Any insight on why you prefer the nginx ingress vs the ALB ingress controller on AWS? you can group/combine ingresses as well and it will automatically load the correct certificate from ACM if it exists. Which means you won’t have to mess around with certbot. Your TLS ends in the loadbalancer in that case though.

EKS managed addons now support custom configuration( might not have when you started out ) though maybe not all the custom features you’re looking for are there. It’s not as flexible as the helm chart obviously, but usually supports the most basic things you’d want to use.

Interesting read otherwise!

Personally I’ve had issues selling people on gitops/kustomize as they all find helm charts a lot easier.