Integrate OPA Gatekeeper with ArgoCD for GitOps policy management

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Global variables
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
LOG_FILE="/tmp/opa-argocd-install.log"
CLEANUP_ITEMS=()
ARGOCD_PORT_PID=""

# Logging function
log() {
    echo -e "${2:-$NC}$1${NC}" | tee -a "$LOG_FILE"
}

# Error handling and cleanup
cleanup() {
    if [[ ${#CLEANUP_ITEMS[@]} -gt 0 ]]; then
        log "Cleaning up due to error..." "$YELLOW"
        for item in "${CLEANUP_ITEMS[@]}"; do
            case "$item" in
                "argocd_namespace") kubectl delete namespace argocd --ignore-not-found=true ;;
                "gatekeeper") kubectl delete -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.14/deploy/gatekeeper.yaml --ignore-not-found=true ;;
                "port_forward") [[ -n "$ARGOCD_PORT_PID" ]] && kill "$ARGOCD_PORT_PID" 2>/dev/null || true ;;
            esac
        done
    fi
}

trap cleanup ERR

# Usage function
usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Install and configure OPA Gatekeeper with ArgoCD for GitOps policy management

Options:
    -h, --help          Show this help message
    -p, --port PORT     ArgoCD port for access (default: 8080)
    -t, --timeout SEC   Timeout for pod readiness (default: 600)
    --skip-verify       Skip final verification steps

Example:
    $0
    $0 --port 9090 --timeout 300
EOF
}

# Parse arguments
ARGOCD_PORT=8080
TIMEOUT=600
SKIP_VERIFY=false

while [[ $# -gt 0 ]]; do
    case $1 in
        -h|--help) usage; exit 0 ;;
        -p|--port) ARGOCD_PORT="$2"; shift 2 ;;
        -t|--timeout) TIMEOUT="$2"; shift 2 ;;
        --skip-verify) SKIP_VERIFY=true; shift ;;
        *) log "Unknown option: $1" "$RED"; usage; exit 1 ;;
    esac
done

# Detect distribution
if [[ ! -f /etc/os-release ]]; then
    log "Cannot detect Linux distribution" "$RED"
    exit 1
fi

. /etc/os-release

case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_INSTALL="apt install -y"
        PKG_UPDATE="apt update"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_INSTALL="dnf install -y"
        PKG_UPDATE="dnf check-update || true"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_INSTALL="dnf install -y"
        PKG_UPDATE="dnf check-update || true"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_INSTALL="yum install -y"
        PKG_UPDATE="yum check-update || true"
        ;;
    *)
        log "Unsupported distribution: $ID" "$RED"
        exit 1
        ;;
esac

log "Detected distribution: $PRETTY_NAME" "$BLUE"

# Check prerequisites
log "[1/9] Checking prerequisites..." "$BLUE"

if [[ $EUID -eq 0 ]]; then
    log "Running as root user" "$YELLOW"
else
    if ! sudo -n true 2>/dev/null; then
        log "This script requires sudo privileges" "$RED"
        exit 1
    fi
fi

# Check required tools
for tool in kubectl curl; do
    if ! command -v "$tool" &> /dev/null; then
        log "Installing $tool..." "$YELLOW"
        sudo $PKG_UPDATE
        case "$tool" in
            kubectl)
                case "$PKG_MGR" in
                    apt)
                        curl -fsSLo /etc/apt/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
                        echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
                        sudo apt update && sudo $PKG_INSTALL kubectl
                        ;;
                    dnf|yum)
                        cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOF
                        sudo $PKG_INSTALL kubectl
                        ;;
                esac
                ;;
            curl) sudo $PKG_INSTALL curl ;;
        esac
    fi
done

# Verify kubectl connection
if ! kubectl cluster-info &>/dev/null; then
    log "kubectl is not configured or cluster is not accessible" "$RED"
    exit 1
fi

log "Prerequisites check completed" "$GREEN"

# Install OPA Gatekeeper
log "[2/9] Installing OPA Gatekeeper..." "$BLUE"
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/release-3.14/deploy/gatekeeper.yaml
CLEANUP_ITEMS+=("gatekeeper")

log "[3/9] Waiting for Gatekeeper pods to be ready..." "$BLUE"
kubectl wait --for=condition=Ready pods --all -n gatekeeper-system --timeout="${TIMEOUT}s"
log "Gatekeeper installation completed" "$GREEN"

# Install ArgoCD
log "[4/9] Installing ArgoCD..." "$BLUE"
kubectl create namespace argocd
CLEANUP_ITEMS+=("argocd_namespace")
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

log "[5/9] Waiting for ArgoCD pods to be ready..." "$BLUE"
kubectl wait --for=condition=Ready pods --all -n argocd --timeout="${TIMEOUT}s"
log "ArgoCD installation completed" "$GREEN"

# Configure ArgoCD access
log "[6/9] Configuring ArgoCD access..." "$BLUE"
ARGOCD_PASSWORD=""
for i in {1..30}; do
    if ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" 2>/dev/null | base64 -d); then
        break
    fi
    log "Waiting for ArgoCD initial password... ($i/30)" "$YELLOW"
    sleep 2
done

if [[ -z "$ARGOCD_PASSWORD" ]]; then
    log "Failed to retrieve ArgoCD initial password" "$RED"
    exit 1
fi

log "ArgoCD admin password: $ARGOCD_PASSWORD" "$GREEN"

# Start port forwarding
log "[7/9] Starting ArgoCD port forwarding on port $ARGOCD_PORT..." "$BLUE"
kubectl port-forward svc/argocd-server -n argocd "$ARGOCD_PORT:443" &>/dev/null &
ARGOCD_PORT_PID=$!
CLEANUP_ITEMS+=("port_forward")

# Create policy repository structure
log "[8/9] Creating policy repository structure..." "$BLUE"
POLICY_DIR="$SCRIPT_DIR/gatekeeper-policies"
mkdir -p "$POLICY_DIR"/{templates,constraints,config}
chown -R $(id -u):$(id -g) "$POLICY_DIR"
chmod -R 755 "$POLICY_DIR"

# Create constraint template for required labels
cat > "$POLICY_DIR/templates/required-labels.yaml" << 'EOF'
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        type: object
        properties:
          labels:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        
        violation[{"msg": msg}] {
          provided := input.review.object.metadata.labels
          required := input.parameters.labels
          missing := required[_]
          not provided[missing]
          msg := sprintf("Missing required label: %v", [missing])
        }
EOF

# Create constraint template for container limits
cat > "$POLICY_DIR/templates/container-limits.yaml" << 'EOF'
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8scontainerlimits
spec:
  crd:
    spec:
      names:
        kind: K8sContainerLimits
      validation:
        type: object
        properties:
          cpu:
            type: string
          memory:
            type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerlimits
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := "Container must specify CPU limits"
        }
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := "Container must specify memory limits"
        }
EOF

# Create sample constraint
cat > "$POLICY_DIR/constraints/require-app-label.yaml" << 'EOF'
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-app-label
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet", "DaemonSet"]
  parameters:
    labels: ["app"]
EOF

chmod 644 "$POLICY_DIR"/{templates,constraints,config}/*.yaml

log "Policy repository structure created at $POLICY_DIR" "$GREEN"

# Verification
if [[ "$SKIP_VERIFY" != "true" ]]; then
    log "[9/9] Performing verification..." "$BLUE"
    
    # Check Gatekeeper
    GATEKEEPER_PODS=$(kubectl get pods -n gatekeeper-system --no-headers | grep -c "Running" || echo "0")
    if [[ "$GATEKEEPER_PODS" -lt 3 ]]; then
        log "Warning: Expected at least 3 Gatekeeper pods running, found $GATEKEEPER_PODS" "$YELLOW"
    else
        log "✓ Gatekeeper pods are running ($GATEKEEPER_PODS/3+)" "$GREEN"
    fi
    
    # Check ArgoCD
    ARGOCD_PODS=$(kubectl get pods -n argocd --no-headers | grep -c "Running" || echo "0")
    if [[ "$ARGOCD_PODS" -lt 5 ]]; then
        log "Warning: Expected at least 5 ArgoCD pods running, found $ARGOCD_PODS" "$YELLOW"
    else
        log "✓ ArgoCD pods are running ($ARGOCD_PODS/5+)" "$GREEN"
    fi
    
    # Check port forwarding
    sleep 2
    if kill -0 "$ARGOCD_PORT_PID" 2>/dev/null; then
        log "✓ ArgoCD port forwarding is active (PID: $ARGOCD_PORT_PID)" "$GREEN"
    else
        log "Warning: ArgoCD port forwarding may have failed" "$YELLOW"
    fi
    
    log "✓ Policy templates created in $POLICY_DIR" "$GREEN"
    
    log "Verification completed" "$GREEN"
fi

# Installation summary
log "Installation completed successfully!" "$GREEN"
echo
log "Next steps:" "$BLUE"
log "1. Access ArgoCD UI at https://localhost:$ARGOCD_PORT" "$NC"
log "   Username: admin" "$NC"
log "   Password: $ARGOCD_PASSWORD" "$NC"
log "2. Initialize git repository in $POLICY_DIR and push to your Git provider" "$NC"
log "3. Create ArgoCD Application to sync policies from your Git repository" "$NC"
log "4. Apply constraint templates: kubectl apply -f $POLICY_DIR/templates/" "$NC"
log "5. Apply constraints: kubectl apply -f $POLICY_DIR/constraints/" "$NC"
echo
log "Port forwarding PID: $ARGOCD_PORT_PID (kill to stop)" "$YELLOW"
log "Log file: $LOG_FILE" "$NC"

# Remove cleanup items since installation succeeded
CLEANUP_ITEMS=()