fix(nginx_gateway_fabric): restore bootstrap TLS secrets (break cert deadlock)

Moving HTTPS listeners into ListenerSets exposed a deadlock: the listener is
rejected (InvalidCertificateRef) until its secret exists, but the cert-manager
gateway-shim only issues for an accepted listener -> the real cert is never
created. Restore the self-signed bootstrap secret (byte-identical to the prior
module) so the listener is valid and accepted, then cert-manager overwrites it
once HTTP-01 succeeds. Pair with cert_manager enableCertificateOwnerRef for
clean teardown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

nginx_gateway_fabric/main.tf

@@ -174,6 +174,16 @@ locals {
     local.gateway_api_crd_labels
   )
 
+  # Domains that need bootstrap TLS certificates so the HTTPS listener is valid before
+  # cert-manager issues. Without a placeholder secret the listener is rejected
+  # (InvalidCertificateRef) and never accepted, so the gateway-shim never issues the
+  # real cert — a deadlock. cert-manager overwrites this secret once HTTP-01 succeeds.
+  bootstrap_tls_domains = var.external_tls_termination ? {} : {
+    for domain_key, domain in local.domains :
+    domain_key => domain
+    if can(domain.domain) && lookup(domain, "certificate_reference", "") == ""
+  }
+
   # Domains that need cert-manager to issue certificates
   # Only domains WITHOUT certificate_reference
   # Not needed when TLS is terminated externally
@@ -1037,6 +1047,104 @@ locals {
   )
 }
 
+# Bootstrap TLS for the base domain — placeholder self-signed cert so the HTTPS
+# listener is valid and accepted before cert-manager issues the real cert (breaks
+# the listener-invalid / cert-not-issued deadlock). cert-manager overwrites it.
+resource "tls_private_key" "bootstrap" {
+  for_each  = local.bootstrap_tls_domains
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "bootstrap" {
+  for_each        = local.bootstrap_tls_domains
+  private_key_pem = tls_private_key.bootstrap[each.key].private_key_pem
+
+  subject {
+    common_name = each.value.domain
+  }
+
+  validity_period_hours = 8760 # 1 year
+
+  dns_names = [
+    each.value.domain,
+    "*.${each.value.domain}"
+  ]
+
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth"
+  ]
+}
+
+resource "kubernetes_secret_v1" "bootstrap_tls" {
+  for_each = local.bootstrap_tls_domains
+
+  metadata {
+    name      = "${local.name}-${each.key}-tls-cert"
+    namespace = var.environment.namespace
+  }
+
+  data = {
+    "tls.crt" = tls_self_signed_cert.bootstrap[each.key].cert_pem
+    "tls.key" = tls_private_key.bootstrap[each.key].private_key_pem
+  }
+
+  type = "kubernetes.io/tls"
+
+  lifecycle {
+    ignore_changes = [data, metadata[0].annotations, metadata[0].labels]
+  }
+}
+
+# Bootstrap TLS for additional hostnames (from domain_prefix in rules)
+# Only for additional hostnames that did NOT inherit a certificate_reference from parent domain
+resource "tls_private_key" "bootstrap_additional" {
+  for_each  = local.additional_hostname_configs
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "bootstrap_additional" {
+  for_each        = local.additional_hostname_configs
+  private_key_pem = tls_private_key.bootstrap_additional[each.key].private_key_pem
+
+  subject {
+    common_name = each.value.hostname
+  }
+
+  validity_period_hours = 8760 # 1 year
+
+  dns_names = [each.value.hostname]
+
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth"
+  ]
+}
+
+resource "kubernetes_secret_v1" "bootstrap_tls_additional" {
+  for_each = local.additional_hostname_configs
+
+  metadata {
+    name      = each.value.secret_name
+    namespace = var.environment.namespace
+  }
+
+  data = {
+    "tls.crt" = tls_self_signed_cert.bootstrap_additional[each.key].cert_pem
+    "tls.key" = tls_private_key.bootstrap_additional[each.key].private_key_pem
+  }
+
+  type = "kubernetes.io/tls"
+
+  lifecycle {
+    ignore_changes = [data, metadata[0].annotations, metadata[0].labels]
+  }
+}
+
 # Helm release name - keep under 34 chars so that fullname (release + "-" + chart name = 34+1+20 = 55)
 # plus the longest suffix (-certgen, 8 chars) stays within the 63-char k8s label value limit.
 #
@@ -1274,6 +1382,11 @@ resource "helm_release" "nginx_gateway_fabric" {
     }),
     yamlencode(local.base_helm_values)
   ]
+
+  depends_on = [
+    kubernetes_secret_v1.bootstrap_tls,
+    kubernetes_secret_v1.bootstrap_tls_additional
+  ]
 }
 
 # Deploy all Gateway API resources using facets-utility-modules