How to Implement GitOps with ArgoCD 2.12 and GitLab CI 16.10 for Kubernetes 1.32 and Docker 25.0

#!/bin/bash
# install-k3s-1.32.sh
# Provisions a single-node Kubernetes 1.32 cluster using k3s, with error handling and validation
set -euo pipefail  # Exit on error, unset variable, pipe failure

# Configuration
K3S_VERSION="v1.32.0+k3s1"
K3S_TOKEN="my-secure-token-12345"  # Replace with a randomly generated token in production
CLUSTER_NAME="gitops-demo-cluster"
INSTALL_LOG="/var/log/k3s-install.log"

# Function to log messages with timestamps
log_message() {
    local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
    echo "[$timestamp] $1" | tee -a "$INSTALL_LOG"
}

# Function to handle errors
handle_error() {
    local exit_code=$?
    log_message "ERROR: Script failed at line $1 with exit code $exit_code"
    exit $exit_code
}
trap 'handle_error $LINENO' ERR

log_message "Starting k3s ${K3S_VERSION} installation for cluster ${CLUSTER_NAME}"

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_message "ERROR: This script must be run as root"
    exit 1
fi

# Check system requirements (64-bit Linux, 2+ CPU, 4GB+ RAM)
ARCH=$(uname -m)
if [[ "$ARCH" != "x86_64" && "$ARCH" != "aarch64" ]]; then
    log_message "ERROR: Unsupported architecture $ARCH. Only x86_64 and aarch64 are supported."
    exit 1
fi

CPU_CORES=$(nproc)
if [[ $CPU_CORES -lt 2 ]]; then
    log_message "ERROR: Insufficient CPU cores. Required: 2+, Found: $CPU_CORES"
    exit 1
fi

TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
TOTAL_MEM_GB=$((TOTAL_MEM_KB / 1024 / 1024))
if [[ $TOTAL_MEM_GB -lt 4 ]]; then
    log_message "ERROR: Insufficient RAM. Required: 4GB+, Found: ${TOTAL_MEM_GB}GB"
    exit 1
fi

log_message "System checks passed. Architecture: $ARCH, CPU cores: $CPU_CORES, RAM: ${TOTAL_MEM_GB}GB"

# Download k3s binary
log_message "Downloading k3s version ${K3S_VERSION}"
curl -Lo /usr/local/bin/k3s "https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}/k3s" 2>&1 | tee -a "$INSTALL_LOG"
chmod +x /usr/local/bin/k3s

# Install k3s server
log_message "Installing k3s server with token ${K3S_TOKEN}"
INSTALL_K3S_EXEC="--token ${K3S_TOKEN} --cluster-init --disable traefik --disable servicelb" \
curl -sfL https://get.k3s.io | sh - 2>&1 | tee -a "$INSTALL_LOG"

# Wait for cluster to be ready
log_message "Waiting for k3s cluster to become ready..."
sleep 10
until kubectl --kubeconfig /etc/rancher/k3s/k3s.yaml get nodes 2>&1 | grep -q "Ready"; do
    log_message "Cluster not ready yet, retrying in 5 seconds..."
    sleep 5
done

# Copy kubeconfig to user directory
mkdir -p $HOME/.kube
cp /etc/rancher/k3s/k3s.yaml $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
chmod 600 $HOME/.kube/config

log_message "k3s cluster ${CLUSTER_NAME} is ready! Kubeconfig saved to $HOME/.kube/config"
kubectl get nodes

#!/bin/bash
# install-argocd-2.12.sh
# Installs ArgoCD 2.12 on Kubernetes 1.32, configures initial settings, and sets up admin access
set -euo pipefail

ARGOCD_VERSION="v2.12.0"
ARGOCD_NAMESPACE="argocd"
ADMIN_PASSWORD="MySecureArgoCDPassword123!"  # Replace with a strong password in production
KUBECONFIG="$HOME/.kube/config"

# Function to log messages
log_argocd() {
    echo "[$(date +'%Y-%m-%d %H:%M:%S')] [ARGOCD] $1"
}

# Check if kubectl is available
if ! command -v kubectl &> /dev/null; then
    log_argocd "ERROR: kubectl not found. Please install kubectl first."
    exit 1
fi

# Check cluster connectivity
if ! kubectl get nodes &> /dev/null; then
    log_argocd "ERROR: Cannot connect to Kubernetes cluster. Check kubeconfig at $KUBECONFIG"
    exit 1
fi

log_argocd "Starting ArgoCD ${ARGOCD_VERSION} installation"

# Create ArgoCD namespace
log_argocd "Creating namespace ${ARGOCD_NAMESPACE}"
kubectl create namespace "$ARGOCD_NAMESPACE" 2>/dev/null || log_argocd "Namespace $ARGOCD_NAMESPACE already exists"

# Install ArgoCD using official manifests
log_argocd "Downloading ArgoCD ${ARGOCD_VERSION} manifests"
curl -Lo argocd-install.yaml "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml" 2>&1 | tee -a argocd-install.log

# Apply manifests
log_argocd "Applying ArgoCD manifests"
kubectl apply -n "$ARGOCD_NAMESPACE" -f argocd-install.yaml 2>&1 | tee -a argocd-install.log

# Wait for ArgoCD pods to be ready
log_argocd "Waiting for ArgoCD pods to become ready..."
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=argocd-server -n "$ARGOCD_NAMESPACE" --timeout=300s

# Set admin password
log_argocd "Setting ArgoCD admin password"
argocd login --core
argocd account update-password \
    --account admin \
    --current-password "$(kubectl -n "$ARGOCD_NAMESPACE" get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)" \
    --new-password "$ADMIN_PASSWORD"

# Expose ArgoCD server via NodePort (for simplicity; use Ingress in production)
log_argocd "Exposing ArgoCD server via NodePort 30007"
kubectl patch svc argocd-server -n "$ARGOCD_NAMESPACE" -p '{"spec": {"type": "NodePort", "ports": [{"name": "http", "port": 80, "targetPort": 8080, "nodePort": 30007}, {"name": "https", "port": 443, "targetPort": 8080, "nodePort": 30008}]}}'

# Verify installation
log_argocd "Verifying ArgoCD installation"
argocd cluster list
argocd app list

log_argocd "ArgoCD ${ARGOCD_VERSION} installed successfully!"
log_argocd "Access ArgoCD UI at: https://:30008"
log_argocd "Admin username: admin"
log_argocd "Admin password: $ADMIN_PASSWORD"

# .gitlab-ci.yml for sample Go REST API
# GitLab CI 16.10 pipeline to build, test, push Docker image, and update GitOps repo
# Requires GitLab Container Registry enabled, CI/CD variables set (see comments)

image: docker:25.0.0
services:
  - docker:25.0.0-dind

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  APP_NAME: "go-rest-api"
  GITOPS_REPO: "git@gitlab.com:your-username/gitops-demo.git"  # Replace with your GitOps repo URL
  GITOPS_BRANCH: "main"
  K8S_CLUSTER: "gitops-demo-cluster"

stages:
  - test
  - build
  - deploy

# Run unit tests for Go app
test:
  image: golang:1.22
  stage: test
  script:
    - cd src
    - go mod download
    - go test -v ./... -coverprofile=coverage.out
    - go tool cover -html=coverage.out -o coverage.html
  artifacts:
    paths:
      - src/coverage.html
    expire_in: 7 days
  only:
    - main
    - merge_requests

# Build Docker image, push to GitLab Container Registry
build:
  stage: build
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
  script:
    - docker build -t "$CI_REGISTRY_IMAGE/$APP_NAME:latest" -t "$CI_REGISTRY_IMAGE/$APP_NAME:$CI_COMMIT_SHA" -f Dockerfile .
    - docker push "$CI_REGISTRY_IMAGE/$APP_NAME:latest"
    - docker push "$CI_REGISTRY_IMAGE/$APP_NAME:$CI_COMMIT_SHA"
  after_script:
    - docker logout "$CI_REGISTRY"
  only:
    - main

# Update GitOps repository with new image tag
update-gitops:
  image: alpine:3.20
  stage: deploy
  before_script:
    - apk add --no-cache git yq jq
    - git config --global user.email "ci-bot@gitlab.com"
    - git config --global user.name "GitLab CI Bot"
    - eval $(ssh-agent -s)
    - echo "$GITOPS_SSH_PRIVATE_KEY" | ssh-add -
    - mkdir -p ~/.ssh
    - ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
  script:
    - git clone --single-branch --branch "$GITOPS_BRANCH" "$GITOPS_REPO" gitops
    - cd gitops
    # Update image tag in deployment manifest
    - yq -i ".spec.template.spec.containers[0].image = \"$CI_REGISTRY_IMAGE/$APP_NAME:$CI_COMMIT_SHA\"" apps/go-rest-api/deployment.yaml
    # Commit and push changes
    - git add apps/go-rest-api/deployment.yaml
    - git commit -m "Update $APP_NAME image to $CI_COMMIT_SHA [skip ci]"
    - git push origin "$GITOPS_BRANCH"
  only:
    - main
  when: manual  # Remove for automatic updates

apiVersion: apps/v1
kind: Deployment
metadata:
  name: go-rest-api
  namespace: default
  labels:
    app: go-rest-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: go-rest-api
  template:
    metadata:
      labels:
        app: go-rest-api
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
    spec:
      containers:
      - name: go-rest-api
        image: registry.gitlab.com/your-username/go-rest-api:latest  # Updated by GitOps pipeline
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          name: http
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 3
          periodSeconds: 5
        env:
        - name: APP_ENV
          value: "production"
        - name: PORT
          value: "8080"
      imagePullSecrets:
      - name: gitlab-registry-secret  # Create this secret to pull from GitLab Container Registry
---
apiVersion: v1
kind: Service
metadata:
  name: go-rest-api-svc
  namespace: default
spec:
  selector:
    app: go-rest-api
  ports:
  - port: 80
    targetPort: 8080
    name: http
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: go-rest-api-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: go-rest-api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: go-rest-api-svc
            port:
              number: 80

kubectl create secret docker-registry gitlab-registry-secret \
  --docker-server=registry.gitlab.com \
  --docker-username=your-username \
  --docker-password=your-gitlab-access-token \
  --docker-email=your-email@example.com

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: go-rest-api
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitlab.com/your-username/gitops-demo.git  # Replace with your GitOps repo URL
    targetRevision: main
    path: apps/go-rest-api
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  resource.customizations: |
    cert-manager.io/Certificate:
      health.lua: |
        if obj.status.conditions then
          for _, condition in ipairs(obj.status.conditions) do
            if condition.type == "Ready" and condition.status == "True" then
              return { status = "Healthy", message = "Certificate is ready" }
            end
          end
        end
        return { status = "Progressing", message = "Certificate not ready" }

build:
  stage: build
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths:
      - .docker-cache/
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - docker pull "$CI_REGISTRY_IMAGE/$APP_NAME:latest" || true
  script:
    - docker build --cache-from "$CI_REGISTRY_IMAGE/$APP_NAME:latest" -t "$CI_REGISTRY_IMAGE/$APP_NAME:latest" -t "$CI_REGISTRY_IMAGE/$APP_NAME:$CI_COMMIT_SHA" -f Dockerfile .
    - docker push "$CI_REGISTRY_IMAGE/$APP_NAME:latest"
    - docker push "$CI_REGISTRY_IMAGE/$APP_NAME:$CI_COMMIT_SHA"

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: block-manual-deployment-changes
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups: ["apps"]
      resources: ["deployments"]
      operations: ["CREATE", "UPDATE"]
  validations:
  - expression: "authorizer.request.userInfo.username == 'system:serviceaccount:argocd:argocd-application-controller'"
    message: "Manual changes to Deployments are not allowed. Use GitOps pipeline."

gitops-argocd-gitlab-k8s-demo/
├── src/                  # Sample Go REST API source code
│   ├── main.go
│   ├── go.mod
│   └── main_test.go
├── Dockerfile            # Docker 25.0 multi-stage build file
├── .gitlab-ci.yml        # GitLab CI 16.10 pipeline definition
├── gitops/               # GitOps repository contents (deployed to cluster)
│   └── apps/
│       └── go-rest-api/
│           ├── deployment.yaml
│           ├── service.yaml
│           └── ingress.yaml
├── scripts/              # Provisioning and installation scripts
│   ├── install-k3s-1.32.sh
│   └── install-argocd-2.12.sh
├── argocd/               # ArgoCD application manifests
│   └── application.yaml
└── README.md             # Project documentation