AWS EKS – AWS Load Balancer Controller & ALB Ingress Setup

This document explains how to configure the AWS Load Balancer Controller on an Amazon EKS cluster and expose internal Kubernetes services like Kubernetes Dashboard and Argo CD using an Application Load Balancer (ALB) with HTTPS.

1. Configure kubectl for EKS Cluster

aws eks --region ap-south-1 update-kubeconfig --name zero

Explanation

Updates the local kubeconfig file.
Enables kubectl to authenticate with the EKS cluster using IAM.

2. Download AWS Load Balancer Controller IAM Policy

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.14.1/docs/install/iam_policy.json

Explanation

Contains required AWS permissions for ALB creation and management.

3. Create IAM Policy

aws iam create-policy \
  --policy-name AWSLoadBalancerControllerIAMPolicy \
  --policy-document file://iam_policy.json

Explanation

Creates an IAM policy used by the controller via IRSA.

4. Install Helm

snap install helm --classic

Explanation

Helm is used to deploy Kubernetes applications efficiently.

5. Add EKS Helm Repository

helm repo add eks https://aws.github.io/eks-charts
helm repo update

6. Install eksctl

curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin
eksctl version

Explanation

eksctl simplifies EKS cluster and IAM-related operations.

7. Associate IAM OIDC Provider

eksctl utils associate-iam-oidc-provider \
  --region ap-south-1 \
  --cluster zero \
  --approve

Explanation

Enables IAM Roles for Service Accounts (IRSA).

8. Create IAM ServiceAccount for ALB Controller

eksctl create iamserviceaccount \
  --cluster=zero \
  --namespace=kube-system \
  --name=aws-load-balancer-controller \
  --attach-policy-arn=arn:aws:iam::497836541334:policy/AWSLoadBalancerControllerIAMPolicy \
  --override-existing-serviceaccounts \
  --region ap-south-1 \
  --approve

Explanation

Grants the controller permission to manage AWS ALB resources.

9. Install AWS Load Balancer Controller

helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system \
  --set clusterName=zero \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller \
  --set region=ap-south-1 \
  --set vpcId=vpc-0a68838e349634ae8

10. Verify Installation

kubectl get deployment -n kube-system aws-load-balancer-controller
kubectl get pods -n kube-system | grep aws-load-balancer-controller

11. Kubernetes Dashboard Ingress (ALB + HTTPS)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dashboard-ingress
  namespace: kubernetes-dashboard
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:497836541334:certificate/8ce5cc94-38d1-4fe2-b11e-e158f307f338
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
    alb.ingress.kubernetes.io/healthcheck-path: /api/v1/healthz
spec:
  ingressClassName: alb
  rules:
  - host: eks-dashboard.asifahmadkhan.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443

12. Argo CD Ingress (ALB + HTTPS)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-ingress
  namespace: argocd
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:ap-south-1:497836541334:certificate/8ce5cc94-38d1-4fe2-b11e-e158f307f338
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/healthcheck-protocol: HTTPS
    alb.ingress.kubernetes.io/healthcheck-path: /healthz
spec:
  ingressClassName: alb
  rules:
  - host: argocd.asifahmadkhan.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: argocd-server
            port:
              number: 80

Summary

Configured AWS Load Balancer Controller using IRSA
Exposed Kubernetes Dashboard and Argo CD via ALB
Secured endpoints using ACM SSL certificates
Implemented production-grade EKS ingress architecture

InfraCraft