fix: harden effective_domains_pre_expansion + drop FACETS-REQUEST-ID

- effective_domains_pre_expansion: rebuild both ternary branches via
  dynamic-key `for` with explicit per-attribute reconstruction
  (tostring/tolist/tomap casts). Forces terraform to infer
  `map(object({uniform shape}))` regardless of whether the wrapper
  passes typed or untyped spec. Earlier `rules = {}` fix on the facets
  literal alone wasn't enough — terraform still inferred object-type
  on the LHS, leaving the inconsistent-conditional-result error.

- FACETS-REQUEST-ID header removed: dropped the auto-injected
  `proxy_set_header FACETS-REQUEST-ID $request_id` in the gateway
  SnippetsPolicy. Also stripped from the converter's auto-strip set
  so any user-defined facets-request-id in proxy_set_headers passes
  through. knowledge-base.md updated.

X-Request-ID continues to be auto-injected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

modules/ingress/nginx_gateway_fabric_capillary/1.0/convert_to_capillary.py

@@ -746,7 +746,7 @@ def convert_advanced_block(advanced, out_spec, report):
             if "proxySetHeaders" in controller:
                 psh = controller.pop("proxySetHeaders") or {}
                 if isinstance(psh, dict):
-                    auto = {"x-request-id", "facets-request-id"}
+                    auto = {"x-request-id"}
                     filtered = {k: v for k, v in psh.items() if k.lower() not in auto}
                     if filtered:
                         out_spec["proxy_set_headers"] = filtered

modules/ingress/nginx_gateway_fabric_capillary/1.0/knowledge-base.md

@@ -232,7 +232,7 @@ Rules can live in two places on the spec. Each domain is in **exactly one of thr
 | `ReferenceGrant` | One per external namespace referenced by a backend | Cross-namespace backends |
 | `AuthenticationFilter` | Basic auth filter | `spec.basic_auth: true` |
 | `ClientSettingsPolicy` | Request body size limit | Always created; reads `spec.body_size` |
-| `SnippetsPolicy` | Gateway-wide NGINX directives | `custom_log_format`, `underscores_in_headers`, `ip_access_control`, `proxy_buffer_size`, `proxy_buffers_number`, `proxy_set_headers`, plus always-on `X-Request-ID` / `FACETS-REQUEST-ID` headers |
+| `SnippetsPolicy` | Gateway-wide NGINX directives | `custom_log_format`, `underscores_in_headers`, `ip_access_control`, `proxy_buffer_size`, `proxy_buffers_number`, `proxy_set_headers`, plus always-on `X-Request-ID` header |
 | `SnippetsFilter` | Per-route NGINX directives | `rules.*.nginx_timeouts`, `configuration_snippet`, `server_snippet` |
 | `Certificate` (cert-manager) | One per cert-manager-issued domain | Domains without `certificate_reference`, or `use_dns01: true` |
 | `ClusterIssuer` (cert-manager) | HTTP-01 issuer bound to the Gateway's port 80 listener | Any HTTP-01 domain |
@@ -312,7 +312,7 @@ On first deploy, cert-manager has not yet issued the real cert. The module pre-c
 |---|---|
 | Access logs | NGF stdout. Format set by `spec.custom_log_format`; `log_format_escape: "json"` for structured logs. |
 | Metrics | Prometheus endpoints on data plane pods. Module creates a `PodMonitor` when `prometheus_details` is wired. |
-| Request correlation | Module injects `X-Request-ID` and `FACETS-REQUEST-ID` (set to NGINX `$request_id`). Extend via `spec.proxy_set_headers`. |
+| Request correlation | Module injects `X-Request-ID` (set to NGINX `$request_id`). Extend via `spec.proxy_set_headers`. |
 
 ---
 

modules/ingress/nginx_gateway_fabric_capillary/1.0/main.tf

@@ -86,8 +86,32 @@ locals {
   )
 
   # --- Effective domain state (after ACM/DNS-01 rewrites, before expansion) ---
-  effective_domains_pre_expansion = local.acm_mode ? lookup(var.instance.spec, "domains", {}) : local.modified_domains
-  effective_disable_base_domain   = local.acm_mode ? lookup(var.instance.spec, "disable_base_domain", false) : (local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false))
+  # Both branches rebuild via dynamic-key `for` with explicit attribute
+  # reconstruction. Terraform infers each side as `map(object({uniform shape}))`
+  # — without this, static keys force object-type inference and the ternary
+  # fails with "inconsistent conditional result types" (the synthetic `facets`
+  # key in modified_domains is absent from the raw spec domains, and the
+  # wrapper may pass untyped spec where the `rules` default isn't applied).
+  effective_domains_pre_expansion = local.acm_mode ? {
+    for k, v in lookup(var.instance.spec, "domains", {}) :
+    k => {
+      domain                = tostring(v.domain)
+      alias                 = tostring(v.alias)
+      certificate_reference = tostring(lookup(v, "certificate_reference", ""))
+      equivalent_prefixes   = [for p in lookup(v, "equivalent_prefixes", []) : tostring(p)]
+      rules                 = { for rk, rv in lookup(v, "rules", {}) : tostring(rk) => rv }
+    }
+    } : {
+    for k, v in local.modified_domains :
+    k => {
+      domain                = tostring(v.domain)
+      alias                 = tostring(v.alias)
+      certificate_reference = tostring(lookup(v, "certificate_reference", ""))
+      equivalent_prefixes   = [for p in lookup(v, "equivalent_prefixes", []) : tostring(p)]
+      rules                 = { for rk, rv in lookup(v, "rules", {}) : tostring(rk) => rv }
+    }
+  }
+  effective_disable_base_domain = local.acm_mode ? lookup(var.instance.spec, "disable_base_domain", false) : (local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false))
 
   # --- Final domains (no expansion — equivalent_prefixes is a rule-routing key, not domain multiplication) ---
   add_base_domain = local.effective_disable_base_domain ? {} : {
@@ -1092,11 +1116,10 @@ locals {
   ])
 
   gateway_snippet_http_server_location = compact([
-    # Feature 11: proxySetHeaders (always include X-Request-ID + FACETS-REQUEST-ID + custom)
+    # Feature 11: proxySetHeaders (always include X-Request-ID + custom)
     join("\n", concat(
       [
         "proxy_set_header X-Request-ID $request_id;",
-        "proxy_set_header FACETS-REQUEST-ID $request_id;"
       ],
       [for header_name, header_value in lookup(var.instance.spec, "proxy_set_headers", {}) :
         "proxy_set_header ${header_name} ${header_value};"