cherry-pick: dual-mode TLS + ACK ACM controller from fabric-fixes#525
Merged
Conversation
sanmesh-kakade
requested review from
anshulsao,
ishaankalra,
pramodh-ayyappan,
rr0hit,
unni-facets and
vishnukv-facets
as code owners
March 19, 2026 06:59
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (26)
WalkthroughAdds an ACK ACM Controller module and cloud-specific legacy wrappers (AWS, Azure, GCP) around nginx_gateway_fabric, introducing ACM integration, DNS-01 wildcard automation, certificate bootstrapping, and Route53 record management while removing the original nginx_gateway_fabric_legacy base implementation. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Terraform
participant EKS as Kubernetes (EKS)
participant AWS as AWS ACM / IAM
participant Route53
rect rgba(0,128,0,0.5)
User->>Terraform: apply modules/ack_acm_controller
end
Terraform->>AWS: create aws_iam_policy
Terraform->>AWS: create IRSA role (module.irsa)
Terraform->>EKS: create ServiceAccount annotated with role ARN
Terraform->>EKS: helm_release ack-acm-controller (install chart)
EKS->>AWS: ACK controller uses IRSA to call ACM APIs
AWS-->>EKS: ACM issues certificates / ACK exports TLS secrets
Terraform->>Route53: (when DNS-01 enabled) create base and wildcard records
Possibly related PRs
Suggested Reviewers
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Trivy (0.69.3)Trivy execution failed: Unknown error Comment |
sanmesh-kakade
force-pushed
the
cherry-pick/dual-mode-tls-aws
branch
2 times, most recently
from
March 19, 2026 07:11
f7976bd to
2e4909c
Compare
…ti-domain outputs - Azure: always set load-balancer-internal annotation (true/false) - OVH: add loadbalancer.ovhcloud.com/flavor annotation - Migrate kubernetes_secret to kubernetes_secret_v1 (deprecated) - Wildcard hostname for certificate_reference domains (*.domain) - ParentRef: subdomain routes use wildcard domain listener when cert_ref present - Filter additional_hostname_configs to exclude cert_ref covered subdomains - cross_namespace_backends: use distinct() to avoid duplicate key error - ClusterIssuer count guard: use certmanager_managed_domains length - Output interfaces: multi-domain rule × domain cross-product - tls_secret: map of domain keys to cert secret names - Add missing outputs: lb_record_value, record_type, name, base_domain, etc. - Remove ACM-specific sections from README (ACM will be in cloud-specific module) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…tes via ACK Deploys the AWS ACK ACM Controller on EKS via Helm with IRSA. Enables managing ACM certificates as Kubernetes CRDs and exporting them to K8s TLS secrets for use with Gateway API listeners. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… cert support AWS-specific wrapper for nginx_gateway_fabric with NLB, Proxy Protocol v2, ACM certificate integration, and DNS-01 wildcard certificate support. When use_dns01 is enabled, all domain listeners switch to wildcard hostnames (*.domain) and certificates are issued via a pre-existing ClusterIssuer (default: gts-production). Base domain is also covered by DNS-01 when active. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When use_dns01=true, we set disable_base_domain=true internally to take over base domain management, which causes the utility module to skip Route53 record creation. Create the records in the AWS wrapper instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ove old legacy module - Add nginx_gateway_fabric_legacy_gcp and nginx_gateway_fabric_legacy_azure modules with DNS-01 wildcard cert support (no ACM) - Pass var.environment.default_tolerations to utility module via merged inputs in all three wrapper modules (AWS, GCP, Azure) - Update migration script and docs to target nginx_gateway_fabric_legacy_aws - Remove standalone nginx_gateway_fabric_legacy module (replaced by cloud-specific wrappers) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove permissions that allow creating, importing, deleting, renewing, or modifying ACM certificates. The controller now only needs to adopt and sync existing certificates via AdoptedResource. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Required for exportTo to work with adopted certificates. This permission only reads existing cert data (cert body + private key), does not create new certificates. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds ACM mode detection: when domains have ACM ARNs as certificate_reference and no ACK controller is available, TLS terminates at the NLB instead of the Gateway pod. - Detects ACM mode via certificate_reference + ACK controller presence - Adds NLB ssl-cert/ssl-ports annotations in ACM mode - Passes var.instance as-is in ACM mode (no domain rewriting) - Gates ACK Certificate CRD resources on ACK controller availability - Passes external_tls_termination=true to base utility module Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove temporary branch ref from utility module source - Disable DNS-01 when ACM mode is active (incompatible) - Fix inconsistent conditional types in modified_instance - Update README with dual-mode TLS architecture and examples Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use distinct() to avoid duplicate ARNs when multiple domains share the same ACM wildcard certificate. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
sanmesh-kakade
force-pushed
the
cherry-pick/dual-mode-tls-aws
branch
from
March 19, 2026 07:18
73e5b85 to
a537c8b
Compare
unni-facets
approved these changes
Mar 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-pick of PR #524 (and related ACK ACM controller commits) from
fabric-fixestomaster.Included commits
Dual-mode TLS
Automatically selects TLS termination point based on configuration:
See PR #524 for full details.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Deprecated