Skip to content

Commit b23bac8

Browse files
sanmesh-kakadeclaude
sanmesh-kakade
and
claude
committed
refactor: consolidate DNS-01 and ACK ACM helm releases into utility module (#535)
Move dns01_certificate and ack_acm_certificate resources from separate helm releases into the utility module's gateway_api_resources_base release via the new additional_base_resources input variable. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent e523d41 commit b23bac8

3 files changed

Lines changed: 109 additions & 140 deletions

File tree

  • modules/ingress
    • nginx_gateway_fabric_legacy_aws/1.0
    • nginx_gateway_fabric_legacy_azure/1.0
    • nginx_gateway_fabric_legacy_gcp/1.0

‎modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf‎

Lines changed: 55 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,60 @@ locals {
143143
"service.beta.kubernetes.io/aws-load-balancer-ssl-ports" = "443"
144144
} : {}
145145
)
146+
147+
# ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
148+
# and exports them to K8s TLS secrets for Gateway listener consumption.
149+
ack_acm_resources = local.use_ack_acm ? {
150+
for domain_key, domain in local.acm_cert_domains :
151+
"ack-acm-cert-${domain_key}" => {
152+
apiVersion = "acm.services.k8s.aws/v1alpha1"
153+
kind = "Certificate"
154+
metadata = {
155+
name = "${local.name}-acm-cert-${domain_key}"
156+
namespace = var.environment.namespace
157+
}
158+
spec = {
159+
domainName = "*.${domain.domain}"
160+
subjectAlternativeNames = [
161+
domain.domain,
162+
"*.${domain.domain}"
163+
]
164+
validationMethod = "DNS"
165+
options = {
166+
certificateTransparencyLoggingPreference = "ENABLED"
167+
}
168+
exportTo = {
169+
namespace = var.environment.namespace
170+
name = local.acm_cert_secret_names[domain_key]
171+
key = "tls.crt"
172+
}
173+
}
174+
}
175+
} : {}
176+
177+
# DNS-01 wildcard certificate resources for cert-manager
178+
dns01_certificate_resources = {
179+
for domain_key, domain in local.all_dns01_domains :
180+
"dns01-cert-${domain_key}" => {
181+
apiVersion = "cert-manager.io/v1"
182+
kind = "Certificate"
183+
metadata = {
184+
name = "${local.name}-dns01-cert-${domain_key}"
185+
namespace = var.environment.namespace
186+
}
187+
spec = {
188+
secretName = local.dns01_cert_secret_names[domain_key]
189+
issuerRef = {
190+
name = local.dns01_cluster_issuer
191+
kind = "ClusterIssuer"
192+
}
193+
dnsNames = [
194+
domain.domain,
195+
"*.${domain.domain}"
196+
]
197+
}
198+
}
199+
}
146200
}
147201

148202
# Call the base utility module
@@ -168,44 +222,8 @@ module "nginx_gateway_fabric" {
168222
}]
169223
}
170224
}
171-
}
172-
173-
# ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
174-
# and exports them to K8s TLS secrets for Gateway listener consumption.
175-
# Only created when ACK controller is available and domains have ACM ARNs.
176-
# When ACK is not available, ACM certs are attached directly to the NLB instead.
177-
module "ack_acm_certificate" {
178-
for_each = local.use_ack_acm ? local.acm_cert_domains : {}
179-
180-
source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
181-
name = "${local.name}-acm-cert-${each.key}"
182-
namespace = var.environment.namespace
183-
advanced_config = {}
184225

185-
data = {
186-
apiVersion = "acm.services.k8s.aws/v1alpha1"
187-
kind = "Certificate"
188-
metadata = {
189-
name = "${local.name}-acm-cert-${each.key}"
190-
namespace = var.environment.namespace
191-
}
192-
spec = {
193-
domainName = "*.${each.value.domain}"
194-
subjectAlternativeNames = [
195-
each.value.domain,
196-
"*.${each.value.domain}"
197-
]
198-
validationMethod = "DNS"
199-
options = {
200-
certificateTransparencyLoggingPreference = "ENABLED"
201-
}
202-
exportTo = {
203-
namespace = var.environment.namespace
204-
name = local.acm_cert_secret_names[each.key]
205-
key = "tls.crt"
206-
}
207-
}
208-
}
226+
additional_base_resources = merge(local.ack_acm_resources, local.dns01_certificate_resources)
209227
}
210228

211229
# Pre-create empty TLS secrets for ACK ACM certificate export
@@ -231,39 +249,6 @@ resource "kubernetes_secret_v1" "acm_cert" {
231249
}
232250
}
233251

234-
# --- DNS-01 wildcard certificate resources ---
235-
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
236-
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
237-
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
238-
module "dns01_certificate" {
239-
for_each = local.all_dns01_domains
240-
241-
source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
242-
name = "${local.name}-dns01-cert-${each.key}"
243-
namespace = var.environment.namespace
244-
advanced_config = {}
245-
246-
data = {
247-
apiVersion = "cert-manager.io/v1"
248-
kind = "Certificate"
249-
metadata = {
250-
name = "${local.name}-dns01-cert-${each.key}"
251-
namespace = var.environment.namespace
252-
}
253-
spec = {
254-
secretName = local.dns01_cert_secret_names[each.key]
255-
issuerRef = {
256-
name = local.dns01_cluster_issuer
257-
kind = "ClusterIssuer"
258-
}
259-
dnsNames = [
260-
each.value.domain,
261-
"*.${each.value.domain}"
262-
]
263-
}
264-
}
265-
}
266-
267252
# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
268253
# to start. cert-manager will overwrite these once the DNS-01 challenge succeeds.
269254
resource "tls_private_key" "dns01_bootstrap" {

‎modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf‎

Lines changed: 27 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ locals {
6060
# When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
6161
modified_instance = merge(var.instance, {
6262
spec = merge(var.instance.spec, {
63-
domains = local.modified_domains
63+
domains = local.modified_domains
6464
disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
6565
})
6666
})
@@ -86,6 +86,30 @@ locals {
8686
azure_annotations = {
8787
"service.beta.kubernetes.io/azure-load-balancer-internal" = lookup(var.instance.spec, "private", false) ? "true" : "false"
8888
}
89+
90+
# DNS-01 wildcard certificate resources for cert-manager
91+
dns01_certificate_resources = {
92+
for domain_key, domain in local.all_dns01_domains :
93+
"dns01-cert-${domain_key}" => {
94+
apiVersion = "cert-manager.io/v1"
95+
kind = "Certificate"
96+
metadata = {
97+
name = "${local.name}-dns01-cert-${domain_key}"
98+
namespace = var.environment.namespace
99+
}
100+
spec = {
101+
secretName = local.dns01_cert_secret_names[domain_key]
102+
issuerRef = {
103+
name = local.dns01_cluster_issuer
104+
kind = "ClusterIssuer"
105+
}
106+
dnsNames = [
107+
domain.domain,
108+
"*.${domain.domain}"
109+
]
110+
}
111+
}
112+
}
89113
}
90114

91115
# Call the base utility module
@@ -97,40 +121,8 @@ module "nginx_gateway_fabric" {
97121
environment = var.environment
98122
inputs = local.merged_inputs
99123

100-
service_annotations = local.azure_annotations
101-
}
102-
103-
# --- DNS-01 wildcard certificate resources ---
104-
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
105-
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
106-
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
107-
module "dns01_certificate" {
108-
for_each = local.all_dns01_domains
109-
110-
source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
111-
name = "${local.name}-dns01-cert-${each.key}"
112-
namespace = var.environment.namespace
113-
advanced_config = {}
114-
115-
data = {
116-
apiVersion = "cert-manager.io/v1"
117-
kind = "Certificate"
118-
metadata = {
119-
name = "${local.name}-dns01-cert-${each.key}"
120-
namespace = var.environment.namespace
121-
}
122-
spec = {
123-
secretName = local.dns01_cert_secret_names[each.key]
124-
issuerRef = {
125-
name = local.dns01_cluster_issuer
126-
kind = "ClusterIssuer"
127-
}
128-
dnsNames = [
129-
each.value.domain,
130-
"*.${each.value.domain}"
131-
]
132-
}
133-
}
124+
service_annotations = local.azure_annotations
125+
additional_base_resources = local.dns01_certificate_resources
134126
}
135127

136128
# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret

‎modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf‎

Lines changed: 27 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ locals {
6060
# When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
6161
modified_instance = merge(var.instance, {
6262
spec = merge(var.instance.spec, {
63-
domains = local.modified_domains
63+
domains = local.modified_domains
6464
disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
6565
})
6666
})
@@ -88,6 +88,30 @@ locals {
8888
"networking.gke.io/load-balancer-type" = "Internal"
8989
"networking.gke.io/internal-load-balancer-allow-global-access" = "true"
9090
} : {}
91+
92+
# DNS-01 wildcard certificate resources for cert-manager
93+
dns01_certificate_resources = {
94+
for domain_key, domain in local.all_dns01_domains :
95+
"dns01-cert-${domain_key}" => {
96+
apiVersion = "cert-manager.io/v1"
97+
kind = "Certificate"
98+
metadata = {
99+
name = "${local.name}-dns01-cert-${domain_key}"
100+
namespace = var.environment.namespace
101+
}
102+
spec = {
103+
secretName = local.dns01_cert_secret_names[domain_key]
104+
issuerRef = {
105+
name = local.dns01_cluster_issuer
106+
kind = "ClusterIssuer"
107+
}
108+
dnsNames = [
109+
domain.domain,
110+
"*.${domain.domain}"
111+
]
112+
}
113+
}
114+
}
91115
}
92116

93117
# Call the base utility module
@@ -99,40 +123,8 @@ module "nginx_gateway_fabric" {
99123
environment = var.environment
100124
inputs = local.merged_inputs
101125

102-
service_annotations = local.gcp_annotations
103-
}
104-
105-
# --- DNS-01 wildcard certificate resources ---
106-
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
107-
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
108-
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
109-
module "dns01_certificate" {
110-
for_each = local.all_dns01_domains
111-
112-
source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
113-
name = "${local.name}-dns01-cert-${each.key}"
114-
namespace = var.environment.namespace
115-
advanced_config = {}
116-
117-
data = {
118-
apiVersion = "cert-manager.io/v1"
119-
kind = "Certificate"
120-
metadata = {
121-
name = "${local.name}-dns01-cert-${each.key}"
122-
namespace = var.environment.namespace
123-
}
124-
spec = {
125-
secretName = local.dns01_cert_secret_names[each.key]
126-
issuerRef = {
127-
name = local.dns01_cluster_issuer
128-
kind = "ClusterIssuer"
129-
}
130-
dnsNames = [
131-
each.value.domain,
132-
"*.${each.value.domain}"
133-
]
134-
}
135-
}
126+
service_annotations = local.gcp_annotations
127+
additional_base_resources = local.dns01_certificate_resources
136128
}
137129

138130
# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret

0 commit comments

Comments
 (0)