Skip to content

IBM Cloud Secrets Manager Imported Cert does not always require intermediate cert #5371

@varksvader

Description

@varksvader

Describe the bug
In IBM Cloud Secrets Manager, when you create an imported cert, the intermediate and private key is not required to be provided and is listed as optional.
Screenshot 2025-09-24 at 10 49 24 PM

As a user of the plugin, we created a imported cert type with a certificate and private key, but no intermediate cert. Our ESO component which is a direct mirror of this repo gave us the error

error processing spec.dataFrom[0].extract, err: key intermediate does not exist in secret <secret name>

Searching through this repo, we realized that the plugin expects intermediate certificate to be there even when the UI as shown above and the documentation don't list it as a required field for this kind of secret type.

To Reproduce
Steps to reproduce the behavior:

  1. Create imported_cert secret with only certificate provided
  2. Create External Secret for the secret created in one
  3. Apply External Secret on Kubernetes cluster and see an error during the processing of the External Secret
error processing spec.dataFrom[0].extract, err: key intermediate does not exist in secret <secret name>

Kubernetes version: 1.32
ESO Version: 0.16.1

Expected behavior
When creating an imported_cert secret type through IBM Cloud Secrets Manager and syncing it with ESO, one should be able to skip syncing the intermediate cert value if not provided.

Screenshots
See above

Additional context
N/A

Metadata

Metadata

Assignees

Labels

area/ibmIssues / Pull Requests related to ibm providerkind/bugCategorizes issue or PR as related to a bug.

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions