) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *CertificateList) DeepCopyInto(out *CertificateList) { *out = *in @@ -260,6 +583,11 @@ func (in *CertificateOptions) DeepCopyInto(out *CertificateOptions) { *out = new(string) **out = **in } + if in.Export != nil { + in, out := &in.Export, &out.Export + *out = new(string) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateOptions. @@ -272,6 +600,26 @@ func (in *CertificateOptions) DeepCopy() *CertificateOptions { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CertificateSearchResult) DeepCopyInto(out *CertificateSearchResult) { + *out = *in + if in.CertificateARN != nil { + in, out := &in.CertificateARN, &out.CertificateARN + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSearchResult. +func (in *CertificateSearchResult) DeepCopy() *CertificateSearchResult { + if in == nil { + return nil + } + out := new(CertificateSearchResult) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) { *out = *in @@ -326,6 +674,11 @@ func (in *CertificateSpec) DeepCopyInto(out *CertificateSpec) { *out = new(string) **out = **in } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } if in.Options != nil { in, out := &in.Options, &out.Options *out = new(CertificateOptions) @@ -527,6 +880,11 @@ func (in *CertificateSummary) DeepCopyInto(out *CertificateSummary) { *out = new(string) **out = **in } + if in.CertificateKeyPairOrigin != nil { + in, out := &in.CertificateKeyPairOrigin, &out.CertificateKeyPairOrigin + *out = new(string) + **out = **in + } if in.CreatedAt != nil { in, out := &in.CreatedAt, &out.CreatedAt *out = (*in).DeepCopy() @@ -536,102 +894,242 @@ func (in *CertificateSummary) DeepCopyInto(out *CertificateSummary) { *out = new(string) **out = **in } - if in.Exported != nil { - in, out := &in.Exported, &out.Exported - *out = new(bool) + if in.ExportOption != nil { + in, out := &in.ExportOption, &out.ExportOption + *out = new(string) + **out = **in + } + if in.Exported != nil { + in, out := &in.Exported, &out.Exported + *out = new(bool) + **out = **in + } + if in.ExtendedKeyUsages != nil { + in, out := &in.ExtendedKeyUsages, &out.ExtendedKeyUsages + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } + if in.HasAdditionalSubjectAlternativeNames != nil { + in, out := &in.HasAdditionalSubjectAlternativeNames, &out.HasAdditionalSubjectAlternativeNames + *out = new(bool) + **out = **in + } + if in.ImportedAt != nil { + in, out := &in.ImportedAt, &out.ImportedAt + *out = (*in).DeepCopy() + } + if in.InUse != nil { + in, out := &in.InUse, &out.InUse + *out = new(bool) + **out = **in + } + if in.IssuedAt != nil { + in, out := &in.IssuedAt, &out.IssuedAt + *out = (*in).DeepCopy() + } + if in.KeyAlgorithm != nil { + in, out := &in.KeyAlgorithm, &out.KeyAlgorithm + *out = new(string) + **out = **in + } + if in.KeyUsages != nil { + in, out := &in.KeyUsages, &out.KeyUsages + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } + if in.NotAfter != nil { + in, out := &in.NotAfter, &out.NotAfter + *out = (*in).DeepCopy() + } + if in.NotBefore != nil { + in, out := &in.NotBefore, &out.NotBefore + *out = (*in).DeepCopy() + } + if in.RenewalEligibility != nil { + in, out := &in.RenewalEligibility, &out.RenewalEligibility + *out = new(string) + **out = **in + } + if in.RevokedAt != nil { + in, out := &in.RevokedAt, &out.RevokedAt + *out = (*in).DeepCopy() + } + if in.Status != nil { + in, out := &in.Status, &out.Status + *out = new(string) + **out = **in + } + if in.SubjectAlternativeNameSummaries != nil { + in, out := &in.SubjectAlternativeNameSummaries, &out.SubjectAlternativeNameSummaries + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSummary. +func (in *CertificateSummary) DeepCopy() *CertificateSummary { + if in == nil { + return nil + } + out := new(CertificateSummary) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CustomAttribute) DeepCopyInto(out *CustomAttribute) { + *out = *in + if in.ObjectIdentifier != nil { + in, out := &in.ObjectIdentifier, &out.ObjectIdentifier + *out = new(string) + **out = **in + } + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CustomAttribute. +func (in *CustomAttribute) DeepCopy() *CustomAttribute { + if in == nil { + return nil + } + out := new(CustomAttribute) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *DNSPrevalidationDetails) DeepCopyInto(out *DNSPrevalidationDetails) { + *out = *in + if in.ResourceRecord != nil { + in, out := &in.ResourceRecord, &out.ResourceRecord + *out = new(ResourceRecord) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DNSPrevalidationDetails. +func (in *DNSPrevalidationDetails) DeepCopy() *DNSPrevalidationDetails { + if in == nil { + return nil + } + out := new(DNSPrevalidationDetails) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *DistinguishedName) DeepCopyInto(out *DistinguishedName) { + *out = *in + if in.CommonName != nil { + in, out := &in.CommonName, &out.CommonName + *out = new(string) + **out = **in + } + if in.Country != nil { + in, out := &in.Country, &out.Country + *out = new(string) **out = **in } - if in.ExtendedKeyUsages != nil { - in, out := &in.ExtendedKeyUsages, &out.ExtendedKeyUsages - *out = make([]*string, len(*in)) - for i := range *in { - if (*in)[i] != nil { - in, out := &(*in)[i], &(*out)[i] - *out = new(string) - **out = **in - } - } - } - if in.HasAdditionalSubjectAlternativeNames != nil { - in, out := &in.HasAdditionalSubjectAlternativeNames, &out.HasAdditionalSubjectAlternativeNames - *out = new(bool) + if in.DistinguishedNameQualifier != nil { + in, out := &in.DistinguishedNameQualifier, &out.DistinguishedNameQualifier + *out = new(string) **out = **in } - if in.ImportedAt != nil { - in, out := &in.ImportedAt, &out.ImportedAt - *out = (*in).DeepCopy() - } - if in.InUse != nil { - in, out := &in.InUse, &out.InUse - *out = new(bool) + if in.GenerationQualifier != nil { + in, out := &in.GenerationQualifier, &out.GenerationQualifier + *out = new(string) **out = **in } - if in.IssuedAt != nil { - in, out := &in.IssuedAt, &out.IssuedAt - *out = (*in).DeepCopy() + if in.GivenName != nil { + in, out := &in.GivenName, &out.GivenName + *out = new(string) + **out = **in } - if in.KeyAlgorithm != nil { - in, out := &in.KeyAlgorithm, &out.KeyAlgorithm + if in.Initials != nil { + in, out := &in.Initials, &out.Initials *out = new(string) **out = **in } - if in.KeyUsages != nil { - in, out := &in.KeyUsages, &out.KeyUsages - *out = make([]*string, len(*in)) - for i := range *in { - if (*in)[i] != nil { - in, out := &(*in)[i], &(*out)[i] - *out = new(string) - **out = **in - } - } + if in.Locality != nil { + in, out := &in.Locality, &out.Locality + *out = new(string) + **out = **in } - if in.NotAfter != nil { - in, out := &in.NotAfter, &out.NotAfter - *out = (*in).DeepCopy() + if in.Organization != nil { + in, out := &in.Organization, &out.Organization + *out = new(string) + **out = **in } - if in.NotBefore != nil { - in, out := &in.NotBefore, &out.NotBefore - *out = (*in).DeepCopy() + if in.OrganizationalUnit != nil { + in, out := &in.OrganizationalUnit, &out.OrganizationalUnit + *out = new(string) + **out = **in } - if in.RenewalEligibility != nil { - in, out := &in.RenewalEligibility, &out.RenewalEligibility + if in.Pseudonym != nil { + in, out := &in.Pseudonym, &out.Pseudonym *out = new(string) **out = **in } - if in.RevokedAt != nil { - in, out := &in.RevokedAt, &out.RevokedAt - *out = (*in).DeepCopy() + if in.SerialNumber != nil { + in, out := &in.SerialNumber, &out.SerialNumber + *out = new(string) + **out = **in } - if in.Status != nil { - in, out := &in.Status, &out.Status + if in.State != nil { + in, out := &in.State, &out.State *out = new(string) **out = **in } - if in.SubjectAlternativeNameSummaries != nil { - in, out := &in.SubjectAlternativeNameSummaries, &out.SubjectAlternativeNameSummaries - *out = make([]*string, len(*in)) - for i := range *in { - if (*in)[i] != nil { - in, out := &(*in)[i], &(*out)[i] - *out = new(string) - **out = **in - } - } + if in.Surname != nil { + in, out := &in.Surname, &out.Surname + *out = new(string) + **out = **in } - if in.Type != nil { - in, out := &in.Type, &out.Type + if in.Title != nil { + in, out := &in.Title, &out.Title *out = new(string) **out = **in } } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSummary. -func (in *CertificateSummary) DeepCopy() *CertificateSummary { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DistinguishedName. +func (in *DistinguishedName) DeepCopy() *DistinguishedName { if in == nil { return nil } - out := new(CertificateSummary) + out := new(DistinguishedName) in.DeepCopyInto(out) return out } @@ -644,6 +1142,11 @@ func (in *DomainValidation) DeepCopyInto(out *DomainValidation) { *out = new(string) **out = **in } + if in.HTTPRedirect != nil { + in, out := &in.HTTPRedirect, &out.HTTPRedirect + *out = new(HTTPRedirect) + (*in).DeepCopyInto(*out) + } if in.ResourceRecord != nil { in, out := &in.ResourceRecord, &out.ResourceRecord *out = new(ResourceRecord) @@ -737,9 +1240,34 @@ func (in *ExtendedKeyUsage) DeepCopy() *ExtendedKeyUsage { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FailureDetails) DeepCopyInto(out *FailureDetails) { + *out = *in + if in.Message != nil { + in, out := &in.Message, &out.Message + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FailureDetails. +func (in *FailureDetails) DeepCopy() *FailureDetails { + if in == nil { + return nil + } + out := new(FailureDetails) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Filters) DeepCopyInto(out *Filters) { *out = *in + if in.ExportOption != nil { + in, out := &in.ExportOption, &out.ExportOption + *out = new(string) + **out = **in + } if in.ExtendedKeyUsage != nil { in, out := &in.ExtendedKeyUsage, &out.ExtendedKeyUsage *out = make([]*string, len(*in)) @@ -773,6 +1301,11 @@ func (in *Filters) DeepCopyInto(out *Filters) { } } } + if in.ManagedBy != nil { + in, out := &in.ManagedBy, &out.ManagedBy + *out = new(string) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Filters. @@ -785,6 +1318,71 @@ func (in *Filters) DeepCopy() *Filters { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GeneralName) DeepCopyInto(out *GeneralName) { + *out = *in + if in.DNSName != nil { + in, out := &in.DNSName, &out.DNSName + *out = new(string) + **out = **in + } + if in.IPAddress != nil { + in, out := &in.IPAddress, &out.IPAddress + *out = new(string) + **out = **in + } + if in.RegisteredID != nil { + in, out := &in.RegisteredID, &out.RegisteredID + *out = new(string) + **out = **in + } + if in.RFC822Name != nil { + in, out := &in.RFC822Name, &out.RFC822Name + *out = new(string) + **out = **in + } + if in.UniformResourceIdentifier != nil { + in, out := &in.UniformResourceIdentifier, &out.UniformResourceIdentifier + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GeneralName. +func (in *GeneralName) DeepCopy() *GeneralName { + if in == nil { + return nil + } + out := new(GeneralName) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *HTTPRedirect) DeepCopyInto(out *HTTPRedirect) { + *out = *in + if in.RedirectFrom != nil { + in, out := &in.RedirectFrom, &out.RedirectFrom + *out = new(string) + **out = **in + } + if in.RedirectTo != nil { + in, out := &in.RedirectTo, &out.RedirectTo + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPRedirect. +func (in *HTTPRedirect) DeepCopy() *HTTPRedirect { + if in == nil { + return nil + } + out := new(HTTPRedirect) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KeyUsage) DeepCopyInto(out *KeyUsage) { *out = *in @@ -805,6 +1403,31 @@ func (in *KeyUsage) DeepCopy() *KeyUsage { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OtherName) DeepCopyInto(out *OtherName) { + *out = *in + if in.ObjectIdentifier != nil { + in, out := &in.ObjectIdentifier, &out.ObjectIdentifier + *out = new(string) + **out = **in + } + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OtherName. +func (in *OtherName) DeepCopy() *OtherName { + if in == nil { + return nil + } + out := new(OtherName) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *RenewalSummary) DeepCopyInto(out *RenewalSummary) { *out = *in @@ -899,3 +1522,106 @@ func (in *Tag) DeepCopy() *Tag { in.DeepCopyInto(out) return out } + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TimestampRange) DeepCopyInto(out *TimestampRange) { + *out = *in + if in.End != nil { + in, out := &in.End, &out.End + *out = (*in).DeepCopy() + } + if in.Start != nil { + in, out := &in.Start, &out.Start + *out = (*in).DeepCopy() + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TimestampRange. +func (in *TimestampRange) DeepCopy() *TimestampRange { + if in == nil { + return nil + } + out := new(TimestampRange) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *X509AttributeFilter) DeepCopyInto(out *X509AttributeFilter) { + *out = *in + if in.ExtendedKeyUsage != nil { + in, out := &in.ExtendedKeyUsage, &out.ExtendedKeyUsage + *out = new(string) + **out = **in + } + if in.KeyAlgorithm != nil { + in, out := &in.KeyAlgorithm, &out.KeyAlgorithm + *out = new(string) + **out = **in + } + if in.KeyUsage != nil { + in, out := &in.KeyUsage, &out.KeyUsage + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new X509AttributeFilter. +func (in *X509AttributeFilter) DeepCopy() *X509AttributeFilter { + if in == nil { + return nil + } + out := new(X509AttributeFilter) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *X509Attributes) DeepCopyInto(out *X509Attributes) { + *out = *in + if in.ExtendedKeyUsages != nil { + in, out := &in.ExtendedKeyUsages, &out.ExtendedKeyUsages + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } + if in.KeyAlgorithm != nil { + in, out := &in.KeyAlgorithm, &out.KeyAlgorithm + *out = new(string) + **out = **in + } + if in.KeyUsages != nil { + in, out := &in.KeyUsages, &out.KeyUsages + *out = make([]*string, len(*in)) + for i := range *in { + if (*in)[i] != nil { + in, out := &(*in)[i], &(*out)[i] + *out = new(string) + **out = **in + } + } + } + if in.NotAfter != nil { + in, out := &in.NotAfter, &out.NotAfter + *out = (*in).DeepCopy() + } + if in.NotBefore != nil { + in, out := &in.NotBefore, &out.NotBefore + *out = (*in).DeepCopy() + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new X509Attributes. +func (in *X509Attributes) DeepCopy() *X509Attributes { + if in == nil { + return nil + } + out := new(X509Attributes) + in.DeepCopyInto(out) + return out +} diff --git a/config/crd/bases/acm.services.k8s.aws_certificates.yaml b/config/crd/bases/acm.services.k8s.aws_certificates.yaml index 4286b0a..582d824 100644 --- a/config/crd/bases/acm.services.k8s.aws_certificates.yaml +++ b/config/crd/bases/acm.services.k8s.aws_certificates.yaml @@ -193,7 +193,7 @@ spec: others allow the use of either RSA and ECDSA keys to ensure that compatibility is not broken. Check the requirements for the Amazon Web Services service where you plan to deploy your certificate. For more information about selecting - an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html#algorithms). + an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate-characteristics.html#algorithms-term). Algorithms supported for an ACM certificate request include: @@ -214,17 +214,30 @@ spec: x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf + managedBy: + description: |- + Identifies the Amazon Web Services service that manages the certificate issued + by ACM. + type: string + x-kubernetes-validations: + - message: Value is immutable once set + rule: self == oldSelf options: description: |- - Currently, you can use this parameter to specify whether to add the certificate - to a certificate transparency log. Certificate transparency makes it possible - to detect SSL/TLS certificates that have been mistakenly or maliciously issued. - Certificates that have not been logged typically produce an error message - in a browser. For more information, see Opting Out of Certificate Transparency - Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency). + You can use this parameter to specify whether to export your certificate. + + Certificate transparency logging opt-out is no longer available. All public + certificates are recorded in a certificate transparency log. For more information, + see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). + + You can export public ACM certificates to use with Amazon Web Services services + as well as outside the Amazon Web Services Cloud. For more information, see + Certificate Manager exportable public certificate (https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). properties: certificateTransparencyLoggingPreference: type: string + export: + type: string type: object privateKey: description: |- @@ -378,6 +391,17 @@ spec: properties: domainName: type: string + httpRedirect: + description: |- + Contains information for HTTP-based domain validation of certificates requested + through Amazon CloudFront and issued by ACM. This field exists only when + the certificate type is AMAZON_ISSUED and the validation method is HTTP. + properties: + redirectFrom: + type: string + redirectTo: + type: string + type: object resourceRecord: description: |- Contains a DNS record value that you can use to validate ownership or control @@ -491,6 +515,17 @@ spec: properties: domainName: type: string + httpRedirect: + description: |- + Contains information for HTTP-based domain validation of certificates requested + through Amazon CloudFront and issued by ACM. This field exists only when + the certificate type is AMAZON_ISSUED and the validation method is HTTP. + properties: + redirectFrom: + type: string + redirectTo: + type: string + type: object resourceRecord: description: |- Contains a DNS record value that you can use to validate ownership or control diff --git a/generator.yaml b/generator.yaml index 6216502..58b374b 100644 --- a/generator.yaml +++ b/generator.yaml @@ -1,4 +1,8 @@ ignore: + resource_names: + - AcmeEndpoint + - AcmeExternalAccountBinding + - AcmeDomainValidation field_paths: - "RequestCertificateInput.IdempotencyToken" - "RequestCertificateInput.ValidationMethod" @@ -88,8 +92,14 @@ resources: is_immutable: true compare: is_ignored: true + ManagedBy: + is_immutable: true + compare: + is_ignored: true Options: late_initialize: {} + Options.Export: + late_initialize: {} # NOTE(jaypipes): The Create operation (RequestCertificate) has a # response with only a single field (certificateArn). All of the status # fields for the certificate are in the ReadOne operation diff --git a/go.mod b/go.mod index 6c88c40..070b050 100644 --- a/go.mod +++ b/go.mod @@ -6,9 +6,9 @@ require ( github.com/aws-controllers-k8s/acmpca-controller v0.0.17 github.com/aws-controllers-k8s/runtime v0.61.0 github.com/aws/aws-sdk-go v1.49.6 - github.com/aws/aws-sdk-go-v2 v1.39.2 - github.com/aws/aws-sdk-go-v2/service/acm v1.33.0 - github.com/aws/smithy-go v1.23.0 + github.com/aws/aws-sdk-go-v2 v1.42.1 + github.com/aws/aws-sdk-go-v2/service/acm v1.42.0 + github.com/aws/smithy-go v1.27.3 github.com/go-logr/logr v1.4.3 github.com/spf13/pflag v1.0.9 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 @@ -22,8 +22,8 @@ require ( github.com/aws/aws-sdk-go-v2/config v1.28.6 // indirect github.com/aws/aws-sdk-go-v2/credentials v1.17.47 // indirect github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect diff --git a/go.sum b/go.sum index dcef9f7..63e97c8 100644 --- a/go.sum +++ b/go.sum @@ -6,22 +6,22 @@ github.com/aws-controllers-k8s/runtime v0.61.0 h1:46ksj9nvW5gx86aB44/zfrZOvJj4G7 github.com/aws-controllers-k8s/runtime v0.61.0/go.mod h1:Ovpk9GCCc/3hekVN6CL0cZhsG41JqSvIb8DXwaEwL34= github.com/aws/aws-sdk-go v1.49.6 h1:yNldzF5kzLBRvKlKz1S0bkvc2+04R1kt13KfBWQBfFA= github.com/aws/aws-sdk-go v1.49.6/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk= -github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I= -github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY= +github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek= +github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= github.com/aws/aws-sdk-go-v2/config v1.28.6 h1:D89IKtGrs/I3QXOLNTH93NJYtDhm8SYa9Q5CsPShmyo= github.com/aws/aws-sdk-go-v2/config v1.28.6/go.mod h1:GDzxJ5wyyFSCoLkS+UhGB0dArhb9mI+Co4dHtoTxbko= github.com/aws/aws-sdk-go-v2/credentials v1.17.47 h1:48bA+3/fCdi2yAwVt+3COvmatZ6jUDNkDTIsqDiMUdw= github.com/aws/aws-sdk-go-v2/credentials v1.17.47/go.mod h1:+KdckOejLW3Ks3b0E3b5rHsr2f9yuORBum0WPnE5o5w= github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21 h1:AmoU1pziydclFT/xRV+xXE/Vb8fttJCLRPv8oAkprc0= github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.21/go.mod h1:AjUdLYe4Tgs6kpH4Bv7uMZo7pottoyHMn4eTcIcneaY= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M= github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ= github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc= -github.com/aws/aws-sdk-go-v2/service/acm v1.33.0 h1:Z3MHBWR1KiviwaAiG7MTPB6T5gLYRPhUECuKLgltCwA= -github.com/aws/aws-sdk-go-v2/service/acm v1.33.0/go.mod h1:t3jPqKBnySV3qsU40cj1TWleOYx5vyz1xBeZiplAVcs= +github.com/aws/aws-sdk-go-v2/service/acm v1.42.0 h1:7edX4+1+1jjfLv4o/fOZYd/eGWcnixjORXHhirbf7NQ= +github.com/aws/aws-sdk-go-v2/service/acm v1.42.0/go.mod h1:0HVmvx7Fvvqg+fXgDm66ye6/IF0NKccKS+UkuJyRjpI= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8= @@ -32,8 +32,8 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6 h1:JnhTZR3PiYDNKlXy50/pNeix github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.6/go.mod h1:URronUEGfXZN1VpdktPSD1EkAL9mfrV+2F4sjH38qOY= github.com/aws/aws-sdk-go-v2/service/sts v1.33.2 h1:s4074ZO1Hk8qv65GqNXqDjmkf4HSQqJukaLuuW0TpDA= github.com/aws/aws-sdk-go-v2/service/sts v1.33.2/go.mod h1:mVggCnIWoM09jP71Wh+ea7+5gAp53q+49wDFs1SW5z8= -github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE= -github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI= +github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY= +github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= diff --git a/helm/crds/acm.services.k8s.aws_certificates.yaml b/helm/crds/acm.services.k8s.aws_certificates.yaml index 701f256..bd07c11 100644 --- a/helm/crds/acm.services.k8s.aws_certificates.yaml +++ b/helm/crds/acm.services.k8s.aws_certificates.yaml @@ -193,7 +193,7 @@ spec: others allow the use of either RSA and ECDSA keys to ensure that compatibility is not broken. Check the requirements for the Amazon Web Services service where you plan to deploy your certificate. For more information about selecting - an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html#algorithms). + an algorithm, see Key algorithms (https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate-characteristics.html#algorithms-term). Algorithms supported for an ACM certificate request include: @@ -214,17 +214,30 @@ spec: x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf + managedBy: + description: |- + Identifies the Amazon Web Services service that manages the certificate issued + by ACM. + type: string + x-kubernetes-validations: + - message: Value is immutable once set + rule: self == oldSelf options: description: |- - Currently, you can use this parameter to specify whether to add the certificate - to a certificate transparency log. Certificate transparency makes it possible - to detect SSL/TLS certificates that have been mistakenly or maliciously issued. - Certificates that have not been logged typically produce an error message - in a browser. For more information, see Opting Out of Certificate Transparency - Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-bestpractices.html#best-practices-transparency). + You can use this parameter to specify whether to export your certificate. + + Certificate transparency logging opt-out is no longer available. All public + certificates are recorded in a certificate transparency log. For more information, + see Certificate Transparency Logging (https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency). + + You can export public ACM certificates to use with Amazon Web Services services + as well as outside the Amazon Web Services Cloud. For more information, see + Certificate Manager exportable public certificate (https://docs.aws.amazon.com/acm/latest/userguide/acm-exportable-certificates.html). properties: certificateTransparencyLoggingPreference: type: string + export: + type: string type: object privateKey: description: |- @@ -378,6 +391,17 @@ spec: properties: domainName: type: string + httpRedirect: + description: |- + Contains information for HTTP-based domain validation of certificates requested + through Amazon CloudFront and issued by ACM. This field exists only when + the certificate type is AMAZON_ISSUED and the validation method is HTTP. + properties: + redirectFrom: + type: string + redirectTo: + type: string + type: object resourceRecord: description: |- Contains a DNS record value that you can use to validate ownership or control @@ -491,6 +515,17 @@ spec: properties: domainName: type: string + httpRedirect: + description: |- + Contains information for HTTP-based domain validation of certificates requested + through Amazon CloudFront and issued by ACM. This field exists only when + the certificate type is AMAZON_ISSUED and the validation method is HTTP. + properties: + redirectFrom: + type: string + redirectTo: + type: string + type: object resourceRecord: description: |- Contains a DNS record value that you can use to validate ownership or control diff --git a/pkg/resource/certificate/delta.go b/pkg/resource/certificate/delta.go index 05714c2..b0ef75e 100644 --- a/pkg/resource/certificate/delta.go +++ b/pkg/resource/certificate/delta.go @@ -78,6 +78,13 @@ func newResourceDelta( delta.Add("Spec.Options.CertificateTransparencyLoggingPreference", a.ko.Spec.Options.CertificateTransparencyLoggingPreference, b.ko.Spec.Options.CertificateTransparencyLoggingPreference) } } + if ackcompare.HasNilDifference(a.ko.Spec.Options.Export, b.ko.Spec.Options.Export) { + delta.Add("Spec.Options.Export", a.ko.Spec.Options.Export, b.ko.Spec.Options.Export) + } else if a.ko.Spec.Options.Export != nil && b.ko.Spec.Options.Export != nil { + if *a.ko.Spec.Options.Export != *b.ko.Spec.Options.Export { + delta.Add("Spec.Options.Export", a.ko.Spec.Options.Export, b.ko.Spec.Options.Export) + } + } } desiredACKTags, _ := convertToOrderedACKTags(a.ko.Spec.Tags) latestACKTags, _ := convertToOrderedACKTags(b.ko.Spec.Tags) diff --git a/pkg/resource/certificate/manager.go b/pkg/resource/certificate/manager.go index d4fcd7f..d54b833 100644 --- a/pkg/resource/certificate/manager.go +++ b/pkg/resource/certificate/manager.go @@ -50,7 +50,7 @@ var ( // +kubebuilder:rbac:groups=acm.services.k8s.aws,resources=certificates,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=acm.services.k8s.aws,resources=certificates/status,verbs=get;update;patch -var lateInitializeFieldNames = []string{"KeyAlgorithm", "Options", "SubjectAlternativeNames"} +var lateInitializeFieldNames = []string{"KeyAlgorithm", "Options", "Export", "SubjectAlternativeNames"} // resourceManager is responsible for providing a consistent way to perform // CRUD operations in a backend AWS service API for Book custom resources. @@ -269,6 +269,11 @@ func (rm *resourceManager) incompleteLateInitialization( if ko.Spec.Options == nil { return true } + if ko.Spec.Options != nil { + if ko.Spec.Options.Export == nil { + return true + } + } if ko.Spec.SubjectAlternativeNames == nil { return true } @@ -289,6 +294,11 @@ func (rm *resourceManager) lateInitializeFromReadOneOutput( if observedKo.Spec.Options != nil && latestKo.Spec.Options == nil { latestKo.Spec.Options = observedKo.Spec.Options } + if observedKo.Spec.Options != nil && latestKo.Spec.Options != nil { + if observedKo.Spec.Options.Export != nil && latestKo.Spec.Options.Export == nil { + latestKo.Spec.Options.Export = observedKo.Spec.Options.Export + } + } if observedKo.Spec.SubjectAlternativeNames != nil && latestKo.Spec.SubjectAlternativeNames == nil { latestKo.Spec.SubjectAlternativeNames = observedKo.Spec.SubjectAlternativeNames } diff --git a/pkg/resource/certificate/sdk.go b/pkg/resource/certificate/sdk.go index cdc6201..68dc701 100644 --- a/pkg/resource/certificate/sdk.go +++ b/pkg/resource/certificate/sdk.go @@ -157,34 +157,34 @@ func (rm *resourceManager) sdkFind( ko.Spec.DomainName = nil } if resp.Certificate.DomainValidationOptions != nil { - f4 := []*svcapitypes.DomainValidationOption{} - for _, f4iter := range resp.Certificate.DomainValidationOptions { - f4elem := &svcapitypes.DomainValidationOption{} - if f4iter.DomainName != nil { - f4elem.DomainName = f4iter.DomainName + f7 := []*svcapitypes.DomainValidationOption{} + for _, f7iter := range resp.Certificate.DomainValidationOptions { + f7elem := &svcapitypes.DomainValidationOption{} + if f7iter.DomainName != nil { + f7elem.DomainName = f7iter.DomainName } - if f4iter.ValidationDomain != nil { - f4elem.ValidationDomain = f4iter.ValidationDomain + if f7iter.ValidationDomain != nil { + f7elem.ValidationDomain = f7iter.ValidationDomain } - f4 = append(f4, f4elem) + f7 = append(f7, f7elem) } - ko.Spec.DomainValidationOptions = f4 + ko.Spec.DomainValidationOptions = f7 } else { ko.Spec.DomainValidationOptions = nil } if resp.Certificate.ExtendedKeyUsages != nil { - f5 := []*svcapitypes.ExtendedKeyUsage{} - for _, f5iter := range resp.Certificate.ExtendedKeyUsages { - f5elem := &svcapitypes.ExtendedKeyUsage{} - if f5iter.Name != "" { - f5elem.Name = aws.String(string(f5iter.Name)) + f8 := []*svcapitypes.ExtendedKeyUsage{} + for _, f8iter := range resp.Certificate.ExtendedKeyUsages { + f8elem := &svcapitypes.ExtendedKeyUsage{} + if f8iter.Name != "" { + f8elem.Name = aws.String(string(f8iter.Name)) } - if f5iter.OID != nil { - f5elem.OID = f5iter.OID + if f8iter.OID != nil { + f8elem.OID = f8iter.OID } - f5 = append(f5, f5elem) + f8 = append(f8, f8elem) } - ko.Status.ExtendedKeyUsages = f5 + ko.Status.ExtendedKeyUsages = f8 } else { ko.Status.ExtendedKeyUsages = nil } @@ -219,18 +219,23 @@ func (rm *resourceManager) sdkFind( ko.Spec.KeyAlgorithm = nil } if resp.Certificate.KeyUsages != nil { - f12 := []*svcapitypes.KeyUsage{} - for _, f12iter := range resp.Certificate.KeyUsages { - f12elem := &svcapitypes.KeyUsage{} - if f12iter.Name != "" { - f12elem.Name = aws.String(string(f12iter.Name)) + f15 := []*svcapitypes.KeyUsage{} + for _, f15iter := range resp.Certificate.KeyUsages { + f15elem := &svcapitypes.KeyUsage{} + if f15iter.Name != "" { + f15elem.Name = aws.String(string(f15iter.Name)) } - f12 = append(f12, f12elem) + f15 = append(f15, f15elem) } - ko.Status.KeyUsages = f12 + ko.Status.KeyUsages = f15 } else { ko.Status.KeyUsages = nil } + if resp.Certificate.ManagedBy != "" { + ko.Spec.ManagedBy = aws.String(string(resp.Certificate.ManagedBy)) + } else { + ko.Spec.ManagedBy = nil + } if resp.Certificate.NotAfter != nil { ko.Status.NotAfter = &metav1.Time{*resp.Certificate.NotAfter} } else { @@ -242,11 +247,14 @@ func (rm *resourceManager) sdkFind( ko.Status.NotBefore = nil } if resp.Certificate.Options != nil { - f15 := &svcapitypes.CertificateOptions{} + f19 := &svcapitypes.CertificateOptions{} if resp.Certificate.Options.CertificateTransparencyLoggingPreference != "" { - f15.CertificateTransparencyLoggingPreference = aws.String(string(resp.Certificate.Options.CertificateTransparencyLoggingPreference)) + f19.CertificateTransparencyLoggingPreference = aws.String(string(resp.Certificate.Options.CertificateTransparencyLoggingPreference)) + } + if resp.Certificate.Options.Export != "" { + f19.Export = aws.String(string(resp.Certificate.Options.Export)) } - ko.Spec.Options = f15 + ko.Spec.Options = f19 } else { ko.Spec.Options = nil } @@ -256,53 +264,63 @@ func (rm *resourceManager) sdkFind( ko.Status.RenewalEligibility = nil } if resp.Certificate.RenewalSummary != nil { - f17 := &svcapitypes.RenewalSummary{} + f21 := &svcapitypes.RenewalSummary{} if resp.Certificate.RenewalSummary.DomainValidationOptions != nil { - f17f0 := []*svcapitypes.DomainValidation{} - for _, f17f0iter := range resp.Certificate.RenewalSummary.DomainValidationOptions { - f17f0elem := &svcapitypes.DomainValidation{} - if f17f0iter.DomainName != nil { - f17f0elem.DomainName = f17f0iter.DomainName + f21f0 := []*svcapitypes.DomainValidation{} + for _, f21f0iter := range resp.Certificate.RenewalSummary.DomainValidationOptions { + f21f0elem := &svcapitypes.DomainValidation{} + if f21f0iter.DomainName != nil { + f21f0elem.DomainName = f21f0iter.DomainName } - if f17f0iter.ResourceRecord != nil { - f17f0elemf1 := &svcapitypes.ResourceRecord{} - if f17f0iter.ResourceRecord.Name != nil { - f17f0elemf1.Name = f17f0iter.ResourceRecord.Name + if f21f0iter.HttpRedirect != nil { + f21f0elemf1 := &svcapitypes.HTTPRedirect{} + if f21f0iter.HttpRedirect.RedirectFrom != nil { + f21f0elemf1.RedirectFrom = f21f0iter.HttpRedirect.RedirectFrom } - if f17f0iter.ResourceRecord.Type != "" { - f17f0elemf1.Type = aws.String(string(f17f0iter.ResourceRecord.Type)) + if f21f0iter.HttpRedirect.RedirectTo != nil { + f21f0elemf1.RedirectTo = f21f0iter.HttpRedirect.RedirectTo + } + f21f0elem.HTTPRedirect = f21f0elemf1 + } + if f21f0iter.ResourceRecord != nil { + f21f0elemf2 := &svcapitypes.ResourceRecord{} + if f21f0iter.ResourceRecord.Name != nil { + f21f0elemf2.Name = f21f0iter.ResourceRecord.Name } - if f17f0iter.ResourceRecord.Value != nil { - f17f0elemf1.Value = f17f0iter.ResourceRecord.Value + if f21f0iter.ResourceRecord.Type != "" { + f21f0elemf2.Type = aws.String(string(f21f0iter.ResourceRecord.Type)) } - f17f0elem.ResourceRecord = f17f0elemf1 + if f21f0iter.ResourceRecord.Value != nil { + f21f0elemf2.Value = f21f0iter.ResourceRecord.Value + } + f21f0elem.ResourceRecord = f21f0elemf2 } - if f17f0iter.ValidationDomain != nil { - f17f0elem.ValidationDomain = f17f0iter.ValidationDomain + if f21f0iter.ValidationDomain != nil { + f21f0elem.ValidationDomain = f21f0iter.ValidationDomain } - if f17f0iter.ValidationEmails != nil { - f17f0elem.ValidationEmails = aws.StringSlice(f17f0iter.ValidationEmails) + if f21f0iter.ValidationEmails != nil { + f21f0elem.ValidationEmails = aws.StringSlice(f21f0iter.ValidationEmails) } - if f17f0iter.ValidationMethod != "" { - f17f0elem.ValidationMethod = aws.String(string(f17f0iter.ValidationMethod)) + if f21f0iter.ValidationMethod != "" { + f21f0elem.ValidationMethod = aws.String(string(f21f0iter.ValidationMethod)) } - if f17f0iter.ValidationStatus != "" { - f17f0elem.ValidationStatus = aws.String(string(f17f0iter.ValidationStatus)) + if f21f0iter.ValidationStatus != "" { + f21f0elem.ValidationStatus = aws.String(string(f21f0iter.ValidationStatus)) } - f17f0 = append(f17f0, f17f0elem) + f21f0 = append(f21f0, f21f0elem) } - f17.DomainValidationOptions = f17f0 + f21.DomainValidationOptions = f21f0 } if resp.Certificate.RenewalSummary.RenewalStatus != "" { - f17.RenewalStatus = aws.String(string(resp.Certificate.RenewalSummary.RenewalStatus)) + f21.RenewalStatus = aws.String(string(resp.Certificate.RenewalSummary.RenewalStatus)) } if resp.Certificate.RenewalSummary.RenewalStatusReason != "" { - f17.RenewalStatusReason = aws.String(string(resp.Certificate.RenewalSummary.RenewalStatusReason)) + f21.RenewalStatusReason = aws.String(string(resp.Certificate.RenewalSummary.RenewalStatusReason)) } if resp.Certificate.RenewalSummary.UpdatedAt != nil { - f17.UpdatedAt = &metav1.Time{*resp.Certificate.RenewalSummary.UpdatedAt} + f21.UpdatedAt = &metav1.Time{*resp.Certificate.RenewalSummary.UpdatedAt} } - ko.Status.RenewalSummary = f17 + ko.Status.RenewalSummary = f21 } else { ko.Status.RenewalSummary = nil } @@ -477,29 +495,35 @@ func (rm *resourceManager) newCreateRequestPayload( if r.ko.Spec.KeyAlgorithm != nil { res.KeyAlgorithm = svcsdktypes.KeyAlgorithm(*r.ko.Spec.KeyAlgorithm) } + if r.ko.Spec.ManagedBy != nil { + res.ManagedBy = svcsdktypes.CertificateManagedBy(*r.ko.Spec.ManagedBy) + } if r.ko.Spec.Options != nil { - f4 := &svcsdktypes.CertificateOptions{} + f5 := &svcsdktypes.CertificateOptions{} if r.ko.Spec.Options.CertificateTransparencyLoggingPreference != nil { - f4.CertificateTransparencyLoggingPreference = svcsdktypes.CertificateTransparencyLoggingPreference(*r.ko.Spec.Options.CertificateTransparencyLoggingPreference) + f5.CertificateTransparencyLoggingPreference = svcsdktypes.CertificateTransparencyLoggingPreference(*r.ko.Spec.Options.CertificateTransparencyLoggingPreference) } - res.Options = f4 + if r.ko.Spec.Options.Export != nil { + f5.Export = svcsdktypes.CertificateExport(*r.ko.Spec.Options.Export) + } + res.Options = f5 } if r.ko.Spec.SubjectAlternativeNames != nil { res.SubjectAlternativeNames = aws.ToStringSlice(r.ko.Spec.SubjectAlternativeNames) } if r.ko.Spec.Tags != nil { - f6 := []svcsdktypes.Tag{} - for _, f6iter := range r.ko.Spec.Tags { - f6elem := &svcsdktypes.Tag{} - if f6iter.Key != nil { - f6elem.Key = f6iter.Key + f7 := []svcsdktypes.Tag{} + for _, f7iter := range r.ko.Spec.Tags { + f7elem := &svcsdktypes.Tag{} + if f7iter.Key != nil { + f7elem.Key = f7iter.Key } - if f6iter.Value != nil { - f6elem.Value = f6iter.Value + if f7iter.Value != nil { + f7elem.Value = f7iter.Value } - f6 = append(f6, *f6elem) + f7 = append(f7, *f7elem) } - res.Tags = f6 + res.Tags = f7 } return res, nil @@ -611,6 +635,9 @@ func (rm *resourceManager) newUpdateRequestPayload( if r.ko.Spec.Options.CertificateTransparencyLoggingPreference != nil { f1.CertificateTransparencyLoggingPreference = svcsdktypes.CertificateTransparencyLoggingPreference(*r.ko.Spec.Options.CertificateTransparencyLoggingPreference) } + if r.ko.Spec.Options.Export != nil { + f1.Export = svcsdktypes.CertificateExport(*r.ko.Spec.Options.Export) + } res.Options = f1 }