chore: clarify isCertValid

Author: Kamil Przybyl

pkg/alb/ingress/alb_spec.go

@@ -351,8 +351,10 @@ func (r *IngressClassReconciler) cleanupCerts(ctx context.Context, ingressClass
 	return nil
 }
 
-// isCertValid checks if the certificate chain is complete. It is used for checking if
-// the cert-manager's ACME challenge is completed, or if it's sill ongoing.
+// isCertValid returns true only if the certificate chain is complete (leaf + intermediates).
+// This is critical because the Certificates API lacks an update method; once a certificate 
+// is created, it is immutable. We must wait for the full chain to avoid being stuck with 
+// a temporary placeholder or an incomplete ACME response that cannot be corrected.
 func isCertValid(secret *corev1.Secret) (bool, error) {
 	tlsCert := secret.Data["tls.crt"]
 	if tlsCert == nil {
@@ -380,7 +382,7 @@ func isCertValid(secret *corev1.Secret) (bool, error) {
 		certs = append(certs, cert)
 	}
 
-	// If there are multiple certificates, it means the chain is likely complete
+    // A single block is often an incomplete ACME response.
 	return len(certs) > 1, nil
 }