Skip to content

refactor: consolidate DNS-01 and ACK ACM helm releases into utility module #536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sanmesh-kakade merged 1 commit into from
Mar 20, 2026
Merged

refactor: consolidate DNS-01 and ACK ACM helm releases into utility module #536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
125 changes: 55 additions & 70 deletions modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,60 @@ locals {
"service.beta.kubernetes.io/aws-load-balancer-ssl-ports" = "443"
} : {}
)

# ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
# and exports them to K8s TLS secrets for Gateway listener consumption.
ack_acm_resources = local.use_ack_acm ? {
for domain_key, domain in local.acm_cert_domains :
"ack-acm-cert-${domain_key}" => {
apiVersion = "acm.services.k8s.aws/v1alpha1"
kind = "Certificate"
metadata = {
name = "${local.name}-acm-cert-${domain_key}"
namespace = var.environment.namespace
}
spec = {
domainName = "*.${domain.domain}"
subjectAlternativeNames = [
domain.domain,
"*.${domain.domain}"
]
validationMethod = "DNS"
options = {
certificateTransparencyLoggingPreference = "ENABLED"
}
exportTo = {
namespace = var.environment.namespace
name = local.acm_cert_secret_names[domain_key]
key = "tls.crt"
}
}
}
} : {}

# DNS-01 wildcard certificate resources for cert-manager
dns01_certificate_resources = {
for domain_key, domain in local.all_dns01_domains :
"dns01-cert-${domain_key}" => {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${domain_key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[domain_key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
domain.domain,
"*.${domain.domain}"
]
}
}
}
}

# Call the base utility module
Expand All @@ -168,44 +222,8 @@ module "nginx_gateway_fabric" {
}]
}
}
}

# ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller
# and exports them to K8s TLS secrets for Gateway listener consumption.
# Only created when ACK controller is available and domains have ACM ARNs.
# When ACK is not available, ACM certs are attached directly to the NLB instead.
module "ack_acm_certificate" {
for_each = local.use_ack_acm ? local.acm_cert_domains : {}

source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
name = "${local.name}-acm-cert-${each.key}"
namespace = var.environment.namespace
advanced_config = {}

data = {
apiVersion = "acm.services.k8s.aws/v1alpha1"
kind = "Certificate"
metadata = {
name = "${local.name}-acm-cert-${each.key}"
namespace = var.environment.namespace
}
spec = {
domainName = "*.${each.value.domain}"
subjectAlternativeNames = [
each.value.domain,
"*.${each.value.domain}"
]
validationMethod = "DNS"
options = {
certificateTransparencyLoggingPreference = "ENABLED"
}
exportTo = {
namespace = var.environment.namespace
name = local.acm_cert_secret_names[each.key]
key = "tls.crt"
}
}
}
additional_base_resources = merge(local.ack_acm_resources, local.dns01_certificate_resources)
}

# Pre-create empty TLS secrets for ACK ACM certificate export
Expand All @@ -231,39 +249,6 @@ resource "kubernetes_secret_v1" "acm_cert" {
}
}

# --- DNS-01 wildcard certificate resources ---
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
module "dns01_certificate" {
for_each = local.all_dns01_domains

source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
advanced_config = {}

data = {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[each.key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
each.value.domain,
"*.${each.value.domain}"
]
}
}
}

# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
# to start. cert-manager will overwrite these once the DNS-01 challenge succeeds.
resource "tls_private_key" "dns01_bootstrap" {
Expand Down
62 changes: 27 additions & 35 deletions modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ locals {
# When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
modified_instance = merge(var.instance, {
spec = merge(var.instance.spec, {
domains = local.modified_domains
domains = local.modified_domains
disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
})
})
Expand All @@ -86,6 +86,30 @@ locals {
azure_annotations = {
"service.beta.kubernetes.io/azure-load-balancer-internal" = lookup(var.instance.spec, "private", false) ? "true" : "false"
}

# DNS-01 wildcard certificate resources for cert-manager
dns01_certificate_resources = {
for domain_key, domain in local.all_dns01_domains :
"dns01-cert-${domain_key}" => {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${domain_key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[domain_key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
domain.domain,
"*.${domain.domain}"
]
}
}
}
}

# Call the base utility module
Expand All @@ -97,40 +121,8 @@ module "nginx_gateway_fabric" {
environment = var.environment
inputs = local.merged_inputs

service_annotations = local.azure_annotations
}

# --- DNS-01 wildcard certificate resources ---
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
module "dns01_certificate" {
for_each = local.all_dns01_domains

source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
advanced_config = {}

data = {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[each.key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
each.value.domain,
"*.${each.value.domain}"
]
}
}
service_annotations = local.azure_annotations
additional_base_resources = local.dns01_certificate_resources
}

# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
Expand Down
62 changes: 27 additions & 35 deletions modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ locals {
# When DNS-01 is active: disable_base_domain=true (we re-add it ourselves with certificate_reference)
modified_instance = merge(var.instance, {
spec = merge(var.instance.spec, {
domains = local.modified_domains
domains = local.modified_domains
disable_base_domain = local.use_dns01 && !lookup(var.instance.spec, "disable_base_domain", false) ? true : lookup(var.instance.spec, "disable_base_domain", false)
})
})
Expand Down Expand Up @@ -88,6 +88,30 @@ locals {
"networking.gke.io/load-balancer-type" = "Internal"
"networking.gke.io/internal-load-balancer-allow-global-access" = "true"
} : {}

# DNS-01 wildcard certificate resources for cert-manager
dns01_certificate_resources = {
for domain_key, domain in local.all_dns01_domains :
"dns01-cert-${domain_key}" => {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${domain_key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[domain_key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
domain.domain,
"*.${domain.domain}"
]
}
}
}
}

# Call the base utility module
Expand All @@ -99,40 +123,8 @@ module "nginx_gateway_fabric" {
environment = var.environment
inputs = local.merged_inputs

service_annotations = local.gcp_annotations
}

# --- DNS-01 wildcard certificate resources ---
# cert-manager Certificate CRDs for DNS-01 wildcard domains.
# Issues wildcard certs (*.domain + domain) via the dns01 ClusterIssuer (e.g. gts-production).
# Only created when use_dns01 is enabled, for domains without existing certificate_reference.
module "dns01_certificate" {
for_each = local.all_dns01_domains

source = "github.com/Facets-cloud/facets-utility-modules//any-k8s-resource"
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
advanced_config = {}

data = {
apiVersion = "cert-manager.io/v1"
kind = "Certificate"
metadata = {
name = "${local.name}-dns01-cert-${each.key}"
namespace = var.environment.namespace
}
spec = {
secretName = local.dns01_cert_secret_names[each.key]
issuerRef = {
name = local.dns01_cluster_issuer
kind = "ClusterIssuer"
}
dnsNames = [
each.value.domain,
"*.${each.value.domain}"
]
}
}
service_annotations = local.gcp_annotations
additional_base_resources = local.dns01_certificate_resources
}

# Bootstrap TLS secrets for DNS-01 domains — Gateway 443 listeners need a TLS secret
Expand Down
Loading