Automating AWS EKS Hosting with GitLab, OpenTofu, and Argo CD

Automating AWS EKS Hosting with GitLab, OpenTofu, and Argo CD

Manual cloud setup remains a persistent pain point for hosting buyers and operators. Network borders, subnet design, IAM credentials, and Kubernetes control planes are easy to misconfigure, and drift between staging and production can cause outages. A recent GitLab tutorial—based on a live demo at AWS Summit Madrid 2025 by Clober (SATEC group)—shows a different path: use GitLab as the single control plane for AWS infrastructure and application delivery. By combining OpenTofu for infrastructure as code, GitLab CI/CD for orchestration, and Argo CD for GitOps, teams can provision an Amazon EKS cluster and deploy a web application without manual console clicks. This matters for sysadmins, agency hosts, and power users who need reproducible, auditable environments.

Why Infrastructure as Code and GitOps Matter for Hosting Teams

Infrastructure as code (IaC) turns networking, compute, and Kubernetes clusters into versioned files. The GitLab example stresses three properties: environments become reproducible (same config anywhere), versioned (every change tracked in Git), and automated (no human interaction). For a hosting provider managing client tenants, that reduces configuration errors and makes disaster recovery a matter of re-applying a repository.

GitOps extends IaC into the application lifecycle. Instead of kubectl exec or manual helm upgrades, the desired state lives in Git. A GitOps operator such as Argo CD continuously reconciles the cluster to match the repo. The demonstrated benefits are consistency across environments, faster recovery (rollback is a commit revert), better collaboration via merge requests, and improved security because developers never need direct cluster access. GitLab bundles the needed pieces: source control, CI/CD pipelines, state management, and a container registry. That consolidation reduces tool sprawl for small ops teams.

Related ServerSpan guide: VPS Hosting for DevOps Pipelines: Setting Up GitLab CI/CD on Your Own Server.

Provisioning a Complete AWS Environment with OpenTofu

The first pipeline provisions networking and EKS using OpenTofu, the open-source Terraform fork. Configuration is not hardcoded; it relies on GitLab CI/CD variables defined at the parent group and inherited by projects. Required variables include TF_VAR_region (e.g., eu-west-1), TF_VAR_instance_type (e.g., t3.medium), TF_VAR_instance_count, TF_VAR_cluster_name, plus AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Sensitive values are marked protected and masked, so they appear only in secure pipeline contexts.

When triggered, the pipeline runs OpenTofu commands using GitLab’s integrated Terraform state backend. According to GitLab documentation reproduced in our research, GitLab-managed OpenTofu state (introduced in GitLab 18.3, requiring glab CLI 1.66+) stores state files with encryption at rest, built-in versioning, and access controlled by GitLab permissions. This eliminates separate state locks or S3 buckets for many teams. OpenTofu then connects to AWS and creates the VPC, subnets, gateways, routing tables, load balancers, and a multi-AZ EKS control plane with worker node groups. At the end of this stage, the AWS environment is live and ready. A post-deploy trigger fires a secondary pipeline to install cluster tooling.

Deploying Kubernetes Tools and Sample App via GitOps

The secondary pipeline uses OpenTofu with the Helm provider to deploy Argo CD, CertManager, and Ingress NGINX Controller into the new EKS cluster. Notably, the source warns that Ingress NGINX is being deprecated in the Kubernetes ecosystem; for new deployments, Traefik or an API-gateway approach is recommended. Each Helm release is declared in code, so upgrades or rollbacks are standard IaC changes.

A third pipeline then ships a sample web app. It downloads the kubeconfig generated by OpenTofu, creates the aws-summit-app namespace, applies Argo CD manifests (repository.yaml, application.yaml, cluster-issuer.yaml), and creates a Container Registry secret using a GitLab access token. The app itself is built earlier: a GitOps repo split separates Apps/ (source code) from Deployments/ (Kubernetes manifests). GitLab CI builds the Docker image, pushes it to the integrated GitLab Container Registry, and updates the deployment repo with the new image tag. Argo CD detects the commit and syncs the cluster. The result is end-to-end automation: infrastructure, cluster tools, and app delivery all traced in one platform.

For a more detailed walkthrough of this part of the topic, read KVM VPS vs Container VPS: Docker, CI/CD, AI Agents, and Self-Hosting Compared.

Operational Tradeoffs and Adoption Checklist

This approach is powerful but not free of friction. It assumes an AWS account, EKS familiarity, and OpenTofu/Terraform knowledge. Running EKS incurs control-plane and worker-node costs regardless of automation. The demo uses masked CI/CD variables for AWS secrets; teams should still rotate keys and consider OIDC federation where possible. GitLab-managed state features require GitLab 18.3 or later—on older instances you can use the HTTP backend but lack integrated versioning UI. The deprecated Ingress NGINX choice is a reminder to validate chart selections before production. For hosting resellers, the model shines when delivering repeated, compliant environments; for a single brochure site, a managed WordPress host may be simpler.

Practical Checklist / Key Takeaways

  • Define protected, masked CI/CD variables (TF_VAR_*, AWS keys) at the GitLab group level before running pipelines.
  • Confirm your GitLab version supports managed OpenTofu state (18.3+ per research) or plan an alternative backend.
  • Separate application source (Apps/) and deployment manifests (Deployments/) to keep GitOps clean.
  • Replace Ingress NGINX with Traefik or API gateway for new clusters despite the demo’s default.
  • Use GitLab Container Registry tokens to avoid embedding long-lived credentials in clusters.
  • Treat Argo CD rollback as a merge revert; test recovery in a staging namespace first.

Conclusion

GitLab as an AWS control plane offers hosting operators a single pane for infrastructure and application delivery. The OpenTofu-to-Argo CD pattern demonstrated at AWS Summit Madrid 2025 shows that reproducible EKS hosting is achievable without leaving the Git workflow. Tradeoffs around complexity, GitLab version, and Kubernetes ingress choice are manageable with discipline. For teams managing multiple client sites or needing auditable cloud builds, this pipeline-first model is worth a pilot.

Related ServerSpan articles

Comentarii

Trimiteți un comentariu

Postări populare de pe acest blog

DebConf26 Wraps Up in Santa Fe as Debian Confirms DebConf27 in Japan: What It Means for Hosting

The annual gathering that quietly shapes much of the software running on European servers has closed for another year. On Saturday 25 July 2026, DebConf26 — the Debian Developers and Contributors Conference — came to an end in Santa Fe, Argentina, having drawn more than 270 attendees from 35 countries for a combined 90 events spanning talks, workshops and Birds of a Feather sessions. Alongside the usual mix of technical deep-dives, packaging debates and community rituals, organizers confirmed the next destination: DebConf27 will take place in Asahikawa, on Japan's northern island of Hokkaido, from Sunday 5 September to Saturday 11 September 2027. If you run Debian images on a VPS, administer a dedicated box, or operate a Proxmox cluster in a European data center, what gets debated at DebConf tends to reach your machines within months. Here is what stood out — and what to do about it. A Week of DebCamp, Five Days of Conference: How DebConf26 Ran The event followed the established...
Citiți mai multe

Software Bill of Materials in Percona Server for MongoDB: Supply Chain Clarity for Database Hosting

Imagine
Percona Server for MongoDB now ships with a Software Bill of Materials (SBOM), a move that should interest anyone running open-source database workloads on European VPS, dedicated, or cloud infrastructure. An SBOM is a machine-readable inventory of every component baked into the software, including transitive dependencies that rarely appear in release notes. For hosting buyers, this means clearer supply-chain visibility, easier license compliance, and faster vulnerability detection. In this article we look at what the SBOM covers, how it links with Percona Monitoring and Management (PMM), and why it matters for operators who manage MongoDB instances themselves or through a provider. What an SBOM Actually Provides in Percona Server for MongoDB A Software Bill of Materials is effectively an ingredient list for a software build. According to the Percona blog summary and the TAVILY research pack, the SBOM shipped with Percona Server for MongoDB is a machine-readable document that enumer...
Citiți mai multe

How ENGINYRING.com Turbocharged Apache2 from 70% to 94%—No External Tools Needed

Imagine
Credit: This article summarizes and analyzes techniques originally published by ENGINYRING.com , with additional technical insights, commentary, and external best practices. Introduction: Apache2, the Underdog Apache2 is often overlooked these days in favor of newer alternatives like nginx and LiteSpeed. Its reputation as a “legacy” web server—slow, memory-hungry, and hard to optimize—precedes it. The typical advice found online: either slap an nginx reverse proxy in front, migrate to Varnish, or jump ship to LiteSpeed. Yet, Apache still powers a massive share of the internet, and for many sites deeply integrated with its ecosystem, moving away isn’t trivial. Recently, ENGINYRING.com published a remarkable technical journey proving that Apache2’s so-called performance ceiling is largely a myth—with the right configuration and without relying on third-party reverse proxies or CDNs, they pushed their GTMetrix performance score from 70% to 94%. This article explores the...
Citiți mai multe