<p>I'm trying to accomplish a VERY common task for an application: </p>

<p>Assign a certificate and secure it with TLS/HTTPS.</p>

<p>I've spent nearly a day scouring thru documentation and trying multiple different tactics to get this working but nothing is working for me.</p>

<p>Initially I setup nginx-ingress on EKS using Helm by following the docs here: <a href="https://github.com/nginxinc/kubernetes-ingress" rel="noreferrer">https://github.com/nginxinc/kubernetes-ingress</a>. I tried to get the sample app working (cafe) using the following config:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  tls:
  - hosts:
    - cafe.example.com
    secretName: cafe-secret
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
      - path: /coffee
        backend:
          serviceName: coffee-svc
          servicePort: 80
</code></pre>

<p>The ingress and all supported services/deploys worked fine but there's one major thing missing: the ingress doesn't have an associated address/ELB:</p>

<pre><code>NAME           HOSTS                 ADDRESS   PORTS     AGE
cafe-ingress   cafe.example.com                80, 443   12h
</code></pre>

<p>Service LoadBalancers create ELB resources, i.e.:</p>

<pre><code>testnodeapp    LoadBalancer   172.20.4.161     a64b46f3588fe...   80:32107/TCP     13h
</code></pre>

<p>However, the Ingress is not creating an address. How do I get an Ingress controller exposed externally on EKS to handle TLS/HTTPS? </p>

<p>I've replicated every step necessary to get up and running on EKS with a secure ingress. I hope this helps anybody else that wants to get their application on EKS quickly and securely.</p>

<p>To get up and running on EKS:</p>

<ol>
<li><p>Deploy EKS using the CloudFormation template <a href="https://gist.github.com/kjenney/356cf4bb029ec0bb7f78fad8230530d5" rel="noreferrer">here</a>: Keep in mind that I've restricted access with the CidrIp: 193.22.12.32/32. Change this to suit your needs.</p></li>
<li><p>Install Client Tools. Follow the guide <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html" rel="noreferrer">here</a>.</p></li>
<li>Configure the client. Follow the guide <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html#eks-configure-kubectl" rel="noreferrer">here</a>.</li>
<li>Enable the worker nodes. Follow the guide <a href="https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html" rel="noreferrer">here</a>.</li>
</ol>

<p>You can verify that the cluster is up and running and you are pointing to it by running:</p>

<p><code>kubectl get svc</code></p>

<p>Now you launch a test application with the nginx ingress.</p>

<p>NOTE: <strong><em>Everything is placed under the ingress-nginx namespace. Ideally this would be templated to build under different namespaces, but for the purposes of this example it works.</em></strong></p>

<p>Deploy nginx-ingress:</p>

<pre><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/provider/cloud-generic.yaml
</code></pre>

<p>Fetch rbac.yml from <a href="https://gist.github.com/kjenney/e1cd655ec2c646c7a700eac7b6488422kubectl" rel="noreferrer">here</a>. Run:</p>

<p><code>kubectl apply -f rbac.yml</code></p>

<p>Have a certificate and key ready for testing. Create the necessary secret like so:</p>

<p><code>kubectl create secret tls cafe-secret --key mycert.key --cert mycert.crt -n ingress-nginx</code></p>

<p>Copy coffee.yml from <a href="https://gist.github.com/kjenney/c0f9acc33bf6b9b38c9e1cc3102efb1b" rel="noreferrer">here</a>. Copy coffee-ingress.yml from <a href="https://gist.github.com/kjenney/cd980c01f7b1008b3ef61c99a6453bc8" rel="noreferrer">here</a>. Update the domain you want to run this under. Run them like so</p>

<pre><code>kubectl apply -f coffee.yaml
kubectl apply -f coffee-ingress.yaml
</code></pre>

<p>Update the CNAME for your domain to point to the ADDRESS for:</p>

<p><code>kubectl get ing -n ingress-nginx -o wide</code></p>

<p>Refresh DNS cache and test the domain. You should get a secure page with request stats. I've replicated this multiple times so if it fails to work for you check the steps, config, and certificate. Also, check the logs on the nginx-ingress-controller* pod. </p>

<p><code>kubectl logs pod/nginx-ingress-controller-*********** -n ingress-nginx</code></p>

<p>That should give you some indication of what's wrong.</p>
