Ensure NAT gateway is allowed as ingress

Author: niallthomson

lab/scripts/setup.sh

@@ -58,6 +58,14 @@ echo "export RESOURCES_PRECREATED='${RESOURCES_PRECREATED}'" > ~/.bashrc.d/infra
 
 echo "export ANALYTICS_ENDPOINT='${ANALYTICS_ENDPOINT}'" > ~/.bashrc.d/analytics.bash
 
+NAT_GW_IP=$(aws ec2 describe-nat-gateways \
+  --filter "Name=tag:created-by,Values=eks-workshop-v2" "Name=tag:env,Values=${EKS_CLUSTER_NAME}" \
+  --query "NatGateways[0].NatGatewayAddresses[0].PublicIp" --output text)
+
+if [ "$NAT_GW_IP" != "None" ] && [ ! -z "$NAT_GW_IP" ]; then
+  INBOUND_CIDRS="${INBOUND_CIDRS:+${INBOUND_CIDRS},}${NAT_GW_IP}/32"
+fi
+
 echo "export INBOUND_CIDRS='${INBOUND_CIDRS}'" > ~/.bashrc.d/inbound-cidr.bash
 
 /usr/local/bin/kubectl completion bash >  ~/.bashrc.d/kubectl_completion.bash

website/docs/automation/gitops/argocd/access_argocd.md

@@ -8,10 +8,11 @@ Let's begin by installing Argo CD in our cluster:
 
 ```bash
 $ helm repo add argo-cd https://argoproj.github.io/argo-helm
+$ ESCAPED_CIDRS="${INBOUND_CIDRS//,/\\,}"
 $ helm upgrade --install argocd argo-cd/argo-cd --version "${ARGOCD_CHART_VERSION}" \
   --namespace "argocd" --create-namespace \
   --values ~/environment/eks-workshop/modules/automation/gitops/argocd/values.yaml \
-  --set "server.service.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges"="$INBOUND_CIDRS" \
+  --set "server.service.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges=$ESCAPED_CIDRS" \
   --wait
 NAME: argocd
 LAST DEPLOYED: [...]

website/docs/automation/gitops/argocd/gitea.md

@@ -8,12 +8,13 @@ We'll be using [Gitea](https://gitea.com) as a quick and easy alternative to Git
 Let's install Gitea in our EKS cluster with Helm:
 
 ```bash
+$ ESCAPED_CIDRS="${INBOUND_CIDRS//,/\\,}"
 $ helm upgrade --install gitea oci://docker.gitea.com/charts/gitea \
   --version "$GITEA_CHART_VERSION" \
   --namespace gitea --create-namespace \
   --values ~/environment/eks-workshop/modules/automation/gitops/argocd/gitea/values.yaml \
-  --set "service.http.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges"="$INBOUND_CIDRS" \
-  --set "service.ssh.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges"="$INBOUND_CIDRS" \
+  --set "service.http.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges=$ESCAPED_CIDRS" \
+  --set "service.ssh.annotations.service\\.beta\\.kubernetes\\.io/load-balancer-source-ranges=$ESCAPED_CIDRS" \
   --set "gitea.admin.password=${GITEA_PASSWORD}" \
   --wait
 ```