Triển khai AWS ALB Ingress Controller

eksctl utils associate-iam-oidc-provider --cluster tony-lab-cluster --region ap-southeast-1 --approve

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json

aws iam create-policy --policy-name AWSLoadBalancerControllerIAMPolicy_Final --policy-document file://iam_policy.json

eksctl create iamserviceaccount ^
  --cluster=beobeo-lab-cluster ^
  --namespace=kube-system ^
  --name=aws-load-balancer-controller ^
  --role-name AmazonEKSLoadBalancerControllerRole_Final ^
  --attach-policy-arn=arn:aws:iam::474891441152:policy/AWSLoadBalancerControllerIAMPolicy_Final ^
  --region=ap-southeast-1 ^
  --override-existing-serviceaccounts ^
  --approve

helm repo add eks https://aws.github.io/eks-charts
helm repo update

helm install aws-load-balancer-controller eks/aws-load-balancer-controller ^
  -n kube-system ^
  --set clusterName=beobeo-lab-cluster ^
  --set serviceAccount.create=false ^
  --set serviceAccount.name=aws-load-balancer-controller

kubectl get deployment -n kube-system aws-load-balancer-controller

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-ingress
  namespace: argocd
  annotations:
    # 1. Controller Designation
    # Specifies that this Ingress is managed by the AWS Load Balancer Controller.
    kubernetes.io/ingress.class: alb

    # 2. Network Scheme
    # 'internet-facing': Creates a public Load Balancer accessible from the internet.
    # 'internal': Creates a private Load Balancer (internal VPC only).
    alb.ingress.kubernetes.io/scheme: internet-facing

    # 3. Target Type
    # 'ip': Routes traffic directly to the Pod IP (High Performance & Faster).
    # 'instance': Routes traffic to NodePort (Legacy mode).
    alb.ingress.kubernetes.io/target-type: ip

    # --- SSL/HTTPS CONFIGURATION ---
    
    # 4. ACM Certificate
    # ACTION REQUIRED: Replace the ARN below with your actual Certificate ARN from AWS ACM.
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-southeast-1:474891441152:certificate/6aac9ac0-cea3-452d-a467-6ce6809969d3

    # 5. Listen Ports
    # Configures the Load Balancer to listen on both HTTP (80) and HTTPS (443).
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'

    # 6. SSL Redirection
    # Automatically redirects all HTTP traffic to HTTPS for security.
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'

    # --- BACKEND PROTOCOL (CRITICAL FOR ARGOCD) ---
    
    # 7. Backend Protocol
    # We use 'HTTP' here because we have disabled internal HTTPS on the ArgoCD Pod 
    # (using the --insecure flag) to avoid "Login Loop" issues and simplify SSL termination.
    alb.ingress.kubernetes.io/backend-protocol: HTTPS

    # 8. Health Check Settings
    # Since the backend speaks HTTP, the health check must also use HTTP.
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
    # ArgoCD exposes a specific health check endpoint at /healthz.
    alb.ingress.kubernetes.io/healthcheck-path: /healthz
    # Codes considered "Healthy" by the Load Balancer.
    alb.ingress.kubernetes.io/success-codes: '200'

spec:
  # Standard Ingress Class definition
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  # This must match the HTTP port exposed by the argocd-server Service.
                  number: 80

kubectl apply -f argocd-ingress.yaml

kubectl delete pod -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller

kubectl get ingress -n argocd