fix(nginx_gateway_fabric_aws): auto-issue ACM cert for base domain in acm_mode

[sanmesh-kakade]

Problem

In acm_mode — an ACM ARN is supplied as a domain's certificate_reference and no ACK ACM controller is present — TLS terminates at the NLB and the wrapper sets external_tls_termination=true, which disables cert-manager in the base module.

The base domain carries no certificate_reference, so it contributed no ARN to the service.beta.kubernetes.io/aws-load-balancer-ssl-cert annotation. Result: base-domain HTTPS fell back to the NLB default certificate (first ARN in the list) and failed hostname validation unless a user-supplied ACM cert coincidentally SAN'd the base domain.

Two independent code paths caused it:

• certmanager_managed_domains = var.external_tls_termination ? {} : {...} (base module) → cert-manager issues nothing in acm_mode.
• The wrapper's acm_cert_arns only scanned spec.domains (user overrides). The base domain is injected inside the base module, so the wrapper never saw it.

Fix

Port the base-domain ACM handling from the capillary flavour (Facets-cloud/ingress-migration@init/nginx_gateway_fabric_capillary). When acm_mode is active and the base domain is enabled on AWS:

1. Issue an ACM certificate covering base_domain + *.base_domain (DNS validation).
2. Publish its validation records to the tooling-account Route53 zone.
3. Append the validated ARN to local.acm_cert_arns → always lands in the ssl-cert annotation.

base_domain is derived in the wrapper from the same control-plane metadata the base module uses (data.external.cc_env), not the base module's output — this avoids a dependency cycle (base_domain → ssl-cert annotation → base module input).

Provider split (cross-account) — reviewer note

Matches capillary:

• aws_acm_certificate / aws_acm_certificate_validation → default aws provider (workload account + region; an ACM cert attached to an NLB must be in the same account/region as the NLB).
• aws_route53_record (DNS validation) + data.aws_route53_zone → aws3tooling (tooling-account Route53 zone).

Both providers are injected at deploy time by the iac-generator (same as nginx_k8s and the base module) — no required_providers in module source, per repo convention (facets_default_providers).

Guards

• Fires only when acm_mode == true, disable_base_domain != true, and tenant_provider == "aws".
• When acm_mode is false, the base domain keeps using cert-manager (unchanged).
• disable_base_domain = true → zero base-ACM resources.

Validation

• terraform fmt clean.
• raptor ... --dry-run terraform init fails on aws3tooling — pre-existing and inherent to deploy-time provider injection; the pristine module fails identically (verified). Real validation happens on CP upload where providers are injected.

⚠️ Not yet applied against the Control Plane. Needs a real plan/apply in a sandbox to confirm: base-ACM cert issued, ssl-cert annotation shows ≥2 ARNs incl. base, and curl https://<base_domain> returns a valid cert.

Follow-up / maintenance note

base_domain derivation is now duplicated in the wrapper and the base module and must stay byte-for-byte in sync (flagged in a code comment). Worth considering a shared source later.

🤖 Generated with Claude Code