Own certificate should be taken as a primary certificate instead of the newly created one

[sybernatus]

Hello,

We are trying to use our own certificate to encrypt secrets.
The issue we encounter actually is that for a controller installation, this certificate is not used as primary certificate.

Here is the flow:

• we deploy our own certificate as a secret
• afterward we deploy sealed-secret controller

In this case, our certificate is taken into account by the controller as we can see it in the log but also as it is a new instance of sealed secret, the controller will create its own certificate.
As its own certificate is newer, it will take it as a primary certificate and kubeseal will use this one to encrypt secrets.

Our workaround today encrypt our secret directly using our own certificate but I think it's an issue for kubeseal.

I think, that if the controller see that there is an existing certificate created, it should avoid creating its own certificate and just use the created one. This might be tackled for example, using a new arguments to the controller (--cert-creation=false).
The idea is to let the control to the project if it wants the control over the certificates used by the controller.

What do you thing?

Here is the flow impacted by this idea:

sealed-secrets/pkg/controller/main.go

Line 64 in 15df23b

func initKeyRegistry(ctx context.Context, client kubernetes.Interface, r io.Reader, namespace, prefix, label string, keysize int) (*KeyRegistry, error) {