Own certificate should be taken as a primary certificate instead of the newly created one

[sybernatus]

Discussed in https://github.com/bitnami-labs/sealed-secrets/discussions/1576

Hello,

We are trying to use our own certificate to encrypt secrets. The issue we encounter actually is that for a controller installation, this certificate is not used as primary certificate.

Here is the flow:

• we deploy our own certificate as a secret
• afterward we deploy sealed-secret controller

In this case, our certificate is taken into account by the controller as we can see it in the log but also as it is a new instance of sealed secret, the controller will create its own certificate. As its own certificate is newer, it will take it as a primary certificate and kubeseal will use this one to encrypt secrets.

Our workaround today is to redeploy again our own certificate but I think it's an issue from the controller.

I think, that if the controller see that there is an existing certificate created, it should avoid creating its own certificate and just use the created one. This might be tackled for example, using a new arguments to the controller (--cert-creation=false). The idea is to let the control to the project if it wants the control over the certificates used by the controller.

What do you thing?

Here is the flow impacted by this idea: https://github.com/bitnami-labs/sealed-secrets/blob/15df23bb25ac009b27eedd0ea8f3501334a06884/pkg/controller/main.go#L64