fix(ingress): legacy NGF HTTP-01/ListenerSet + wildcard TLS, Gateway API v1.5.1, drop ACK ACM

[sanmesh-kakade]

What

Legacy NGF flavors: HTTP-01 + ListenerSet cert flow, wildcard TLS for private LBs, Gateway API v1.5.1, and removal of the ACK ACM controller path.

Changes

• Gateway API — CRDs default to v1.5.1; raised legacy control-plane resource defaults + min_replicas.
• Drop ACK ACM — removed the ACK ACM controller + DNS-01 from the legacy NGF flavors (module + output deleted).
• legacy aws/azure/gcp flavors — DNS-01 (gts-production) cert issuance + wildcard TLS for private LBs (mirrors k8s-native); dropped the unsupported cluster_issuer_override fallback.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• facets-saas

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5fef44e1-001a-4984-a236-d1fd6433df79

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ngf-gw-api-1.5.1-legacy

---

_{Comment @coderabbitai help to get the list of available commands.}

[sanmesh-kakade]

📋 Gateway API CRD changelog v1.4.1 → v1.5.1 — verified against the real manifests, with impact

v1.5.1 is a conformance/docs patch over v1.5.0 (zero CRD schema change) — all API deltas are from v1.5.0.

Legend: ✅ affects us · ⚠️ pre-check · — no impact

• ReferenceGrant: v1 added; v1beta1 still served + storage — — safe/additive. Existing v1beta1 ReferenceGrants stay valid, no migration.
• Gateway / GatewayClass / HTTPRoute / GRPCRoute — schemas grew (CORS GEP-1767, client-cert validation GEP-91/3567, cert selection GEP-3155) — — all additive optional fields on the existing v1 storage; existing CRs not rejected.
• TLSRoute promoted to standard as v1; experimental storage v1alpha3→v1 — ⚠️ only matters if TLSRoutes exist. Pre-check kubectl get tlsroutes -A (expect empty).
• XListenerSet → ListenerSet (v1); xlistenersets removed — ⚠️ breaking rename, only matters if XListenerSet CRs exist. Pre-check kubectl get xlistenersets -A (expect empty).
• New safe-upgrades ValidatingAdmissionPolicy (failurePolicy: Fail, action Deny) — ✅ affects rollback: blocks applying CRDs below v1.5.0 and standard↔experimental mixing. Forward upgrade is fine; to roll back to ≤1.4.x first kubectl delete validatingadmissionpolicy safe-upgrades.gateway.networking.k8s.io + its binding.
• --server-side apply is mandatory — the httproutes CRD alone is ~533 KB (> the 262 KB client-side annotation limit) — ✅ module already uses --server-side; keep it.
• Min Kubernetes ≥ 1.31 (TLSRoute CEL) — ✅ satisfied (CP v1.33, nodes ≥ v1.31.3).

Pre-flight before apply

kubectl get tlsroutes,xlistenersets -A     # expect empty
kubectl get crd httproutes.gateway.networking.k8s.io \
  -o jsonpath='{range .metadata.managedFields[*]}{.manager}{"\n"}{end}'

If managedFields show kubectl-client-side-apply (or another conflicting manager), the install Job's server-side apply will conflict → needs --force-conflicts (module sets backoff_limit=3, no --force-conflicts today).

Apply these CRDs before the NGF 2.6.3 controller (facets-utility-modules#39).

Net: additive + safe for our Gateway/HTTPRoute/ReferenceGrant usage. Only real watch-items: the rollback VAP and a possible server-side-apply field-manager conflict — both operational, neither a schema break.