feat(nginx_gateway_fabric): NGF 2.6.5 + HTTP-01/ListenerSet cert flow, wildcard TLS, alias-A base record

- Bump vendored chart 2.4.1 -> 2.6.5 (org image with #5330 fix); raise control-plane
  resource/replica defaults; imagePullPolicy Always.
- HTTP-01 default via ListenerSet listeners; drop the ACK/dns01 wildcard path. Annotate the
  ListenerSet for the cert-manager listenerset-shim, which creates each listener's TLS secret
  itself — no self-signed bootstrap placeholder secrets (the old workaround for the cert-manager
  HTTP-01 + Gateway API bug, cert-manager/cert-manager#7337, fixed in 1.18.1).
- Wildcard TLS mode for private/DNS-01 LBs (apex + *.domain, one shim-issued cert).
- Base-domain Route53 record: alias-A on AWS (NLB canonical zone id from a static per-region map in
  nlb_zone_ids.tf) so cnameStrategy:Follow does not chase into amazonaws.com and break DNS-01; plain
  A/CNAME otherwise; honor the lb_service_record_type override.
- README refresh.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

.gitignore

@@ -1,4 +1,5 @@
 .terraform/
+.terraform.lock.hcl
 *.tfstate
 *.tfstate.*
 *.tfvars

nginx_gateway_fabric/README.md

@@ -1,6 +1,6 @@
 # nginx_gateway_fabric
 
-Cloud-agnostic base module for [NGINX Gateway Fabric](https://github.com/nginxinc/nginx-gateway-fabric) (v2.4.1) using the Kubernetes Gateway API.
+Cloud-agnostic base module for [NGINX Gateway Fabric](https://github.com/nginxinc/nginx-gateway-fabric) (v2.6.5) using the Kubernetes Gateway API.
 
 This module is designed to be called by cloud-specific flavor modules (AWS, GCP, Azure, OVH) that pass their own LB annotations and proxy configuration.
 
@@ -63,23 +63,37 @@ module "nginx_gateway_fabric" {
 
 ## What this module creates
 
-- NGINX Gateway Fabric Helm release (chart v2.4.1)
-- GatewayClass and Gateway with per-domain HTTPS listeners
-- HTTPRoute and GRPCRoute resources from spec rules
-- Bootstrap TLS certificates (self-signed, replaced by cert-manager)
-- cert-manager ClusterIssuer for HTTP-01 validation
-- cert-manager Certificate resources (when mixed cert modes)
+- NGINX Gateway Fabric Helm release (chart v2.6.5), with Gateway API experimental
+  features enabled (required for the ListenerSet CRD)
+- GatewayClass and a Gateway carrying only the HTTP (:80) listener, with
+  `allowedListeners` set so ListenerSets can attach
+- `ListenerSet` resources holding the per-hostname HTTPS listeners, chunked at 64
+  listeners each — this is how the deployment scales past the 64-listeners-per-Gateway
+  limit
+- HTTPRoute and GRPCRoute resources from spec rules (HTTPS routes attach to the
+  ListenerSet listeners; the HTTP listener stays on the Gateway)
+- Bootstrap TLS secrets (self-signed) so each HTTPS listener is valid before
+  cert-manager issues — the listener-invalid / cert-not-issued deadlock breaker;
+  cert-manager overwrites them once HTTP-01 succeeds
+- cert-manager ClusterIssuer for HTTP-01 validation, annotated onto the ListenerSet
+  so cert-manager's listenerset-shim issues per-hostname certs
+- cert-manager Certificate resources (per hostname, apex/concrete names — HTTP-01
+  never issues wildcards)
 - Basic auth via NGF AuthenticationFilter CRD (optional)
 - PodMonitor for Prometheus scraping (optional)
 - ReferenceGrant for cross-namespace backends
 - ClientSettingsPolicy for body size limits
 - Route53 DNS records for base domain and wildcard (AWS only)
 - HTTP to HTTPS redirect route (when force_ssl_redirection enabled)
 
+A domain may instead carry a `certificate_reference` (a pre-made TLS secret name) as
+an optional escape hatch — that listener uses the supplied secret and cert-manager is
+not involved for it.
+
 ## What flavor modules provide
 
 | Config | Example (AWS) |
 |--------|---------------|
 | `service_annotations` | NLB scheme, target type, backend protocol, proxy protocol |
 | `nginx_proxy_extra_config` | `rewriteClientIP.mode = "ProxyProtocol"` |
-| ACM certificate handling | Detect ACM ARN, create ACK Certificate CRD, rewrite `certificate_reference` to K8s secret name before passing `instance` |
+| ACM-at-LB handling | Detect an ACM ARN in `certificate_reference`, set `external_tls_termination` and the NLB `aws-load-balancer-ssl-cert` annotation so the NLB terminates TLS (no in-cluster ACK controller) |