Install and configure ArgoCD for GitOps continuous deployment with RBAC and SSL

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly BLUE='\033[0;34m'
readonly NC='\033[0m'

# Configuration
readonly SCRIPT_NAME=$(basename "$0")
readonly ARGOCD_NAMESPACE="argocd"
readonly ARGOCD_DOMAIN="${1:-argocd.local}"

# Print usage
usage() {
    echo "Usage: $SCRIPT_NAME [domain]"
    echo "  domain: ArgoCD server domain (default: argocd.local)"
    echo ""
    echo "Example: $SCRIPT_NAME argocd.example.com"
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Error handler
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        kubectl delete namespace "$ARGOCD_NAMESPACE" --ignore-not-found=true 2>/dev/null || true
        rm -f kubectl argocd.key argocd.crt
    fi
}
trap cleanup ERR

# Check prerequisites
check_prereqs() {
    if [[ $EUID -eq 0 ]]; then
        log_error "Do not run this script as root. Use a user with sudo privileges."
        exit 1
    fi
    
    if ! command -v sudo &> /dev/null; then
        log_error "sudo is required but not installed"
        exit 1
    fi
    
    if ! command -v curl &> /dev/null; then
        log_error "curl is required but not installed"
        exit 1
    fi
}

# Detect distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_UPDATE="dnf check-update || true"
                PKG_INSTALL="dnf install -y"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_UPDATE="yum check-update || true"
                PKG_INSTALL="yum install -y"
                ;;
            *) 
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Install kubectl
install_kubectl() {
    log_info "[1/8] Installing kubectl..."
    
    if command -v kubectl &> /dev/null; then
        log_warn "kubectl already installed, skipping..."
        return 0
    fi
    
    local kubectl_version
    kubectl_version=$(curl -sL https://dl.k8s.io/release/stable.txt)
    
    curl -sLO "https://dl.k8s.io/release/$kubectl_version/bin/linux/amd64/kubectl"
    chmod 755 kubectl
    sudo install -o root -g root -m 755 kubectl /usr/local/bin/kubectl
    rm -f kubectl
    
    kubectl version --client >/dev/null
    log_success "kubectl installed successfully"
}

# Verify cluster access
verify_cluster() {
    log_info "[2/8] Verifying Kubernetes cluster access..."
    
    if ! kubectl cluster-info &>/dev/null; then
        log_error "Cannot connect to Kubernetes cluster. Check your kubeconfig."
        exit 1
    fi
    
    if ! kubectl auth can-i create namespace &>/dev/null; then
        log_error "Insufficient permissions. Cluster-admin access required."
        exit 1
    fi
    
    local node_count
    node_count=$(kubectl get nodes --no-headers | wc -l)
    if [ "$node_count" -lt 3 ]; then
        log_warn "Less than 3 nodes detected. High availability may not work properly."
    fi
    
    log_success "Cluster access verified"
}

# Create ArgoCD namespace
create_namespace() {
    log_info "[3/8] Creating ArgoCD namespace..."
    
    if kubectl get namespace "$ARGOCD_NAMESPACE" &>/dev/null; then
        log_warn "Namespace $ARGOCD_NAMESPACE already exists"
    else
        kubectl create namespace "$ARGOCD_NAMESPACE"
        log_success "Namespace created"
    fi
}

# Install ArgoCD
install_argocd() {
    log_info "[4/8] Installing ArgoCD with high availability..."
    
    kubectl apply -n "$ARGOCD_NAMESPACE" -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/install.yaml
    
    log_info "Waiting for ArgoCD components to be ready (up to 10 minutes)..."
    
    local deployments=(
        "argocd-applicationset-controller"
        "argocd-dex-server"
        "argocd-notifications-controller"
        "argocd-redis-ha-haproxy"
        "argocd-repo-server"
        "argocd-server"
    )
    
    for deployment in "${deployments[@]}"; do
        kubectl wait --for=condition=available --timeout=600s "deployment/$deployment" -n "$ARGOCD_NAMESPACE"
    done
    
    log_success "ArgoCD installed successfully"
}

# Generate SSL certificates
generate_ssl_certs() {
    log_info "[5/8] Generating SSL certificates..."
    
    if ! command -v openssl &> /dev/null; then
        log_info "Installing OpenSSL..."
        sudo $PKG_UPDATE
        sudo $PKG_INSTALL openssl
    fi
    
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
        -keyout argocd.key \
        -out argocd.crt \
        -subj "/C=US/ST=CA/L=San Francisco/O=ArgoCD/OU=IT/CN=$ARGOCD_DOMAIN" \
        2>/dev/null
    
    chmod 600 argocd.key
    chmod 644 argocd.crt
    
    kubectl create secret tls argocd-server-tls \
        --cert=argocd.crt \
        --key=argocd.key \
        -n "$ARGOCD_NAMESPACE" \
        --dry-run=client -o yaml | kubectl apply -f -
    
    rm -f argocd.key argocd.crt
    log_success "SSL certificates generated and stored"
}

# Configure ArgoCD server with SSL
configure_ssl() {
    log_info "[6/8] Configuring ArgoCD server with SSL..."
    
    kubectl patch configmap argocd-cmd-params-cm -n "$ARGOCD_NAMESPACE" \
        --type merge \
        -p '{"data":{"server.insecure":"false"}}'
    
    kubectl patch deployment argocd-server -n "$ARGOCD_NAMESPACE" \
        --type='json' \
        -p='[
            {
                "op": "add",
                "path": "/spec/template/spec/volumes/-",
                "value": {
                    "name": "tls-certs",
                    "secret": {
                        "secretName": "argocd-server-tls"
                    }
                }
            },
            {
                "op": "add",
                "path": "/spec/template/spec/containers/0/volumeMounts/-",
                "value": {
                    "name": "tls-certs",
                    "mountPath": "/app/config/tls",
                    "readOnly": true
                }
            }
        ]'
    
    kubectl rollout status deployment/argocd-server -n "$ARGOCD_NAMESPACE" --timeout=300s
    log_success "SSL configuration applied"
}

# Create LoadBalancer service
create_service() {
    log_info "[7/8] Creating LoadBalancer service..."
    
    cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: argocd-server-loadbalancer
  namespace: $ARGOCD_NAMESPACE
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/name: argocd-server
spec:
  type: LoadBalancer
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8080
  - name: grpc
    port: 443
    protocol: TCP
    targetPort: 8080
  selector:
    app.kubernetes.io/name: argocd-server
EOF
    
    log_success "LoadBalancer service created"
}

# Verify installation
verify_installation() {
    log_info "[8/8] Verifying installation..."
    
    # Check all pods are running
    kubectl wait --for=condition=Ready --timeout=300s pod -l app.kubernetes.io/part-of=argocd -n "$ARGOCD_NAMESPACE"
    
    # Get admin password
    local admin_password
    admin_password=$(kubectl -n "$ARGOCD_NAMESPACE" get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
    
    # Get service info
    local service_ip
    service_ip=$(kubectl get service argocd-server-loadbalancer -n "$ARGOCD_NAMESPACE" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null || echo "pending")
    
    log_success "ArgoCD installation completed successfully!"
    echo ""
    echo -e "${GREEN}=== ArgoCD Access Information ===${NC}"
    echo "URL: https://$service_ip (or https://$ARGOCD_DOMAIN if DNS configured)"
    echo "Username: admin"
    echo "Password: $admin_password"
    echo ""
    echo -e "${YELLOW}Note: If LoadBalancer IP shows 'pending', check your cluster's LoadBalancer implementation.${NC}"
    echo -e "${YELLOW}For NodePort access, run: kubectl get service argocd-server -n $ARGOCD_NAMESPACE${NC}"
}

# Main execution
main() {
    if [[ "${1:-}" == "-h" ]] || [[ "${1:-}" == "--help" ]]; then
        usage
        exit 0
    fi
    
    log_info "Starting ArgoCD installation for domain: $ARGOCD_DOMAIN"
    
    check_prereqs
    detect_distro
    install_kubectl
    verify_cluster
    create_namespace
    install_argocd
    generate_ssl_certs
    configure_ssl
    create_service
    verify_installation
}

main "$@"