cherry-pick: dual-mode TLS + ACK ACM controller from fabric-fixes#525

Merged

sanmesh-kakade merged 13 commits into

cherry-pick/dual-mode-tls-aws

Mar 19, 2026

Commits on Mar 19, 2026

Fix nginx_gateway_fabric_legacy: annotations, wildcard listeners, multi-domain outputs

sanmesh-kakade
and
claude
committed
feat: add ack_acm_controller legacy module for managing ACM certificates via ACK

sanmesh-kakade
and
claude
committed
feat: add nginx_gateway_fabric_legacy_aws module with DNS-01 wildcard cert support

sanmesh-kakade
and
claude
committed
fix: add Route53 records for base domain when use_dns01 is active

sanmesh-kakade
and
claude
committed
fix: rename Route53 resources to match utility module naming convention

sanmesh-kakade
and
claude
committed
feat: add GCP and Azure legacy modules, pass default_tolerations, remove old legacy module

sanmesh-kakade
and
claude
committed
fix: remove leftover migration files from deleted legacy module

sanmesh-kakade
and
claude
committed
Restrict ACK ACM controller IAM policy to read-only access

sanmesh-kakade
and
claude
committed
Add acm:ExportCertificate to IAM policy for adopted cert export

sanmesh-kakade
and
claude
committed
feat: dual-mode TLS for NGINX Gateway Fabric AWS module

sanmesh-kakade
and
claude
committed
feat: dual-mode TLS, DNS-01/ACM guard, remove branch ref, update README

sanmesh-kakade
and
claude
committed
fix: deduplicate ACM ARNs in NLB ssl-cert annotation

sanmesh-kakade
and
claude
committed
remove export permission
sanmesh-kakade
committed