feat(nginx_gateway_fabric): NGF 2.6.5 + HTTP-01/ListenerSet cert flow, wildcard TLS, alias-A base record

[sanmesh-kakade]

What

Base nginx_gateway_fabric module: upgrade to NGF 2.6.5, switch the cert flow to HTTP-01 + Gateway API ListenerSet, add wildcard TLS for private/DNS-01 LBs, and fix the base-domain Route53 record on AWS.

Changes

• Chart 2.4.1 → 2.6.5 — vendored chart + org image carrying the #5330 fix; raised control-plane resource/replica defaults; imagePullPolicy: Always.
• HTTP-01 + ListenerSet — HTTP-01 is the default issuance path via ListenerSet listeners; dropped the ACK/dns01 wildcard path. ListenerSet annotated for the cert-manager listenerset-shim.
• No bootstrap placeholder secrets — the shim creates each listener's TLS secret itself. The old per-hostname self-signed placeholders were a workaround for the cert-manager HTTP-01 + Gateway API bug (cert-manager#7337, broken 1.16.0, fixed 1.18.1); the bundled cert-manager is past that fix, so the placeholders (and all their tls_*/secret TF resources) are removed. Verified: Gateway/LB program without the secret, the shim issues per-listener certs.
• Wildcard TLS mode — for private/DNS-01 LBs, emit apex + *.domain listeners sharing one shim-issued cert (single DNS-01 challenge).
• Base-domain record (AWS) — alias-A instead of CNAME: a CNAME makes cnameStrategy: Follow chase into amazonaws.com and break DNS-01. The NLB canonical hosted-zone-id comes from a static per-region map (nlb_zone_ids.tf) — an AWS-published constant, so no ELB API call / cross-account lookup (the LB lives in the tenant cloud account, unreachable from the release pod). Non-AWS → plain A; lb_service_record_type override wins.

Testing

Private-LB DNS-01 wildcard certs + public HTTP-01 per-subdomain certs verified issuing (real Google Trust Services certs) on AWS + OVH test envs, with no bootstrap placeholders.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

NGINX Gateway Fabric is upgraded to v2.6.5. The module now generates ListenerSet resources for HTTPS, routes HTTPS traffic through ListenerSet parentRefs, updates Gateway listener settings, and adjusts bootstrap TLS and Helm values.

Changes

NGF v2.6.5 Upgrade and ListenerSet HTTPS Wiring

Layer / File(s)	Summary
Helm chart upgrade and control-plane image update nginx_gateway_fabric/README.md, nginx_gateway_fabric/main.tf	Updates the documented module/chart version to 2.6.5, upgrades the Helm release chart, switches the control-plane image to facetscloud/nginx-gateway-fabric:2.6.5, enables gwAPIExperimentalFeatures, and changes control-plane resource values.
ListenerSet resource generation and bootstrap TLS nginx_gateway_fabric/main.tf	Adds locals that flatten HTTPS listeners, chunk them into groups of 64, build ListenerSet manifests and listener parentRefs, and restricts bootstrap TLS DNS names to apex domains.
HTTPRoute and GRPCRoute parentRefs rewired to ListenerSets nginx_gateway_fabric/main.tf	Changes HTTPS route parentRefs to use ListenerSet-backed section names and includes local.listenerset_resources in the base deployment data.
Gateway listener settings nginx_gateway_fabric/main.tf	Sets allowedListeners.namespaces.from to Same and replaces inline HTTPS listeners with an empty listeners list when external_tls_termination is disabled.

Possibly related PRs

• Facets-cloud/facets-utility-modules#41: Modifies the same main.tf HTTPS listener attachment path and route parentRef wiring for domain routing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main changes: NGF 2.6.5 upgrade and the shift to ListenerSet/HTTP-01 certificate flow.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch upgrade-ngf-2.6.3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nginx_gateway_fabric/main.tf`:
- Around line 312-319: The HTTPRoute/GRPCRoute parentRef lookup still falls back
to synthesizing Gateway references for missing HTTPS listener names, which can
produce unattached routes after the inline HTTPS listeners are removed. Update
the routing logic in the listener parentRef generation path (the branches using
local.listener_parentref, local.gateway_parentref_base, and the https-* naming)
to use the ListenerSet map as the source of truth, and make the Gateway fallback
only apply when the listener name is actually present on the Gateway. Apply the
same fix consistently in both the HTTPRoute and GRPCRoute branches so naming
drift fails fast instead of silently deploying broken routes.
- Line 1028: The ListenerSet manifests in the any-k8s-resources flow can be
applied before the experimental Gateway API CRDs are present, causing failures
on a fresh cluster. Update the dependency chain around
`local.listenerset_resources` so the release that applies these resources
explicitly waits on the CRD installation path used by the nginx gateway fabric
setup, not just `helm_release.nginx_gateway_fabric` and the TLS secrets. Use the
existing symbols `local.listenerset_resources` and the related
`any-k8s-resources` release wiring to add the missing dependency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ab846950-3ee5-4e3a-a633-56112026074d

📥 Commits

Reviewing files that changed from the base of the PR and between 66f0e8c and 8eb3dbf.

📒 Files selected for processing (4)

• nginx_gateway_fabric/README.md
• nginx_gateway_fabric/charts/nginx-gateway-fabric-2.4.1.tgz
• nginx_gateway_fabric/charts/nginx-gateway-fabric-2.6.5.tgz
• nginx_gateway_fabric/main.tf