ArgoCD setup in EKS Cluster

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.2.1/manifests/install.yaml

sudo curl --silent --location -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/v2.2.1/argocd-linux-amd64

sudo chmod +x /usr/local/bin/argocd

3a. Open the IAM console at https://console.aws.amazon.com/iam/.
3b. In the navigation panel, choose Roles, Create Role.
3c. In the Select type of trusted entity section, choose Web identity.
3d. In the Choose a web identity provider section:
    For Identity provider, choose the URL for your cluster. 
    For Audience, choose sts.amazonaws.com.
    Choose Next: Permissions.
3e. In the Attach Policy section, select the AWSLoadBalancerControllerIAMPolicy policy that you created in a previous step to use for your service account.
3f. Choose Next: Tags.
3g. Choose Next: Review.
3h. For Role Name, enter a name for your role, such as AmazonEKSLoadBalancerControllerRole, and then choose Create Role.
3i. After the role is created, choose the role in the console to open it for editing.
3j. Choose the Trust relationships tab, and then choose Edit trust relationship.
3k. Find the line that looks similar to the following line:
`"oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:aud": "sts.amazonaws.com"`
Change the line to look like the following line. Replace EXAMPLED539D4633E53DE1B716D3041E with your cluster's OIDC provider ID and if necessary, replace region-code with the Region code that your cluster is in. Change aud to sub and replace sts.amazonaws.com with the value in the following text.

`"oidc.eks.region-code.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E:sub":"system:serviceaccount:kube-system:aws-load-balancer-controller"`

3l. Choose Update Trust Policy to finish.
3m. Note the ARN of the role for use in a later step.
3n. Save the following contents to a file that's named aws-load-balancer-controller-service-account.yaml, replacing 111122223333 with your account ID.
=============================================
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/name: aws-load-balancer-controller
  name: aws-load-balancer-controller
  namespace: kube-system
  annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/AmazonEKSLoadBalancerControllerRole
Create the service account on your cluster.
=============================================
3o. kubectl apply -f aws-load-balancer-controller-service-account.yaml

curl -o iam_policy_v1_to_v2_additional.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.3.1/docs/install/iam_policy_v1_to_v2_additional.json

aws iam create-policy \
  --policy-name AWSLoadBalancerControllerAdditionalIAMPolicy \
  --policy-document file://iam_policy_v1_to_v2_additional.json

aws iam attach-role-policy \
  --role-name your-role name \
  --policy-arn arn:aws:iam::111122223333:policy/AWSLoadBalancerControllerAdditionalIAMPolicy

helm repo add eks https://aws.github.io/eks-charts

helm repo update

--set region=region-code

--set vpcId=vpc-xxxxxxxx

--set image.repository=account.dkr.ecr.region-code.amazonaws.com/amazon/aws-load-balancer-controller

helm install aws-load-balancer-controller eks/aws-load-balancer-controller \
  -n kube-system \
  --set clusterName=cluster-name \
  --set region=region-code \
  --set vpcId=vpc-xxxxxxxx \
  --set serviceAccount.create=false \
  --set serviceAccount.name=aws-load-balancer-controller 

kubectl get deployment -n kube-system aws-load-balancer-controller

NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
aws-load-balancer-controller   2/2     2            2           84s

---
apiVersion: v1
kind: Service
metadata:
  name: argogrpc
  namespace: argocd
  annotations:
    alb.ingress.kubernetes.io/backend-protocol-version: HTTP2
  labels:
    app: argogrpc
spec:
  ports:
  - name: "443"
    port: 443
    protocol: TCP
    targetPort: 8080
  selector:
    app.kubernetes.io/name: argocd-server
  sessionAffinity: None
  type: ClusterIP

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: argocd
  namespace: argocd
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/backend-protocol: HTTPS
    alb.ingress.kubernetes.io/certificate-arn: <ACM ARN>
    alb.ingress.kubernetes.io/inbound-cidrs: x.xx.xx.xx/32, xx.xx.xx.xx/32
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-FS-1-2-2019-08
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/subnets: <public subnets>
    alb.ingress.kubernetes.io/target-type: ip
    # Use this annotation (which must match a service name) to route traffic to HTTP2 backends.
    alb.ingress.kubernetes.io/conditions.argogrpc: |
      [{"field":"http-header","httpHeaderConfig":{"httpHeaderName": "Content-Type", "values":["application/grpc"]}}]
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
spec:
  rules:
  - host: "argocd.demo-angel.com"
    http:
      paths:
      - backend:
          serviceName: argogrpc
          servicePort: 443
        pathType: ImplementationSpecific
      - backend:
          serviceName: argocd-server
          servicePort: 443
        pathType: ImplementationSpecific

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

kubectl config use-context arn:aws:eks:us-east-1:XXXXXXXX:cluster/eks-argocd
argocd login --port-forward  --port-forward-namespace argocd