[fix] Tls fix 2 to make it work

README.md

@@ -361,6 +361,20 @@ This unified approach:
 - ✅ Simplifies maintenance
 - ✅ Enables easy configuration
 
+### Platform Ownership
+
+NodeInfra is the source of truth for platform behavior such as ingress, TLS termination, DNS integration, and provider compatibility.
+
+External validator repositories should treat NodeInfra as the reusable platform layer and keep only validator-specific configuration locally, such as:
+
+- `DNS_ZONE_NAME`
+- `CHAIN_NAME`
+- `INGRESS_DOMAIN`
+- secrets and environment values
+- deployment selection and operational wrappers
+
+Platform logic should not be re-implemented in downstream Terraform roots. When ingress or TLS behavior changes, the fix should land in NodeInfra once and downstream consumers should inherit it by updating their NodeInfra integration rather than copying the logic.
+
 ## Deployment Tools
 
 The `tools/` package provides reusable Python modules for infrastructure automation:

examples/public-fullnode/deploy.py

@@ -33,12 +33,16 @@ def build_terraform_vars(env_vars: dict) -> dict:
     if "VPC_CIDR" in env_vars:
         variables["vpc_cidr"] = env_vars["VPC_CIDR"]
 
+    enable_ingress = env_vars.get("INGRESS_ENABLED", "false").lower() in ("true", "1", "yes")
+    ingress_base_domain = env_vars.get("INGRESS_DOMAIN", "scratchpad.movementnetwork.xyz")
+
     # DNS configuration
     enable_dns = env_vars.get("ENABLE_DNS", "false").lower() in ("true", "1", "yes")
     variables["enable_dns"] = enable_dns
     if enable_dns:
-        if "DNS_ZONE_NAME" in env_vars:
-            variables["dns_zone_name"] = env_vars["DNS_ZONE_NAME"]
+        variables["dns_zone_name"] = env_vars.get("DNS_ZONE_NAME") or (
+            ingress_base_domain if enable_ingress else ""
+        )
         if "FULLNODE_DNS_NAME" in env_vars:
             variables["fullnode_dns_name"] = env_vars["FULLNODE_DNS_NAME"]
     else:
@@ -60,11 +64,10 @@ def build_terraform_vars(env_vars: dict) -> dict:
         ]
 
     # Ingress configuration
-    enable_ingress = env_vars.get("INGRESS_ENABLED", "false").lower() in ("true", "1", "yes")
     variables["enable_ingress"] = enable_ingress
     if enable_ingress:
         variables["chain_name"] = env_vars.get("CHAIN_NAME", "testnet")
-        variables["ingress_domain"] = env_vars.get("INGRESS_DOMAIN", "scratchpad.movementnetwork.xyz")
+        variables["ingress_domain"] = ingress_base_domain
 
     return variables
 

examples/validator-vfn/deploy.py

@@ -437,10 +437,13 @@ def deploy(env_vars: dict, force_create: bool, validate: bool, terraform_dir: Pa
     namespace = env_vars.get("NAMESPACE", "movement-l1")
     validator_keys_secret = env_vars.get("VALIDATOR_KEYS_SECRET", "validator-identity")
     vfn_keys_secret = env_vars.get("VFN_KEYS_SECRET", "vfn-identity")
+    validator_public = env_vars.get("VALIDATOR_PUBLIC", "false").lower() in ("true", "1", "yes")
+    validator_service_type = "LoadBalancer" if validator_public else "ClusterIP"
 
     # Display deployment plan
     info("Deployment Topology:")
-    info(f"  Validator: {validator_name} (ClusterIP - private)")
+    validator_access = "LoadBalancer - public" if validator_public else "ClusterIP - private"
+    info(f"  Validator: {validator_name} ({validator_access})")
     if ingress_enabled:
         info(f"  Ingress: ENABLED (TLS via *.{ingress_domain})")
         if deploy_vfn and deploy_fullnode:

terraform-modules/movement-ingress/main.tf

@@ -160,17 +160,25 @@ resource "kubectl_manifest" "wildcard_certificate" {
 data "aws_region" "current" {}
 
 # NOTE: NLB provisioning is asynchronous. After helm_release.nginx_ingress completes,
-# AWS needs 2-5 minutes to provision the actual NLB. If the first terraform apply fails
-# with "no matching ELB found", wait a few minutes and rerun. This is expected behavior.
-#
-# The data source lookup will fail fast if NLB doesn't exist yet, which is preferable
-# to blocking with arbitrary sleep times that may still be insufficient.
+# AWS needs 2-5 minutes to provision the actual NLB. We discover the load balancer
+# via the ingress controller Service and the AWS service tag rather than assuming
+# the requested semantic name becomes the final AWS LB name.
+data "kubernetes_service_v1" "nginx_ingress" {
+  metadata {
+    name      = "ingress-nginx-controller"
+    namespace = var.ingress_namespace
+  }
+
+  depends_on = [helm_release.nginx_ingress]
+}
 
-# Get the NLB by name (set via service annotation)
+# Get the NLB from the stable service tag applied by the Kubernetes service controller.
 data "aws_lb" "nginx_ingress" {
-  name = local.nlb_name
+  tags = {
+    "kubernetes.io/service-name" = "${var.ingress_namespace}/ingress-nginx-controller"
+  }
 
-  depends_on = [helm_release.nginx_ingress]
+  depends_on = [data.kubernetes_service_v1.nginx_ingress]
 }
 
 # Create DNS record for the wildcard domain pointing to the NLB

terraform-modules/movement-ingress/outputs.tf

@@ -30,7 +30,7 @@ output "ingress_class_name" {
 
 output "load_balancer_hostname" {
   description = "NLB hostname for the NGINX Ingress Controller"
-  value       = data.aws_lb.nginx_ingress.dns_name
+  value       = data.kubernetes_service_v1.nginx_ingress.status[0].load_balancer[0].ingress[0].hostname
 }
 
 output "wildcard_dns_record" {

terraform-modules/movement-ingress/versions.tf

@@ -6,13 +6,17 @@ terraform {
       source  = "hashicorp/aws"
       version = ">= 5.0"
     }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.35"
+    }
     helm = {
       source  = "hashicorp/helm"
-      version = ">= 2.0"
+      version = "~> 2.17"
     }
     kubectl = {
       source  = "gavinbunney/kubectl"
-      version = ">= 1.14"
+      version = "~> 1.14"
     }
   }
 }