If kubernetes API service on EKS is private not exposed over internet, could I then create ingress which is exposed over the internet?
While it is technically possible to create an ingress for the Kubernetes API service, you will inevitably get certificate mismatch errors. If you're trying to restrict access to the public API endpoint you can create a whitelist of CIDRs, see Amazon EKS cluster endpoint access control. If your question is about using ingress when the API endpoint is private, the answer is "yes" unless your VPC doesn't have an IGW.