[ACM] Re-import over spec.certificateARN always fails: "Tagging is not permitted on re-import"

[blinohod]

Describe the bug

spec.certificateARN on a Certificate is documented as the way to re-import
material over an existing ACM certificate, but it can never succeed. ACM rejects
ImportCertificate if the request carries Tags and CertificateArn together
("Tagging is not permitted on re-import"), and the controller seems always sends
Tags, even if these are not set in Certificate CR.

Suspected cause: newImportCertificateInput copies Spec.Tags into the request under a
bare nil check with no check for CertificateArn, while the ACK runtime's
EnsureTags populates Spec.Tags before every create and fromACKTags returns
an empty slice rather than nil.

Steps to reproduce

Install the controller with stock chart values — only aws.region is set:

helm install ack-acm-controller \
  oci://public.ecr.aws/aws-controllers-k8s/acm-chart --version 1.8.1 \
  --namespace ack-system --create-namespace \
  --set aws.region=us-east-1

1. Create an imported certificate in ACM, outside ACK. Self-signed is
sufficient; ACM does not validate ownership of an imported certificate's domains.

openssl req -x509 -newkey rsa:2048 -nodes -days 90 \
  -keyout v1.key -out v1.crt \
  -subj "/CN=repro.example.com" \
  -addext "subjectAltName=DNS:repro.example.com"

aws acm import-certificate \
  --certificate fileb://v1.crt --private-key fileb://v1.key \
  --query CertificateArn --output text
# arn:aws:acm:us-east-1:111122223333:certificate/11111111-2222-3333-4444-555555555555

2. Generate new material to rotate to — same CN, two additional SANs, so the
change is visible in DescribeCertificate:

openssl req -x509 -newkey rsa:2048 -nodes -days 90 \
  -keyout v2.key -out v2.crt \
  -subj "/CN=repro.example.com" \
  -addext "subjectAltName=DNS:repro.example.com,DNS:alt1.repro.example.com,DNS:alt2.repro.example.com"

kubectl create secret generic acm-reimport-repro -n ack-system \
  --from-file=tls.crt=v2.crt --from-file=tls.key=v2.key

3. Apply a Certificate that re-imports over that ARN. Note there is no
spec.tags:

apiVersion: acm.services.k8s.aws/v1alpha1
kind: Certificate
metadata:
  name: acm-reimport-repro
  namespace: ack-system
spec:
  certificateARN: arn:aws:acm:us-east-1:111122223333:certificate/11111111-2222-3333-4444-555555555555
  certificate:
    name: acm-reimport-repro
    key: tls.crt
  privateKey:
    name: acm-reimport-repro
    key: tls.key

4. Read the conditions. The CR never becomes Ready:

$ kubectl get certificate acm-reimport-repro -n ack-system \
    -o 'jsonpath={range .status.conditions[*]}{.type}={.status}{"  "}{.message}{"\n"}{end}'

ACK.Recoverable=True     ValidationException: Tagging is not permitted on re-import.
ACK.ResourceSynced=Unknown  Unable to determine if desired resource state matches latest observed state
Ready=False              ValidationException: Tagging is not permitted on re-import.

status.ackResourceMetadata.arn stays empty, so the CR owns nothing, and the
controller retries indefinitely:

"error":"operation error ACM: ImportCertificate, https response error StatusCode: 400,
 RequestID: <id>, ValidationException: Tagging is not permitted on re-import."

The certificate in ACM is untouched — same serial, same single SAN, same
ImportedAt.

5. Control: the identical call without Tags is accepted. Same ARN, same
material, same account and region:

aws acm import-certificate \
  --certificate-arn arn:aws:acm:us-east-1:111122223333:certificate/11111111-2222-3333-4444-555555555555 \
  --certificate fileb://v2.crt --private-key fileb://v2.key

The serial and ImportedAt move, the certificate goes from 1 SAN to 3, the ARN
is unchanged and tags are preserved. So ACM supports the operation; only the
controller cannot perform it.

Expected outcome

A Certificate with spec.certificateARN set replaces the material under that
ARN, keeps the existing tags, and reaches Ready=True, matching
aws acm import-certificate --certificate-arn with no --tags.

Environment

• Kubernetes version: 1.36
• Using EKS: yes, platform eks.9
• AWS service targeted: ACM
• Controller version: acm-controller v1.8.1, chart acm-chart 1.8.1

[github-actions]

Hello @blinohod 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.