devEksCluster, err := eks.NewCluster(ctx, "rh-eks-dev", &eks.ClusterArgs{
			ClusterSecurityGroup: eksSecurityGroup,
			VpcId:                devEksVpc.VpcId,
			Fargate:              pulumi.Bool(true),
			//	CreateOidcProvider:   pulumi.Bool(true),
			// Public subnets will be used for load balancers
			PublicSubnetIds: devEksVpc.PublicSubnetIds,
			// Private subnets will be used for cluster nodes
			PrivateSubnetIds: devEksVpc.PrivateSubnetIds,
		})

_, err = v1.NewIngress(ctx, "api-ingress", &v1.IngressArgs{
			Metadata: &metav1.ObjectMetaArgs{
				Annotations: pulumi.StringMap{
					"<http://kubernetes.io/ingress.class|kubernetes.io/ingress.class>":                pulumi.String("alb"),
					"<http://alb.ingress.kubernetes.io/backend-protocol|alb.ingress.kubernetes.io/backend-protocol>": pulumi.String("HTTP"),
					"<http://alb.ingress.kubernetes.io/scheme|alb.ingress.kubernetes.io/scheme>":           pulumi.String("internet-facing"),
					"<http://alb.ingress.kubernetes.io/target-type|alb.ingress.kubernetes.io/target-type>":      pulumi.String("ip"),
				},
				Labels: pulumi.StringMap{
					"app": pulumi.String("api"),
				},
				Name: pulumi.String("api-ingress"),
			},
			Spec: &v1.IngressSpecArgs{
				Rules: v1.IngressRuleArray{
					&v1.IngressRuleArgs{
						Http: &v1.HTTPIngressRuleValueArgs{
							Paths: v1.HTTPIngressPathArray{
								&v1.HTTPIngressPathArgs{
									Backend: &v1.IngressBackendArgs{
										Service: &v1.IngressServiceBackendArgs{
											Name: pulumi.String("my-service"), // Your service name goes here
											Port: &v1.ServiceBackendPortArgs{
												Number: <http://pulumi.Int|pulumi.Int>(80), // Your service target port number
											},
										},
									},
									Path:     pulumi.String("/*"), // Request path to match
									PathType: pulumi.String("Prefix"),
								},
							},
						},
					},
				},
			},
		}, pulumi.Provider(eksProvider))

devEksCluster, err := eks.NewCluster(ctx, "rh-eks-dev", &eks.ClusterArgs{
			ClusterSecurityGroup: eksSecurityGroup,
			VpcId:                devEksVpc.VpcId,
			Fargate:              pulumi.Bool(true),
			CreateOidcProvider:   pulumi.Bool(true),
			// Public subnets will be used for load balancers
			PublicSubnetIds: devEksVpc.PublicSubnetIds,
			// Private subnets will be used for cluster nodes
			PrivateSubnetIds: devEksVpc.PrivateSubnetIds,
		})

ClusterSecurityGroup: eksSecurityGroup,

CreateOidcProvider:   pulumi.Bool(true),

error: cannot re-use a name that is still in use

apiVersion: <http://networking.k8s.io/v1|networking.k8s.io/v1>
kind: Ingress
metadata:
  name: {{ .Chart.Name }}
  annotations:
    <http://alb.ingress.kubernetes.io/group.name|alb.ingress.kubernetes.io/group.name>: dev-load-balancer
    <http://alb.ingress.kubernetes.io/scheme|alb.ingress.kubernetes.io/scheme>: internet-facing
    <http://alb.ingress.kubernetes.io/target-type|alb.ingress.kubernetes.io/target-type>: instance
    ## SSL Settings
    <http://alb.ingress.kubernetes.io/certificate-arn|alb.ingress.kubernetes.io/certificate-arn>: arn:aws:acm:eu-central-2:949119048772:certificate/2ec19ed9-cb27-4c1d-9fe5-b8b56aca36f4
    <http://alb.ingress.kubernetes.io/listen-ports|alb.ingress.kubernetes.io/listen-ports>: '[{"HTTP": 80}, {"HTTPS":443}]'
    #<http://alb.ingress.kubernetes.io/ssl-redirect|alb.ingress.kubernetes.io/ssl-redirect>: '443'
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /rh-backend
            pathType: Prefix
            backend:
              service:
                name: rh-backend
                port:
                  number: 80
          - path: /rh-public-api
            pathType: Prefix
            backend:
              service:
                name: rh-public-api
                port:
                  number: 80

import { iam } from '@pulumi/aws';
import * as k8s from '@pulumi/kubernetes';
import {
  ComponentResource,
  ComponentResourceOptions,
  Input,
} from '@pulumi/pulumi';
import { serviceAccountNamespace } from './clusterConfig';
import { region } from '@pulumi/aws/config';
import { getAssumeRolePolicyDocument } from './policies';

export type ExternalDNSArgs = {
  /**
   * Name of the environment the cluster will be running in e.g. sandbox, prod, qa
   */
  environment: Input<string>;
  /**
   * Name of the cluster e.g. jugo-monitoring
   */
  clusterName: string;
  /**
   * The DNS update policy: upsert-only or sync. Defaults to sync
   */
  dnsUpdatePolicy?: string;
  /**
   * The issuer of the cluster OIDC provider
   */
  clusterOidcProviderUrl: Input<string>;
  /**
   * The ARN of the cluster OIDC provider
   */
  clusterOidcProviderArn: Input<string>;
  /**
   * The provider with authentication to the cluster
   */
  provider: k8s.Provider;
  /**
   * The resource tags
   */
  tags: Tags;
};

export class ExternalDNS extends ComponentResource {
  constructor(
    name: string,
    {
      environment,
      clusterName,
      dnsUpdatePolicy,
      clusterOidcProviderArn,
      clusterOidcProviderUrl,
      provider,
      tags,
    }: ExternalDNSArgs,
    opts?: ComponentResourceOptions
  ) {
    super('pkg:io:jugo:eks:ExternalDNS', name, {}, opts);

    const externalDNSPolicyDocument: iam.PolicyDocument = {
      Version: '2012-10-17',
      Statement: [
        {
          Effect: 'Allow',
          Action: ['route53:ChangeResourceRecordSets'],
          Resource: ['arn:aws:route53:::hostedzone/*'],
        },
        {
          Effect: 'Allow',
          Action: ['route53:ListHostedZones', 'route53:ListResourceRecordSets'],
          Resource: ['*'],
        },
      ],
    };

    const saName = `${clusterName}-external-dns`;

    const assumeRolePolicy = getAssumeRolePolicyDocument({
      clusterOidcProviderUrl,
      clusterOidcProviderArn,
      provider,
      saName,
    });

    const role = new iam.Role(
      `${clusterName}-external-dns-role`,
      {
        name: `${clusterName}-external-dns-role`,
        assumeRolePolicy,
        tags,
      },
      { parent: this }
    );

    const externalDnsPolicy = new iam.Policy(
      `${clusterName}-external-dns-policy`,
      {
        name: `${clusterName}-external-dns-policy`,
        policy: externalDNSPolicyDocument,
      },
      { parent: this }
    );

    new iam.RolePolicyAttachment(
      `${clusterName}-external-dns-policy-attachment`,
      {
        role: role.name,
        policyArn: externalDnsPolicy.arn,
      },
      { parent: this }
    );

    const serviceAccount = new k8s.core.v1.ServiceAccount(
      saName,
      {
        metadata: {
          name: saName,
          namespace: serviceAccountNamespace,
          annotations: {
            '<http://eks.amazonaws.com/role-arn|eks.amazonaws.com/role-arn>': role.arn,
          },
          labels: {
            '<http://app.kubernetes.io/component|app.kubernetes.io/component>': 'controller',
            '<http://app.kubernetes.io/name|app.kubernetes.io/name>': saName,
          },
        },
      },
      {
        provider,
        parent: this,
      }
    );


    let domainFilter = environment;
    // See: <https://github.com/bitnami/charts/tree/main/bitnami/external-dns>
    new k8s.helm.v3.Release(
      `${clusterName}-external-dns`,
      {
        name: 'external-dns',
        chart: 'external-dns',
        version: '6.18.0',
        namespace: 'kube-system',
        values: {
          provider: 'aws',
          serviceAccount: {
            create: false,
            name: serviceAccount.metadata.name,
          },
          aws: {
            region: region,
            roleArn: role.arn,
          },
          zoneType: 'public',
          txtOwnerId: clusterName,
          domainFilters: [`${domainFilter}`],
          policy: dnsUpdatePolicy || 'sync',
          tolerations: [
            {
              key: '<http://jugo.io/node-role|jugo.io/node-role>',
              operator: 'Exists',
              effect: 'NoSchedule',
            },
          ],
          nodeSelector: {
            '<http://jugo.io/node-role|jugo.io/node-role>': 'system',
          },
        },
        repositoryOpts: {
          repo: '<https://charts.bitnami.com/bitnami>',
        },
      },
      {
        provider,
        customTimeouts: { create: '2m' },
        parent: this,
      }
    );
  }
}