<p>I am trying to write a high-level CDK construct that can be used to deploy Django applications with EKS. I have most of the k8s manifests defined for the application, but I am struggling with the Ingress part. Looking into different options, I have decided to try installing the AWS Load Balancer Controller (<a href="https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/" rel="nofollow noreferrer">https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/</a>). Their documentation has instructions for installing the controller using the AWS CLI and the eksctl CLI tool, so I'm working on trying to translate these into CDK code. Here's what I have so far:</p>
<pre class="lang-js prettyprint-override"><code>import * as ec2 from '@aws-cdk/aws-ec2';
import * as eks from '@aws-cdk/aws-eks';
import * as iam from '@aws-cdk/aws-iam';
import * as cdk from '@aws-cdk/core';
import { ApplicationVpc } from './vpc';
var request = require('sync-request');


export interface DjangoEksProps {
  readonly vpc: ec2.IVpc;
}


export class DjangoEks extends cdk.Construct {

  public vpc: ec2.IVpc;
  public cluster: eks.Cluster;

  constructor(scope: cdk.Construct, id: string, props: DjangoEksProps) {
    super(scope, id);

    this.vpc = props.vpc;


    // allow all account users to assume this role in order to admin the cluster
    const mastersRole = new iam.Role(this, 'AdminRole', {
      assumedBy: new iam.AccountRootPrincipal(),
    });

    this.cluster = new eks.Cluster(this, &quot;MyEksCluster&quot;, {
      version: eks.KubernetesVersion.V1_19,
      vpc: this.vpc,
      mastersRole,
      defaultCapacity: 2,
    });

    // Adopted from comments in this issue: https://github.com/aws/aws-cdk/issues/8836
    const albServiceAccount = this.cluster.addServiceAccount('aws-alb-ingress-controller-sa', {
      name: 'aws-load-balancer-controller',
      namespace: 'kube-system',
    });

    const awsAlbControllerPolicyUrl = 'https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.2.0/docs/install/iam_policy.json';
    const policyJson = request('GET', awsAlbControllerPolicyUrl).getBody('utf8');
    ((JSON.parse(policyJson))['Statement'] as any[]).forEach(statement =&gt; {
      albServiceAccount.addToPrincipalPolicy(iam.PolicyStatement.fromJson(statement))
    })

    // This is where I am stuck
    // https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/#add-controller-to-cluster

    // I tried running this
    // kubectl apply -k &quot;github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master&quot;

    this.cluster.addHelmChart('aws-load-balancer-controller-helm-chart', {
      repository: 'https://aws.github.io/eks-charts',
      chart: 'eks/aws-load-balancer-controller',
      release: 'aws-load-balancer-controller',
      version: '2.2.0',
      namespace: 'kube-system',
      values: {
        clusterName: this.cluster.clusterName,
        serviceAccount: {
          create: false,
          name: 'aws-load-balancer-controller',
        },
      },
    });
  }
}
</code></pre>
<p>Here are the errors I am seeing in CDK when I do <code>cdk deploy</code>:</p>
<pre><code>Received response status [FAILED] from custom resource. Message returned: Error: b'WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /tmp/kubeconfig\nWARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /tmp/kubeconfig\nRelease &quot;aws-load-balancer-controller&quot; does not exist. Installing it now.\nError: chart &quot;eks/aws-load-balancer-controller&quot; version &quot;2.2.0&quot; not found in https://aws.github.io/eks-charts repository\n' Logs: /aws/lambda/DjangoEks-awscdkawseksKubectlProvi-Handler886CB40B-6yld0A8rw9hp at invokeUserFunction (/var/task/framework.js:95:19) at processTicksAndRejections (internal/process/task_queues.js:93:5) at async onEvent (/var/task/framework.js:19:27) at async Runtime.handler (/var/task/cfn-response.js:48:13) (RequestId: ec066bb2-4cc1-48f6-8a88-c6062c27ed0f)
</code></pre>
<p>and a related error:</p>
<pre><code>Received response status [FAILED] from custom resource. Message returned: Error: b'error: no objects passed to create\n' Logs: /aws/lambda/DjangoEks-awscdkawseksKubectlProvi-Handler886CB40B-6yld0A8rw9hp at invokeUserFunction (/var/task/framework.js:95:19) at processTicksAndRejections (internal/process/task_queues.js:93:5) at async onEvent (/var/task/framework.js:19:27) at async Runtime.handler (/var/task/cfn-response.js:48:13) (RequestId: fe2c4c04-4de9-4a71-b18a-ab5bc91d180a)
</code></pre>
<p>The CDK EKS docs say that <code>addHelmChart</code> will install the provided Helm Chart with <code>helm upgrade --install</code>.</p>
<p>The AWS Load Balancer Controller installation instructions also say:</p>
<blockquote>
<p>Install the TargetGroupBinding CRDs if upgrading the chart via helm upgrade.</p>
<pre><code>kubectl apply -k &quot;github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master&quot;
</code></pre>
</blockquote>
<p>I'm not sure how I can do this part in CDK. The link to <code>github.com/aws/eks-charts/stable/aws-load-balancer-controller//crds?ref=master</code> gives a 404, but that command does work when I run it against my EKS cluster, and I can install those CRDs. Running the deploy command after manually installing those CRDs also fails with the same message.</p>
<p>I think the error in my code comes from the <code>HelmChartOptions</code> that I pass to the <code>addHelmChart</code> command, and I have tried several options, and referenced similar CDK projects that install Helm charts from the same repo, but I keep getting failures.</p>
<p>Is anyone else installing the AWS Load Balancer Controller with CDK like I am trying to do here? One project that I have been trying to reference is <a href="https://github.com/neilkuan/cdk8s-aws-load-balancer-controller" rel="nofollow noreferrer">https://github.com/neilkuan/cdk8s-aws-load-balancer-controller</a>.</p>
<p>There is also discussion in this GitHub issue: <a href="https://github.com/aws/aws-cdk/issues/8836" rel="nofollow noreferrer">https://github.com/aws/aws-cdk/issues/8836</a> that might help as well, but a lot of the discussion is around cert manager manager which doesn't seem to be relevant for what I'm trying to do.</p>

briancaffey
<p>Now built into CDK (<a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AlbControllerOptions.html" rel="nofollow noreferrer">ref</a>), you no longer need to write your own code to add an ALB controller. Looks like it was added to resolve <a href="https://github.com/aws/aws-cdk/issues/8836" rel="nofollow noreferrer">issue 8836</a> on which OP had replied.</p>
<p>Extract from the above CDK ref:</p>
<pre><code>new eks.Cluster(this, 'HelloEKS', {
  version: eks.KubernetesVersion.V1_21,
  albController: {
    version: eks.AlbControllerVersion.V2_4_1,
  },
});
</code></pre>
<p>CDK uses the same method to deploy the ALB <a href="https://github.com/aws/aws-cdk/blob/v2.87.0/packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts#L185" rel="nofollow noreferrer">as seen here</a>.</p>
