Install and configure ArgoCD Image Updater for automatic Kubernetes deployments with GitOps automation

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly BLUE='\033[0;34m'
readonly NC='\033[0m' # No Color

# Default values
NAMESPACE="${NAMESPACE:-argocd}"
GIT_USER="${GIT_USER:-argocd-image-updater}"
GIT_EMAIL="${GIT_EMAIL:-argocd-image-updater@example.com}"
REGISTRY_USERNAME="${REGISTRY_USERNAME:-}"
REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-}"
REGISTRY_EMAIL="${REGISTRY_EMAIL:-}"

# Progress tracking
STEP=0
TOTAL_STEPS=8

log() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
}

step() {
    STEP=$((STEP + 1))
    echo -e "${BLUE}[$STEP/$TOTAL_STEPS]${NC} $1"
}

usage() {
    cat << EOF
Usage: $0 [OPTIONS]

Install and configure ArgoCD Image Updater for automatic Kubernetes deployments

OPTIONS:
    -n, --namespace     ArgoCD namespace (default: argocd)
    -u, --git-user      Git username for commits (default: argocd-image-updater)
    -e, --git-email     Git email for commits (default: argocd-image-updater@example.com)
    --reg-user         Registry username (optional)
    --reg-pass         Registry password (optional)
    --reg-email        Registry email (optional)
    -h, --help         Show this help message

EXAMPLES:
    $0
    $0 -n my-argocd --git-user "CI Bot" --git-email "ci@company.com"
    $0 --reg-user myuser --reg-pass mypass --reg-email user@example.com

EOF
}

cleanup() {
    error "Installation failed. Cleaning up..."
    kubectl delete -n "$NAMESPACE" -f https://raw.githubusercontent.com/argoproj-labs/argocd-image-updater/stable/manifests/install.yaml 2>/dev/null || true
    kubectl delete secret regcred -n "$NAMESPACE" 2>/dev/null || true
    kubectl delete secret argocd-image-updater-secret -n "$NAMESPACE" 2>/dev/null || true
    kubectl delete configmap argocd-image-updater-config -n "$NAMESPACE" 2>/dev/null || true
    rm -f /tmp/argocd-image-updater* 2>/dev/null || true
}

trap cleanup ERR

check_prerequisites() {
    step "Checking prerequisites"
    
    # Check if running as root or with sudo
    if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
        error "This script requires root privileges or sudo access"
        exit 1
    fi

    # Detect OS and package manager
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                ;;
            *) 
                error "Unsupported distro: $ID"
                exit 1
                ;;
        esac
    else
        error "Cannot detect OS distribution"
        exit 1
    fi

    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        error "kubectl is required but not installed"
        exit 1
    fi

    # Check cluster connection
    if ! kubectl cluster-info &> /dev/null; then
        error "Cannot connect to Kubernetes cluster"
        exit 1
    fi

    # Check if ArgoCD namespace exists
    if ! kubectl get namespace "$NAMESPACE" &> /dev/null; then
        error "ArgoCD namespace '$NAMESPACE' does not exist. Please install ArgoCD first."
        exit 1
    fi

    # Check if ArgoCD is running
    if ! kubectl get deployment argocd-server -n "$NAMESPACE" &> /dev/null; then
        error "ArgoCD server deployment not found in namespace '$NAMESPACE'"
        exit 1
    fi

    success "Prerequisites check passed"
}

install_dependencies() {
    step "Installing dependencies"
    
    if [[ $EUID -eq 0 ]]; then
        SUDO=""
    else
        SUDO="sudo"
    fi

    $SUDO $PKG_UPDATE

    case "$PKG_MGR" in
        apt)
            $SUDO $PKG_INSTALL curl openssh-client
            ;;
        dnf|yum)
            $SUDO $PKG_INSTALL curl openssh-clients
            ;;
    esac

    success "Dependencies installed"
}

install_image_updater() {
    step "Installing ArgoCD Image Updater"
    
    kubectl apply -n "$NAMESPACE" -f https://raw.githubusercontent.com/argoproj-labs/argocd-image-updater/stable/manifests/install.yaml
    
    # Wait for deployment to be ready
    log "Waiting for ArgoCD Image Updater to be ready..."
    kubectl wait --for=condition=available --timeout=300s deployment/argocd-image-updater -n "$NAMESPACE"
    
    success "ArgoCD Image Updater installed"
}

create_registry_secret() {
    step "Creating registry authentication secret"
    
    if [[ -n "$REGISTRY_USERNAME" && -n "$REGISTRY_PASSWORD" && -n "$REGISTRY_EMAIL" ]]; then
        kubectl create secret docker-registry regcred \
            --docker-server=https://index.docker.io/v1/ \
            --docker-username="$REGISTRY_USERNAME" \
            --docker-password="$REGISTRY_PASSWORD" \
            --docker-email="$REGISTRY_EMAIL" \
            -n "$NAMESPACE" || true
        success "Registry secret created"
    else
        warning "Registry credentials not provided. Skipping registry secret creation."
        warning "You can create it later with: kubectl create secret docker-registry regcred ..."
    fi
}

generate_ssh_keys() {
    step "Generating SSH keys for Git access"
    
    # Generate SSH key pair
    ssh-keygen -t ed25519 -f /tmp/argocd-image-updater -N "" -C "$GIT_EMAIL"
    chmod 600 /tmp/argocd-image-updater
    chmod 644 /tmp/argocd-image-updater.pub
    
    # Create Kubernetes secret
    kubectl create secret generic argocd-image-updater-secret \
        --from-file=sshPrivateKey=/tmp/argocd-image-updater \
        -n "$NAMESPACE" || true
    
    success "SSH keys generated and secret created"
    warning "Add the following public key to your Git repository's deploy keys with write access:"
    echo "----------------------------------------"
    cat /tmp/argocd-image-updater.pub
    echo "----------------------------------------"
}

create_config() {
    step "Creating ArgoCD Image Updater configuration"
    
    cat << EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-image-updater-config
  namespace: $NAMESPACE
data:
  registries.conf: |
    registries:
    - name: Docker Hub
      api_url: https://registry-1.docker.io
      ping: yes
      credentials: pullsecret:$NAMESPACE/regcred
    - name: GitHub Container Registry
      api_url: https://ghcr.io
      prefix: ghcr.io
      ping: yes
  git.conf: |
    git:
      user: $GIT_USER
      email: $GIT_EMAIL
  ssh_config: |
    Host *
      PubkeyAcceptedAlgorithms +ssh-rsa
      HostkeyAlgorithms +ssh-rsa
      StrictHostKeyChecking no
      UserKnownHostsFile /dev/null
EOF

    success "Configuration created"
}

update_deployment() {
    step "Updating ArgoCD Image Updater deployment"
    
    # Patch deployment to mount SSH key
    kubectl patch deployment argocd-image-updater -n "$NAMESPACE" --type='json' -p='[
        {
            "op": "add",
            "path": "/spec/template/spec/volumes",
            "value": [
                {
                    "name": "ssh-key",
                    "secret": {
                        "secretName": "argocd-image-updater-secret",
                        "defaultMode": 256
                    }
                }
            ]
        },
        {
            "op": "add",
            "path": "/spec/template/spec/containers/0/volumeMounts",
            "value": [
                {
                    "name": "ssh-key",
                    "mountPath": "/app/.ssh",
                    "readOnly": true
                }
            ]
        }
    ]'
    
    # Wait for rollout to complete
    kubectl rollout status deployment/argocd-image-updater -n "$NAMESPACE"
    
    success "Deployment updated"
}

verify_installation() {
    step "Verifying installation"
    
    # Check pod status
    if kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=argocd-image-updater | grep -q "Running"; then
        success "ArgoCD Image Updater pod is running"
    else
        error "ArgoCD Image Updater pod is not running"
        kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=argocd-image-updater
        exit 1
    fi
    
    # Check logs for errors
    log "Checking logs for any errors..."
    if kubectl logs -n "$NAMESPACE" deployment/argocd-image-updater --tail=50 | grep -i error; then
        warning "Found errors in logs. Please review the logs manually."
    fi
    
    success "Installation verification completed"
    
    echo
    success "ArgoCD Image Updater has been successfully installed!"
    echo
    log "Next steps:"
    log "1. Add the SSH public key to your Git repository's deploy keys"
    log "2. Annotate your ArgoCD applications to enable image updating:"
    log "   kubectl annotate application myapp -n $NAMESPACE \\"
    log "     argocd-image-updater.argoproj.io/image-list=myimage=myregistry/myimage"
    log "3. For more configuration options, visit:"
    log "   https://argocd-image-updater.readthedocs.io/"
}

main() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--namespace)
                NAMESPACE="$2"
                shift 2
                ;;
            -u|--git-user)
                GIT_USER="$2"
                shift 2
                ;;
            -e|--git-email)
                GIT_EMAIL="$2"
                shift 2
                ;;
            --reg-user)
                REGISTRY_USERNAME="$2"
                shift 2
                ;;
            --reg-pass)
                REGISTRY_PASSWORD="$2"
                shift 2
                ;;
            --reg-email)
                REGISTRY_EMAIL="$2"
                shift 2
                ;;
            -h|--help)
                usage
                exit 0
                ;;
            *)
                error "Unknown option: $1"
                usage
                exit 1
                ;;
        esac
    done

    log "Starting ArgoCD Image Updater installation..."
    
    check_prerequisites
    install_dependencies
    install_image_updater
    create_registry_secret
    generate_ssh_keys
    create_config
    update_deployment
    verify_installation
    
    # Cleanup temporary files
    rm -f /tmp/argocd-image-updater*
}

main "$@"