Using GitLab as Your AWS Control Plane: OpenTofu, Argo CD, and GitOps in Practice
Managing cloud hosting infrastructure by hand is slow, inconsistent, and difficult to reproduce. A detailed walkthrough from GitLab’s blog shows a fully automated alternative where GitLab acts as the operations brain for AWS. By combining OpenTofu for infrastructure as code, GitLab CI/CD for pipeline orchestration, and Argo CD for GitOps-based application delivery, teams can provision VPCs, Amazon EKS clusters, and a sample web application without manual steps. For hosting buyers, sysadmins, and site owners, the approach promises reproducible environments, faster rollback, and tighter access control. This article breaks down the workflow, the tools involved, and the operational tradeoffs you should weigh before adopting it.
Related ServerSpan guide: VPS Hosting for DevOps Pipelines: Setting Up GitLab CI/CD on Your Own Server.
Provisioning AWS Networking and EKS with OpenTofu
The first stage uses OpenTofu—the open-source Terraform fork—to declaratively build the underlying AWS environment. A GitLab pipeline is triggered from an infrastructure repository that contains the OpenTofu configuration files. According to the source research, the pipeline relies on GitLab CI/CD variables instead of hardcoded values, keeping configuration flexible and environment-independent.
Required variables declared under Settings > CI/CD > Variables in the parent group include:
TF_VAR_region(e.g., eu-west-1)TF_VAR_instance_type(example given: t3.medium)TF_VAR_instance_count(number of worker nodes)TF_VAR_cluster_nameAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEY
All are marked protected in GitLab, and the sensitive AWS secret is also masked. The research does not specify the exact GitLab version used in the demo, but it notes the integrated Terraform state backend securely manages the state file inside GitLab. Separate GitLab documentation included in our research (Sources 3–5) states that GitLab-managed OpenTofu state—introduced in GitLab 18.3 and requiring GitLab CLI 1.66+—adds automatic encryption at rest, built-in versioning, and permission-model access. Whether or not the demo used that newer feature, the principle is the same: state lives securely next to your code.
The executed pipeline connects to AWS through configured providers to create VPC, subnets, gateways, routing tables, load balancers, and an EKS control plane with worker node groups distributed across multiple availability zones. A secondary trigger then hands off to the next pipeline.
Automating Cluster Tooling: Argo CD, CertManager, and Ingress
Once the EKS cluster is live, a second GitLab pipeline—hosted in a separate repository—runs automatically via a trigger job. It uses OpenTofu with the Helm provider to download the kubeconfig and install core Kubernetes tooling declaratively.
The components deployed are:
- Argo CD for GitOps-based state management
- CertManager for automated TLS certificate handling
- Ingress NGINX Controller for ingress traffic routing
An important caveat from the research: Ingress NGINX Controller is being deprecated in the Kubernetes ecosystem. For new deployments, the source explicitly recommends evaluating alternatives such as Traefik or an API-gateway approach. Each Helm release is defined in OpenTofu code, so upgrades or rollbacks are standard infrastructure changes. No manual kubectl access by developers is required, which reduces credential sprawl and attack surface.
GitOps Application Delivery and Container Builds
The final deployment stage uses a third pipeline to deliver a sample web app through Argo CD. GitLab uses the kubeconfig generated earlier to apply Argo CD manifests that define the desired state. The pipeline creates the application namespace (aws-summit-app), sets credentials dynamically via CI/CD variables, and creates a Container Registry secret so the cluster can pull images securely.
The research emphasizes a clean GitOps repository split:
- Apps/ holds source code repositories (e.g., the sample web page)
- Deployments/ holds Kubernetes manifest repositories (e.g., deployment.yaml, service.yaml, ingress.yaml)
A dedicated CI/CD pipeline builds the Docker image from a Dockerfile, pushes it to the GitLab Container Registry, and then updates the image reference in the deployment repo via commit or merge request. Argo CD detects the manifest change and synchronizes the cluster. Rollback is as simple as reverting a commit—a major operational benefit for hosting providers and site owners who need rapid recovery from bad releases.
For a more detailed walkthrough of this part of the topic, read KVM VPS vs Container VPS: Docker, CI/CD, AI Agents, and Self-Hosting Compared.
Operational Tradeoffs and Who Should Adopt This
This model is powerful but not free of friction. It requires an AWS account, a Kubernetes/EKS cluster, and familiarity with GitLab CI/CD, OpenTofu, and GitOps concepts. The research does not include migration steps from an existing manually managed environment, so teams with legacy infrastructure must plan state import and cutover carefully而非 assume turnkey adoption.
Cost is a real consideration. Multi-AZ EKS control planes, load balancers, and worker nodes generate ongoing AWS billing. The instance type and node count are configurable but must be tuned to workload to avoid overspend.
Security posture improves because developers do not need direct cluster access; deployments flow through reviewed merge requests. However, you now depend on GitLab pipeline availability and the integrity of your CI/CD variables. The noted deprecation of Ingress NGINX means new adopters should substitute a maintained ingress or gateway to avoid future compatibility gaps.
For HostXMe readers—whether running managed VPS, cloud VMs, or full Kubernetes stacks—the takeaway is that GitLab can serve as a unified control plane, but the setup suits teams with enough DevOps maturity to maintain pipelines and state files. Small static-site owners may find the overhead unnecessary, while SaaS operators and agencies managing multiple environments will see the strongest return.
Key Takeaways and Practical Checklist
- Store AWS keys as protected and masked GitLab CI/CD variables; never hardcode them.
- Use GitLab’s integrated Terraform state backend or, if on GitLab 18.3+, the managed OpenTofu state for encryption and versioning.
- Separate application source repos from deployment manifest repos to keep GitOps clean.
- After EKS provisioning, auto-install Argo CD and CertManager; replace deprecated Ingress NGINX with Traefik or an API gateway for new builds.
- Build and push images to GitLab Container Registry, then let Argo CD sync the updated manifests.
- Test the full pipeline in a staging group before applying to production infrastructure.
For hosting operators willing to invest in automation, using GitLab as an AWS control plane transforms fragile manual setups into auditable, reproducible systems. The combination of OpenTofu, GitLab CI/CD, and Argo CD reduces human error and accelerates recovery, but it demands disciplined pipeline design and ongoing cost oversight. Evaluate your team’s workflow maturity and start with a non-critical project before standardizing on this architecture.