feat: move GitLab from EKS to EC2 docker-compose

- Disable GitLab ArgoCD addon (enabled-addons, hub-config, platform.yaml registry)
- Remove Keycloak SSO client for GitLab
- Remove gitlab-nlb/gitlab-distribution Taskfile.cloudfront.yaml tasks
- Add gitlab:init-ec2 task: wait for CE readiness, create root token, user1, repos
- Replace k8s Job wait in clone-repos with CF readiness poll
- GITLAB_DOMAIN_INT uses EC2 private IP for in-cluster ArgoCD git access
- Remove git_token from seed-secrets (seeded by CDK at deploy time)

Refs #754

Author: allamand

Taskfile.yaml

@@ -25,6 +25,13 @@ includes:
     vars:
       CONFIG_FILE: "{{.CONFIG_FILE}}"
     optional: true
+  workshop:
+    taskfile: ./cluster-providers/workshop/Taskfile.yaml
+    dir: ./cluster-providers/workshop
+    vars:
+      CONFIG_FILE: "{{.CONFIG_FILE}}"
+      ROOT_DIR: "{{.ROOT_DIR}}"
+    optional: true
 
 tasks:
   default:

applications/java/deployment/templates/kro/application.yaml

@@ -21,7 +21,6 @@ spec:
     enabled: true
     path: /java-app
     rewrite: true
-    healthcheckPath: /java-app/
   functionalGate:
     enabled: true
     image: "httpd:alpine"

applications/java/kargo/deploy-kargo.sh

@@ -18,33 +18,6 @@ if [[ -z "$AWS_ACCOUNT_ID" || -z "$AWS_REGION" || -z "$GITLAB_URL" || -z "$GIT_U
     exit 1
 fi
 
-# Ensure the Kargo controller has ECR read access so the warehouse can discover images.
-# Creates the IAM role + pod identity association (idempotent).
-HUB_CLUSTER="${RESOURCE_PREFIX:-peeks}-hub"
-KARGO_ROLE="${HUB_CLUSTER}-kargo-controller-role"
-
-echo "Setting up Kargo ECR access..."
-if ! aws iam get-role --role-name "$KARGO_ROLE" --region "$AWS_REGION" >/dev/null 2>&1; then
-  aws iam create-role --role-name "$KARGO_ROLE" \
-    --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"pods.eks.amazonaws.com"},"Action":["sts:AssumeRole","sts:TagSession"]}]}' \
-    --description "Kargo controller ECR read access" --no-cli-pager >/dev/null
-  aws iam attach-role-policy --role-name "$KARGO_ROLE" \
-    --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly --region "$AWS_REGION"
-  echo "  ✓ IAM role $KARGO_ROLE created"
-fi
-KARGO_ROLE_ARN=$(aws iam get-role --role-name "$KARGO_ROLE" --query 'Role.Arn' --output text --region "$AWS_REGION")
-
-if ! aws eks list-pod-identity-associations --cluster-name "$HUB_CLUSTER" --region "$AWS_REGION" \
-    --query "associations[?namespace=='kargo'&&serviceAccount=='kargo-controller']" --output text 2>/dev/null | grep -q .; then
-  aws eks create-pod-identity-association \
-    --cluster-name "$HUB_CLUSTER" --namespace kargo --service-account kargo-controller \
-    --role-arn "$KARGO_ROLE_ARN" --region "$AWS_REGION" >/dev/null
-  echo "  ✓ pod identity association created"
-  # Restart kargo controller to pick up the new credentials
-  kubectl rollout restart deployment -n kargo 2>/dev/null || true
-  kubectl rollout status deployment -n kargo --timeout=60s 2>/dev/null || true
-fi
-
 
 # Deploy the project (creates namespace)
 echo "Creating Kargo project..."

applications/java/progressive-app.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: team-java
 spec:
   image: argoproj/rollouts-demo:blue
-  image_name: progressive-app
+  image_name: rollout-demo
   replicas: 2
   port: 8080
   targetPort: 8080
@@ -25,11 +25,11 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: progressive-app
+  name: rollout-demo
   namespace: team-java
 spec:
   selector:
-    app: progressive-app
+    app: rollout-demo
   ports:
     - port: 8080
       targetPort: 8080
@@ -38,11 +38,11 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: progressive-app-preview
+  name: rollout-demo-preview
   namespace: team-java
 spec:
   selector:
-    app: progressive-app
+    app: rollout-demo
   ports:
     - port: 8080
       targetPort: 8080

applications/next-js/deployment/dev/application.yaml

@@ -22,7 +22,6 @@ spec:
     enabled: true
     path: /unicorn
     rewrite: false
-    healthcheckPath: /unicorn
 ---
 apiVersion: v1
 kind: Service

applications/rust/deployment/templates/kro/application.yaml

@@ -29,7 +29,6 @@ spec:
     enabled: true
     path: /rust-app
     rewrite: true
-    healthcheckPath: /rust-app/
   ## Uncomment the sections below to enable metrics-driven progressive delivery (Module 30)
   # functionalGate:
   #   enabled: true

cluster-providers/kind-crossplane/Taskfile.cloudfront.yaml

@@ -28,32 +28,17 @@ tasks:
               echo "Platform CloudFront origin OK"
             fi
           fi
-          # GitLab NLB
-          NLB_DNS=$(aws elbv2 describe-load-balancers --names "{{.HUB_CLUSTER_NAME}}-gitlab" --region {{.AWS_REGION}} --query 'LoadBalancers[0].DNSName' --output text 2>/dev/null)
-          DIST_ID=$(aws cloudfront list-distributions --query "DistributionList.Items[?Comment=='{{.HUB_CLUSTER_NAME}}-gitlab'].Id" --output text 2>/dev/null)
-          if [ -n "$DIST_ID" ] && [ "$DIST_ID" != "None" ] && [ -n "$NLB_DNS" ] && [ "$NLB_DNS" != "None" ]; then
-            CURRENT_ORIGIN=$(aws cloudfront get-distribution-config --id "$DIST_ID" --query 'DistributionConfig.Origins.Items[0].DomainName' --output text)
-            if [ "$CURRENT_ORIGIN" != "$NLB_DNS" ]; then
-              echo "Updating GitLab CloudFront origin: $CURRENT_ORIGIN → $NLB_DNS"
-              ETAG=$(aws cloudfront get-distribution-config --id "$DIST_ID" --query 'ETag' --output text)
-              aws cloudfront get-distribution-config --id "$DIST_ID" --query 'DistributionConfig' --output json | \
-                jq --arg dns "$NLB_DNS" '.Origins.Items[0].DomainName = $dns' > /tmp/cf-gitlab-config.json
-              aws cloudfront update-distribution --id "$DIST_ID" --if-match "$ETAG" --distribution-config file:///tmp/cf-gitlab-config.json > /dev/null
-              echo "GitLab CloudFront updated"
-            else
-              echo "GitLab CloudFront origin OK"
-            fi
-          fi
+          # GitLab CloudFront is managed by CDK (NLB + distribution in team-stack.ts).
+          # private/gitlab-cloudfront-domain is written by bootstrap.sh at EC2 boot.
 
   setup-exposure:
-    desc: Pre-create ALB and CloudFront distributions (cloudfront mode only)
+    desc: Pre-create ALB and CloudFront distributions (cloudfront mode only, skipped if cloudfrontDomain already set in config)
     status:
       - '[ "{{.EXPOSURE_MODE}}" != "cloudfront" ]'
+      - '[ -n "{{.CLOUDFRONT_DOMAIN}}" ]'
     cmds:
       - task: create-alb
       - task: hub-distribution
-      - task: gitlab-nlb
-      - task: gitlab-distribution
   create-alb:
     desc: Pre-create the platform ALB for CloudFront (cloudfront mode only)
     status:
@@ -62,9 +47,12 @@ tasks:
       - printf '{{.C_STEP}}▸ Creating platform ALB...{{.C_RESET}}\n'
       - |
         set -e
-        VPC_ID=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.vpcId' --output text)
-        PUBLIC_SUBNETS=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.subnetIds' --output text | tr '\t' '\n')
-        PUBLIC_SUBNETS=$(aws ec2 describe-subnets --subnet-ids $PUBLIC_SUBNETS --region {{.AWS_REGION}} --query 'Subnets[?MapPublicIpOnLaunch==`true`].SubnetId' --output text | tr '\t' ' ')
+        # Use VPC from config.local.yaml cloudfront.vpcId if set, else derive from EKS cluster
+        VPC_ID="${{.CLOUDFRONT_VPC_ID}}"
+        if [ -z "$VPC_ID" ]; then
+          VPC_ID=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.vpcId' --output text)
+        fi
+        PUBLIC_SUBNETS=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" "Name=mapPublicIpOnLaunch,Values=true" --region {{.AWS_REGION}} --query 'Subnets[*].SubnetId' --output text | tr '\t' ' ')
         CLUSTER_SG=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.clusterSecurityGroupId' --output text)
         SG_NAME="{{.HUB_CLUSTER_NAME}}-platform-alb-sg"
         SG_ID=$(aws ec2 describe-security-groups --filters "Name=group-name,Values=$SG_NAME" "Name=vpc-id,Values=$VPC_ID" --region {{.AWS_REGION}} --query 'SecurityGroups[0].GroupId' --output text 2>/dev/null)
@@ -109,55 +97,7 @@ tasks:
         CF_DOMAIN=$(aws cloudfront create-distribution --distribution-config "$CF_CONFIG" --query "Distribution.DomainName" --output text)
         mkdir -p {{.ROOT_DIR}}/private
         echo -n "$CF_DOMAIN" > {{.ROOT_DIR}}/private/cloudfront-domain
-        echo "CloudFront: $CF_DOMAIN"
+        echo "CloudFront: $CF_DOMAIN (copy this to config.local.yaml cloudfront.cloudfrontDomain)"
       - printf '{{.C_OK}}✓ Platform CloudFront ready.{{.C_RESET}}\n'
-
-  gitlab-nlb:
-    desc: Pre-create GitLab NLB for CloudFront (cloudfront mode only)
-    status:
-      - aws elbv2 describe-load-balancers --names {{.HUB_CLUSTER_NAME}}-gitlab --region {{.AWS_REGION}} 2>/dev/null
-    cmds:
-      - printf '{{.C_STEP}}▸ Creating GitLab NLB...{{.C_RESET}}\n'
-      - |
-        set -e
-        VPC_ID=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.vpcId' --output text)
-        PUBLIC_SUBNETS=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.subnetIds' --output text | tr '\t' '\n')
-        PUBLIC_SUBNETS=$(aws ec2 describe-subnets --subnet-ids $PUBLIC_SUBNETS --region {{.AWS_REGION}} --query 'Subnets[?MapPublicIpOnLaunch==`true`].SubnetId' --output text | tr '\t' ' ')
-        # Create WITH a security group: an NLB created with zero SGs can never have
-        # SGs added later, which blocks the AWS LBC from attaching its managed
-        # frontend SG when it adopts this NLB. Seed with the cluster SG; the LBC
-        # replaces the set via SetSecurityGroups during reconcile.
-        CLUSTER_SG=$(aws eks describe-cluster --name {{.HUB_CLUSTER_NAME}} --region {{.AWS_REGION}} --query 'cluster.resourcesVpcConfig.clusterSecurityGroupId' --output text)
-        NLB_ARN=$(aws elbv2 create-load-balancer \
-          --name "{{.HUB_CLUSTER_NAME}}-gitlab" \
-          --subnets $PUBLIC_SUBNETS \
-          --security-groups "$CLUSTER_SG" \
-          --scheme internet-facing \
-          --type network \
-          --tags Key=elbv2.k8s.aws/cluster,Value={{.HUB_CLUSTER_NAME}} Key=service.k8s.aws/stack,Value=gitlab/gitlab Key=service.k8s.aws/resource,Value=LoadBalancer \
-          --region {{.AWS_REGION}} \
-          --query 'LoadBalancers[0].LoadBalancerArn' --output text)
-        NLB_DNS=$(aws elbv2 describe-load-balancers --load-balancer-arns "$NLB_ARN" --region {{.AWS_REGION}} --query 'LoadBalancers[0].DNSName' --output text)
-        echo "GitLab NLB: $NLB_DNS"
-      - printf '{{.C_OK}}✓ GitLab NLB ready.{{.C_RESET}}\n'
-
-  gitlab-distribution:
-    desc: Create CloudFront distribution for GitLab NLB (idempotent)
-    status:
-      - aws cloudfront list-distributions --query "DistributionList.Items[?Comment=='{{.HUB_CLUSTER_NAME}}-gitlab'].Id" --output text | grep -q .
-    cmds:
-      - printf '{{.C_STEP}}▸ Creating GitLab CloudFront distribution...{{.C_RESET}}\n'
-      - |
-        set -e
-        NLB_DNS=$(aws elbv2 describe-load-balancers --names "{{.HUB_CLUSTER_NAME}}-gitlab" --region {{.AWS_REGION}} --query 'LoadBalancers[0].DNSName' --output text)
-        CF_CONFIG=$(cat <<'CFEOF'
-        {"CallerReference":"{{.HUB_CLUSTER_NAME}}-gitlab-TIMESTAMP","Comment":"{{.HUB_CLUSTER_NAME}}-gitlab","Enabled":true,"Origins":{"Quantity":1,"Items":[{"Id":"gitlab-nlb","DomainName":"NLB_DNS_PLACEHOLDER","CustomOriginConfig":{"HTTPPort":80,"HTTPSPort":443,"OriginProtocolPolicy":"http-only","OriginSslProtocols":{"Quantity":1,"Items":["TLSv1.2"]}}}]},"DefaultCacheBehavior":{"TargetOriginId":"gitlab-nlb","ViewerProtocolPolicy":"redirect-to-https","AllowedMethods":{"Quantity":7,"Items":["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],"CachedMethods":{"Quantity":2,"Items":["GET","HEAD"]}},"CachePolicyId":"4135ea2d-6df8-44a3-9df3-4b5a84be39ad","OriginRequestPolicyId":"216adef6-5c7f-47e4-b989-5492eafa07d3","Compress":true},"ViewerCertificate":{"CloudFrontDefaultCertificate":true},"PriceClass":"PriceClass_100"}
-        CFEOF
-        )
-        CF_CONFIG=$(echo "$CF_CONFIG" | sed "s|NLB_DNS_PLACEHOLDER|$NLB_DNS|g; s|TIMESTAMP|$(date +%s)|g")
-        CF_DOMAIN=$(aws cloudfront create-distribution --distribution-config "$CF_CONFIG" --query "Distribution.DomainName" --output text)
-        mkdir -p {{.ROOT_DIR}}/private
-        echo -n "$CF_DOMAIN" > {{.ROOT_DIR}}/private/gitlab-cloudfront-domain
-        echo "GitLab CloudFront: $CF_DOMAIN"
-      - printf '{{.C_OK}}✓ GitLab CloudFront ready.{{.C_RESET}}\n'
+# gitlab-nlb and gitlab-distribution removed — GitLab CloudFront is now managed by CDK (team-stack.ts).