feat(nginx_gateway_fabric): drop bootstrap TLS placeholders, let cert-manager shim issue

The per-hostname self-signed placeholder secrets (6 blocks x N hostnames) worked around the
cert-manager HTTP-01 + Gateway API bug (cert-manager/cert-manager#7337: broken 1.16.0, fixed
1.18.1). The bundled cert-manager is past that fix, so the gateway/listenerset-shim creates each
listener's TLS secret on its own. Removes tls_private_key/tls_self_signed_cert/kubernetes_secret_v1
bootstrap resources + the bootstrap_tls_domains local + the helm_release depends_on on them.
Listeners still reference the same secret names (strings); the shim now fills them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

nginx_gateway_fabric/main.tf

@@ -187,16 +187,6 @@ locals {
     local.gateway_api_crd_labels
   )
 
-  # Domains that need bootstrap TLS certificates so the HTTPS listener is valid before
-  # cert-manager issues. Without a placeholder secret the listener is rejected
-  # (InvalidCertificateRef) and never accepted, so the gateway-shim never issues the
-  # real cert — a deadlock. cert-manager overwrites this secret once HTTP-01 succeeds.
-  bootstrap_tls_domains = var.external_tls_termination ? {} : {
-    for domain_key, domain in local.domains :
-    domain_key => domain
-    if can(domain.domain) && lookup(domain, "certificate_reference", "") == ""
-  }
-
   # Domains that need cert-manager to issue certificates
   # Only domains WITHOUT certificate_reference
   # Not needed when TLS is terminated externally
@@ -1088,103 +1078,10 @@ locals {
   )
 }
 
-# Bootstrap TLS for the base domain — placeholder self-signed cert so the HTTPS
-# listener is valid and accepted before cert-manager issues the real cert (breaks
-# the listener-invalid / cert-not-issued deadlock). cert-manager overwrites it.
-resource "tls_private_key" "bootstrap" {
-  for_each  = local.bootstrap_tls_domains
-  algorithm = "RSA"
-  rsa_bits  = 2048
-}
-
-resource "tls_self_signed_cert" "bootstrap" {
-  for_each        = local.bootstrap_tls_domains
-  private_key_pem = tls_private_key.bootstrap[each.key].private_key_pem
-
-  subject {
-    common_name = each.value.domain
-  }
-
-  validity_period_hours = 8760 # 1 year
-
-  dns_names = [
-    each.value.domain,
-    "*.${each.value.domain}"
-  ]
-
-  allowed_uses = [
-    "key_encipherment",
-    "digital_signature",
-    "server_auth"
-  ]
-}
-
-resource "kubernetes_secret_v1" "bootstrap_tls" {
-  for_each = local.bootstrap_tls_domains
-
-  metadata {
-    name      = "${local.name}-${each.key}-tls-cert"
-    namespace = var.environment.namespace
-  }
-
-  data = {
-    "tls.crt" = tls_self_signed_cert.bootstrap[each.key].cert_pem
-    "tls.key" = tls_private_key.bootstrap[each.key].private_key_pem
-  }
-
-  type = "kubernetes.io/tls"
-
-  lifecycle {
-    ignore_changes = [data, metadata[0].annotations, metadata[0].labels]
-  }
-}
-
-# Bootstrap TLS for additional hostnames (from domain_prefix in rules)
-# Only for additional hostnames that did NOT inherit a certificate_reference from parent domain
-resource "tls_private_key" "bootstrap_additional" {
-  for_each  = local.additional_hostname_configs
-  algorithm = "RSA"
-  rsa_bits  = 2048
-}
-
-resource "tls_self_signed_cert" "bootstrap_additional" {
-  for_each        = local.additional_hostname_configs
-  private_key_pem = tls_private_key.bootstrap_additional[each.key].private_key_pem
-
-  subject {
-    common_name = each.value.hostname
-  }
-
-  validity_period_hours = 8760 # 1 year
-
-  dns_names = [each.value.hostname]
-
-  allowed_uses = [
-    "key_encipherment",
-    "digital_signature",
-    "server_auth"
-  ]
-}
-
-resource "kubernetes_secret_v1" "bootstrap_tls_additional" {
-  for_each = local.additional_hostname_configs
-
-  metadata {
-    name      = each.value.secret_name
-    namespace = var.environment.namespace
-  }
-
-  data = {
-    "tls.crt" = tls_self_signed_cert.bootstrap_additional[each.key].cert_pem
-    "tls.key" = tls_private_key.bootstrap_additional[each.key].private_key_pem
-  }
-
-  type = "kubernetes.io/tls"
-
-  lifecycle {
-    ignore_changes = [data, metadata[0].annotations, metadata[0].labels]
-  }
-}
+# Bootstrap TLS placeholder secrets removed: cert-manager's gateway/listenerset-shim creates the
+# listener's TLS secret itself. The old placeholder worked around the cert-manager HTTP-01 + Gateway
+# API bug (cert-manager/cert-manager#7337, broken 1.16.0, fixed 1.18.1); the bundled cert-manager
+# is past that fix, so no placeholder is needed.
 
 # Helm release name - keep under 34 chars so that fullname (release + "-" + chart name = 34+1+20 = 55)
 # plus the longest suffix (-certgen, 8 chars) stays within the 63-char k8s label value limit.
@@ -1424,10 +1321,6 @@ resource "helm_release" "nginx_gateway_fabric" {
     yamlencode(local.base_helm_values)
   ]
 
-  depends_on = [
-    kubernetes_secret_v1.bootstrap_tls,
-    kubernetes_secret_v1.bootstrap_tls_additional
-  ]
 }
 
 # Deploy all Gateway API resources using facets-utility-modules