EKS ALB Ingress Rules for kubernetes dashboard

Question

As the guide at: https://repost.aws/knowledge-center/eks-kubernetes-dashboard-custom-path, I used the following yaml to expose kubernetes dashboard to ALB. Then I mapped a domain xyz.com to that ALB. However when I accessed the dashboard via browser, I received the error: Client sent an HTTP request to an HTTPS server.

Could anyone tell me what is wrong?

---
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
  type: NodePort
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: "kubernetes-dashboard"
  namespace: "kubernetes-dashboard"
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:xxxx:certificate/xxx-xxx-xxx-xxx-xxxx
    alb.ingress.kubernetes.io/healthcheck-path: /dashboard/
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
  labels:
    app: dashboard
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ssl-redirect
            port:
              name: use-annotation
      - path: /
        pathType: Prefix
        backend:
          service:
            name: "kubernetes-dashboard"
            port:
              number: 443
---

Answer 1

Follow the document of AWS Load Balancer Controller and Kubernetes

1. https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
2. https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/

The annotation alb.ingress.kubernetes.io/backend-protocol must be set to HTTPS to make it works:

alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:xxxx:certificate/xxx-xxx-4447-8593-xxx
alb.ingress.kubernetes.io/healthcheck-path: /dashboard/
alb.ingress.kubernetes.io/healthcheck-protocol: 'HTTPS'
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
alb.ingress.kubernetes.io/ssl-redirect: '443'
alb.ingress.kubernetes.io/backend-protocol: 'HTTPS'