fix: type var.instance and use spec-derived for_each keys in legacy modules

[sanmesh-kakade]

Summary

• Typed variable "instance" with object({spec = ...}) across all three legacy modules (AWS, GCP, Azure) to prevent merge() tainting with type=any that causes unknown for_each keys on first apply
• AWS only: Removed use_ack_acm gating from ack_acm_resources, acm_cert secrets, and acm_modified_domains — now iterates over spec-derived values (always known at plan time) instead of var.inputs.ack_acm_controller_details (potentially unknown on first apply)
• Syncs fixes from facets-modules-redesign (3dfb8f3 for AWS, 70d419b for GCP/Azure)
• Cherry-picked from develop (PR fix: use spec-derived for_each keys in legacy AWS module #537)

Modules changed

• modules/ingress/nginx_gateway_fabric_legacy_aws/1.0 — typed instance variable + removed use_ack_acm for_each gating
• modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0 — typed instance variable
• modules/ingress/nginx_gateway_fabric_legacy_azure/1.0 — typed instance variable

Test plan

• Verify terraform plan succeeds on first apply (no unknown for_each errors)
• Verify ACK path (AWS): ACM domains with ACK controller still get Certificate CRDs and TLS secrets
• Verify ACM mode (AWS): ACM domains without ACK controller terminate TLS at NLB correctly
• Verify DNS-01 path is unaffected across all three cloud modules
• Verify GCP and Azure modules plan/apply cleanly with typed instance

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Enhanced configuration schema with explicit type validation and default values across AWS, Azure, and GCP modules.
  • Simplified certificate handling with improved domain management logic.

• Chores

  • Strengthened infrastructure module validation to prevent misconfiguration.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b75afce8-5671-4563-b2ce-920b94ea6bcb

📥 Commits

Reviewing files that changed from the base of the PR and between ac8a2bf and 91d335e.

📒 Files selected for processing (4)

• modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf
• modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf
• modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf
• modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf

---

Walkthrough

Type constraints strengthened on the instance variable across three cloud provider ingress modules (AWS, Azure, GCP) from unconstrained any to structured objects with typed, optional fields and defaults. AWS module modified to unconditionally create Kubernetes secrets for ACM-managed domains.

Changes

Cohort / File(s)	Summary
AWS ACM Logic modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf	Removed conditional gating on local.use_ack_acm; local.acm_cert_domains and kubernetes_secret_v1.acm_cert now always process ACM domains. Updated local.ack_acm_resources to iterate over local.acm_cert_domains unconditionally instead of returning empty object.
Variable Type Strengthening modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/variables.tf, modules/ingress/nginx_gateway_fabric_legacy_azure/1.0/variables.tf, modules/ingress/nginx_gateway_fabric_legacy_gcp/1.0/variables.tf	instance variable type changed from any to structured object with required spec. New schema enforces typed, optional fields with defaults: boolean flags (private, disable_base_domain, force_ssl_redirection, basic_auth, helm_wait, use_dns01), string settings (body_size, domain_prefix_override, dns01_cluster_issuer), and domains map requiring domain and alias with optional certificate_reference.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync-fabric-modules-master

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Trivy (0.69.3)

Trivy execution failed: Unknown error

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}