[AWS] Configure Ingress SSL and SSL Redirect on Load Balancer Controller

Chúng ta cũng đã biết cách tạo ingress trên eks là như thế nào.
Nhưng giờ chúng ta cần add thêm SSL vào trong ingress của Load Balancer Controller

1) Overview

2) Demo

2.1) Prepare system

2.1.1) Install eks cluster

Đầu tiên bạn cần dựng được 1 eks cluster:
https://github.com/mrnim94/terraform-aws/tree/master/eks/AWS-EKS-Cluster-Basics
và đầu là 1 bài viết về dụng eks cluster bằng terraform.
https://nimtechnology.com/2022/08/21/aws-create-eks-node-groups-in-public-and-private-subnets/

2.1.2) Install Load Balancer Controller

Tiếp theo bạn cần cài đặt Load Balancer Controller
https://github.com/mrnim94/terraform-aws/tree/master/eks-ingress/EKS-with-LoadBalancer-Controller/lbc-install-terraform-manifests
Bạn có thể tham khảo bài này:
https://nimtechnology.com/2022/09/13/aws-aws-load-balancer-controller-and-ingress-are-installed-by-terraform-helm-provider-on-eks/

2.2) Install ACM Certificate by terraform

c11-acm-certificate.tf
>>>>

# Resource: ACM Certificate
resource "aws_acm_certificate" "acm_cert" {
  domain_name       = "*.nimtechnology.com"
  validation_method = "DNS"

  tags = {
    Environment = "dev"
  }

  lifecycle {
    create_before_destroy = true
   }
}

# Outputs
output "acm_certificate_id" {
  value = aws_acm_certificate.acm_cert.id 
}

output "acm_certificate_arn" {
  value = aws_acm_certificate.acm_cert.arn
}

output "acm_certificate_status" {
  value = aws_acm_certificate.acm_cert.status
}

https://github.com/mrnim94/terraform-aws/tree/master/ingress-ssl-terraform-manifests

root@LP11-D7891:~# kubectl get all
NAME                                         READY   STATUS    RESTARTS   AGE
pod/app1-nginx-deployment-777cddb9b4-h6km5   1/1     Running   0          63s
pod/app2-nginx-deployment-577bf469f7-5nd2j   1/1     Running   0          63s
pod/app3-nginx-deployment-6988d859c5-8lwwx   1/1     Running   0          63s

NAME                                  TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/app1-nginx-nodeport-service   NodePort    172.20.108.228   <none>        80:30031/TCP   55s
service/app2-nginx-nodeport-service   NodePort    172.20.124.205   <none>        80:31908/TCP   55s
service/app3-nginx-nodeport-service   NodePort    172.20.239.172   <none>        80:31545/TCP   55s
service/kubernetes                    ClusterIP   172.20.0.1       <none>        443/TCP        120m

NAME                                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/app1-nginx-deployment   1/1     1            1           68s
deployment.apps/app2-nginx-deployment   1/1     1            1           68s
deployment.apps/app3-nginx-deployment   1/1     1            1           68s

NAME                                               DESIRED   CURRENT   READY   AGE
replicaset.apps/app1-nginx-deployment-777cddb9b4   1         1         1       69s
replicaset.apps/app2-nginx-deployment-577bf469f7   1         1         1       69s
replicaset.apps/app3-nginx-deployment-6988d859c5   1         1         1       69s
root@LP11-D7891:~# kubectl get ingress
NAME               CLASS                  HOSTS   ADDRESS                                                  PORTS   AGE
ingress-ssl-demo   my-aws-ingress-class   *       ingress-ssl-demo-236734605.us-east-1.elb.amazonaws.com   80      74s