[feat acm-certs-mgmt] bug fixes and doc improvements

[shraddhabang]

Issue

Bug 1: Certificate dedup drops certs in ingress groups : For auto-created certs (ResourceFieldStringToken), Resolve() returns "" because the cert status isn't set until the synthesizer runs. This caused all auto-created certs after the first to be silently dropped in ingress groups.
Fix: Use resource identity (Type()/ID() from Dependencies()) for dedup on auto-created certs. Fall back to Resolve() only for literal tokens (e.g. certificate-arn), which always resolve to the actual ARN string.

Bug 2: Same hostname across ingresses in a group produces only one cert
Fix: Include a hash of the ingress namespace/name in the resource ID, ensuring each ingress gets its own cert even with shared hostnames.

Bug 3: Orphaned certs when hosted zone doesn't exist : certificate was requested from ACM before checking if a Route53 hosted zone exists. If no zone was found, the cert was left in PENDING_VALIDATION state for 30 minutes, blocking the reconcile loop.

Fix: Pre-check that hosted zones exist for all domains before calling RequestCertificate.

Bug 4: No hostname in Ingress provides weird error message : when create-acm-cert are set and ingress does not have any hostname, the API was called and failed requesting the new cert.

Fix: Added a check in builder before calling the API to fail fast when no hostname are specified.

Documentation updates

• Added Ingress Group Behavior section with examples of mixed cert strategies
• Added Security Considerations section covering multi-tenant isolation and IAM policy scoping
• Added note about same-hostname behavior in ingress groups

Manual testing

Single ingress: amazon-issued, PCA, cert-arn, cert discovery, multi-SAN, SAN update
Ingress groups: mixed strategies, dedup with different hostnames, same hostname, cert-arn backward compat
Error cases: no hostname, wrong domain pre-check, SAN quota exceeded, cert-arn precedence
Lifecycle: delete ingress → cert cleanup, switch create-acm-cert → certificate-arn

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the docs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shraddhabang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [shraddhabang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

❌ Patch coverage is 89.65517% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.13%. Comparing base (ed8bd00) to head (53f26ad).
⚠️ Report is 857 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/deploy/acm/certificate_manager.go	78.57%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4711      +/-   ##
==========================================
+ Coverage   50.39%   56.13%   +5.74%     
==========================================
  Files         205      388     +183     
  Lines       12109    30942   +18833     
==========================================
+ Hits         6102    17369   +11267     
- Misses       5590    12562    +6972     
- Partials      417     1011     +594     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[shuqz]

/approved