From df5e13980780abc9591903a9b432fa0e997ae9da Mon Sep 17 00:00:00 2001 From: Sanmesh Kakade Date: Wed, 25 Mar 2026 14:43:13 +0530 Subject: [PATCH] fix: gate ack_acm_resources on use_ack_acm to avoid creating CRDs without controller (#539) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts the ungated ack_acm_resources change — creating ACK Certificate CRDs when the ACK controller is not deployed causes apply failures since the CRD types are not registered in the cluster. Co-authored-by: Claude Opus 4.6 (1M context) --- .../nginx_gateway_fabric_legacy_aws/1.0/main.tf | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf index cbf8cbdf..1162ec68 100644 --- a/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf +++ b/modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf @@ -146,9 +146,8 @@ locals { # ACK ACM Certificate CRD resources — creates ACM certificates via ACK controller # and exports them to K8s TLS secrets for Gateway listener consumption. - # Iterates over acm_cert_domains directly (always known from spec) instead of - # gating on use_ack_acm which may be unknown on first apply. - ack_acm_resources = { + # Only created when ACK controller is available. + ack_acm_resources = local.use_ack_acm ? { for domain_key, domain in local.acm_cert_domains : "ack-acm-cert-${domain_key}" => { apiVersion = "acm.services.k8s.aws/v1alpha1" @@ -174,7 +173,7 @@ locals { } } } - } + } : {} # DNS-01 wildcard certificate resources for cert-manager dns01_certificate_resources = { @@ -230,9 +229,9 @@ module "nginx_gateway_fabric" { # Pre-create empty TLS secrets for ACK ACM certificate export # ACK ACM controller requires the target secret to exist before it can export -# Gated on acm_cert_domains (always known from spec) instead of use_ack_acm +# Only created when ACK controller is available resource "kubernetes_secret_v1" "acm_cert" { - for_each = local.acm_cert_domains + for_each = local.use_ack_acm ? local.acm_cert_domains : {} metadata { name = local.acm_cert_secret_names[each.key]