From cd5cd81a3dc13172cb27a554031f4a786470442f Mon Sep 17 00:00:00 2001
From: sallaman <sallaman@amazon.com>
Date: Thu, 7 Sep 2023 14:05:32 +0000
Subject: [PATCH] upgrade blue-green-upgrade sample addons to V5 with
 gitops-bridge

---
 .github/PULL_REQUEST_TEMPLATE.md              |   2 +-
 .github/workflows/dependency-review.yml       |   2 +-
 .../blue-green-upgrade/bootstrap/addons.yaml  |  33 ++
 .../bootstrap/workloads.yaml                  |  68 +++
 examples/blue-green-upgrade/eks-blue/main.tf  |  30 +-
 .../blue-green-upgrade/eks-blue/outputs.tf    |  20 +-
 .../blue-green-upgrade/eks-blue/providers.tf  |   2 +-
 .../blue-green-upgrade/eks-blue/variables.tf  |  63 +-
 examples/blue-green-upgrade/eks-green/main.tf |  29 +-
 .../blue-green-upgrade/eks-green/outputs.tf   |  20 +-
 .../blue-green-upgrade/eks-green/providers.tf |   2 +-
 .../blue-green-upgrade/eks-green/variables.tf |  57 +-
 .../blue-green-upgrade/environment/main.tf    |  14 +-
 .../modules/eks_cluster/main.tf               | 546 ++++++++----------
 .../modules/eks_cluster/outputs.tf            |  29 +
 .../modules/eks_cluster/variables.tf          |  64 +-
 .../modules/eks_cluster/versions.tf           |  11 +-
 .../tear-down-applications.sh                 |  21 +
 examples/blue-green-upgrade/tear-down.sh      |  26 +-
 .../terraform.tfvars.example                  |   3 +-
 20 files changed, 639 insertions(+), 403 deletions(-)
 create mode 100644 examples/blue-green-upgrade/bootstrap/addons.yaml
 create mode 100644 examples/blue-green-upgrade/bootstrap/workloads.yaml
 create mode 100755 examples/blue-green-upgrade/tear-down-applications.sh

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 6d2434bbf4..c35f235b2c 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,6 +1,6 @@
 # Description
 
-<!-- 
+<!--
 🛑 Please open an issue first to discuss any significant work and flesh out details/direction - we would hate for your time to be wasted.
 Consult the [CONTRIBUTING](https://github.com/aws-ia/terraform-aws-eks-blueprints/blob/main/CONTRIBUTING.md#contributing-via-pull-requests) guide for submitting pull-requests.
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index aa20c458b2..8692d30d51 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -2,7 +2,7 @@
 #
 # This Action will scan dependency manifest files that change as part of a Pull Request,
 # surfacing known-vulnerable versions of the packages declared or updated in the PR.
-# Once installed, if the workflow run is marked as required, 
+# Once installed, if the workflow run is marked as required,
 # PRs introducing known-vulnerable packages will be blocked from merging.
 #
 # Source repository: https://github.com/actions/dependency-review-action
diff --git a/examples/blue-green-upgrade/bootstrap/addons.yaml b/examples/blue-green-upgrade/bootstrap/addons.yaml
new file mode 100644
index 0000000000..1c010e4a0c
--- /dev/null
+++ b/examples/blue-green-upgrade/bootstrap/addons.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: bootstrap-addons
+  namespace: argocd
+spec:
+  syncPolicy:
+    preserveResourcesOnDeletion: true
+  generators:
+    - clusters:
+        selector:
+          matchExpressions:
+            - key: akuity.io/argo-cd-cluster-name
+              operator: NotIn
+              values: [in-cluster]
+  template:
+    metadata:
+      name: 'bootstrap-addons'
+    spec:
+      project: default
+      source:
+        repoURL: '{{metadata.annotations.addons_repo_url}}'
+        path: '{{metadata.annotations.addons_repo_path}}'
+        targetRevision: '{{metadata.annotations.addons_repo_revision}}'
+        directory:
+          recurse: true
+          exclude: exclude/*
+      destination:
+        namespace: 'argocd'
+        name: '{{name}}'
+      syncPolicy:
+        automated: {}
diff --git a/examples/blue-green-upgrade/bootstrap/workloads.yaml b/examples/blue-green-upgrade/bootstrap/workloads.yaml
new file mode 100644
index 0000000000..8552278f9a
--- /dev/null
+++ b/examples/blue-green-upgrade/bootstrap/workloads.yaml
@@ -0,0 +1,68 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: bootstrap-workloads
+  namespace: argocd
+spec:
+  goTemplate: true
+  syncPolicy:
+    preserveResourcesOnDeletion: true
+  generators:
+    - matrix:
+        generators:
+          - clusters:
+              selector:
+                matchExpressions:
+                  - key: akuity.io/argo-cd-cluster-name
+                    operator: NotIn
+                    values:
+                      - in-cluster
+          - git:
+              repoURL: '{{.metadata.annotations.gitops_workloads_url}}'
+              revision: '{{.metadata.annotations.gitops_workloads_revision}}'
+              directories:
+                - path: '{{.metadata.annotations.gitops_workloads_path}}/*'
+  template:
+    metadata:
+      name: 'bootstrap-workload-{{.name}}'
+    spec:
+      project: default
+      sources:
+        - repoURL: '{{.metadata.annotations.gitops_workloads_url}}'
+          targetRevision: '{{.metadata.annotations.gitops_workloads_revision}}'
+          ref: values
+          path: '{{.metadata.annotations.gitops_workloads_path}}'
+          helm:
+            releaseName: 'bootstrap-workload-{{.name}}'
+            ignoreMissingValueFiles: true
+            values: |
+              "account": "{{.metadata.annotations.aws_account_id}}"
+              "clusterName": "{{.metadata.annotations.cluster_name}}"
+              "labels":
+                "env": "{{.metadata.annotations.env}}"
+              "region": "{{.metadata.annotations.aws_region}}"
+              "repoUrl": "{{.metadata.annotations.gitops_workloads_url}}"
+              "spec":
+                "source":
+                  "repoURL": "{{.metadata.annotations.gitops_workloads_url}}"
+                  "targetRevision": "{{.metadata.annotations.gitops_workloads_revision}}"
+                "blueprint": "terraform"
+                "clusterName": "{{.metadata.annotations.cluster_name}}"
+                "env": "{{.metadata.annotations.env}}"
+                "ingress":
+                  "route53_weight": {{default "0" .metadata.annotations.route53_weight}}
+                  "argocd_route53_weight": {{default "0" .metadata.annotations.argocd_route53_weight}}
+                  "ecsfrontend_route53_weight": {{default "0" .metadata.annotations.ecsfrontend_route53_weight}}
+                  "host": {{ default "" .metadata.annotations.eks_cluster_domain }}
+                  "type": "{{.metadata.annotations.ingress_type}}"
+                "karpenterInstanceProfile": "{{.metadata.annotations.karpenter_node_instance_profile_name}}"
+                "target_group_arn": {{ default "" .metadata.annotations.target_group_arn }}
+                "external_lb_url": {{ if index .metadata.annotations "external_lb_dns" }} http://{{ .metadata.annotations.external_lb_dns }}{{ else }}{{ end }}
+      destination:
+        name: '{{.name}}'
+      syncPolicy:
+        automated: {}
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true # Big CRDs.
diff --git a/examples/blue-green-upgrade/eks-blue/main.tf b/examples/blue-green-upgrade/eks-blue/main.tf
index d13f2c4e16..9c12ae32c6 100644
--- a/examples/blue-green-upgrade/eks-blue/main.tf
+++ b/examples/blue-green-upgrade/eks-blue/main.tf
@@ -38,27 +38,35 @@ provider "kubectl" {
     args        = ["eks", "get-token", "--cluster-name", module.eks_cluster.eks_cluster_id]
   }
 }
+
 module "eks_cluster" {
   source = "../modules/eks_cluster"
 
   aws_region      = var.aws_region
   service_name    = "blue"
-  cluster_version = "1.25"
+  cluster_version = "1.26"
 
   argocd_route53_weight      = "100"
   route53_weight             = "100"
   ecsfrontend_route53_weight = "100"
 
-  environment_name       = var.environment_name
-  hosted_zone_name       = var.hosted_zone_name
-  eks_admin_role_name    = var.eks_admin_role_name
-  workload_repo_url      = var.workload_repo_url
-  workload_repo_secret   = var.workload_repo_secret
-  workload_repo_revision = var.workload_repo_revision
-  workload_repo_path     = var.workload_repo_path
+  environment_name    = var.environment_name
+  hosted_zone_name    = var.hosted_zone_name
+  eks_admin_role_name = var.eks_admin_role_name
+
+  aws_secret_manager_git_private_ssh_key_name = var.aws_secret_manager_git_private_ssh_key_name
+  argocd_secret_manager_name_suffix           = var.argocd_secret_manager_name_suffix
+  ingress_type                                = var.ingress_type
+
+  gitops_addons_org      = var.gitops_addons_org
+  gitops_addons_repo     = var.gitops_addons_repo
+  gitops_addons_basepath = var.gitops_addons_basepath
+  gitops_addons_path     = var.gitops_addons_path
+  gitops_addons_revision = var.gitops_addons_revision
 
-  addons_repo_url = var.addons_repo_url
+  gitops_workloads_org      = var.gitops_workloads_org
+  gitops_workloads_repo     = var.gitops_workloads_repo
+  gitops_workloads_revision = var.gitops_workloads_revision
+  gitops_workloads_path     = var.gitops_workloads_path
 
-  iam_platform_user                 = var.iam_platform_user
-  argocd_secret_manager_name_suffix = var.argocd_secret_manager_name_suffix
 }
diff --git a/examples/blue-green-upgrade/eks-blue/outputs.tf b/examples/blue-green-upgrade/eks-blue/outputs.tf
index 7e166f24e2..06ac616086 100644
--- a/examples/blue-green-upgrade/eks-blue/outputs.tf
+++ b/examples/blue-green-upgrade/eks-blue/outputs.tf
@@ -3,13 +3,18 @@ output "eks_cluster_id" {
   value       = module.eks_cluster.eks_cluster_id
 }
 
+output "configure_kubectl" {
+  description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  value       = module.eks_cluster.configure_kubectl
+}
+
 output "eks_blueprints_platform_teams_configure_kubectl" {
-  description = "Configure kubectl for each Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  description = "Configure kubectl for Platform Team: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = module.eks_cluster.eks_blueprints_platform_teams_configure_kubectl
 }
 
 output "eks_blueprints_dev_teams_configure_kubectl" {
-  description = "Configure kubectl for each Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  description = "Configure kubectl for each Dev Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = module.eks_cluster.eks_blueprints_dev_teams_configure_kubectl
 }
 
@@ -17,3 +22,14 @@ output "eks_blueprints_ecsdemo_teams_configure_kubectl" {
   description = "Configure kubectl for each Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = module.eks_cluster.eks_blueprints_ecsdemo_teams_configure_kubectl
 }
+
+output "access_argocd" {
+  description = "ArgoCD Access"
+  value       = module.eks_cluster.access_argocd
+}
+
+output "gitops_metadata" {
+  description = "export gitops_metadata"
+  value       = module.eks_cluster.gitops_metadata
+  sensitive   = true
+}
diff --git a/examples/blue-green-upgrade/eks-blue/providers.tf b/examples/blue-green-upgrade/eks-blue/providers.tf
index 68943de818..fac76269c2 100644
--- a/examples/blue-green-upgrade/eks-blue/providers.tf
+++ b/examples/blue-green-upgrade/eks-blue/providers.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0.1"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/examples/blue-green-upgrade/eks-blue/variables.tf b/examples/blue-green-upgrade/eks-blue/variables.tf
index 98e8976dff..e95e6a4683 100644
--- a/examples/blue-green-upgrade/eks-blue/variables.tf
+++ b/examples/blue-green-upgrade/eks-blue/variables.tf
@@ -10,6 +10,12 @@ variable "environment_name" {
   default     = "eks-blueprint"
 }
 
+variable "ingress_type" {
+  type        = string
+  description = "Type of ingress to uses (alb | nginx | ...). this parameter will be sent to arocd via gitops bridge"
+  default     = "alb"
+}
+
 variable "hosted_zone_name" {
   type        = string
   description = "Route53 domain for the cluster."
@@ -22,44 +28,63 @@ variable "eks_admin_role_name" {
   default     = ""
 }
 
-variable "workload_repo_url" {
+variable "aws_secret_manager_git_private_ssh_key_name" {
   type        = string
-  description = "Git repo URL for the ArgoCD workload deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-workloads.git"
+  description = "Secret Manager secret name for hosting Github SSH-Key to Access private repository"
+  default     = "github-blueprint-ssh-key"
 }
 
-variable "workload_repo_secret" {
+variable "argocd_secret_manager_name_suffix" {
   type        = string
-  description = "Secret Manager secret name for hosting Github SSH-Key to Access private repository"
-  default     = "github-blueprint-ssh-key"
+  description = "Name of secret manager secret for ArgoCD Admin UI Password"
+  default     = "argocd-admin-secret"
+}
+
+variable "gitops_workloads_org" {
+  type        = string
+  description = "Git repository org/user contains for workloads"
+  default     = "https://github.com/aws-samples"
 }
 
-variable "workload_repo_revision" {
+variable "gitops_workloads_repo" {
+  type        = string
+  description = "Git repository contains for workloads"
+  default     = "eks-blueprints-workloads"
+}
+
+variable "gitops_workloads_revision" {
   type        = string
   description = "Git repo revision in workload_repo_url for the ArgoCD workload deployment"
   default     = "main"
 }
 
-variable "workload_repo_path" {
+variable "gitops_workloads_path" {
   type        = string
   description = "Git repo path in workload_repo_url for the ArgoCD workload deployment"
   default     = "envs/dev"
 }
-
-variable "addons_repo_url" {
+variable "gitops_addons_org" {
   type        = string
-  description = "Git repo URL for the ArgoCD addons deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-add-ons.git"
+  description = "Git repository org/user contains for addons"
+  default     = "https://github.com/gitops-bridge-dev"
 }
-
-variable "iam_platform_user" {
+variable "gitops_addons_repo" {
+  type        = string
+  description = "Git repository contains for addons"
+  default     = "gitops-bridge-argocd-control-plane-template"
+}
+variable "gitops_addons_basepath" {
   type        = string
-  description = "IAM user used as platform-user"
+  description = "Git repository base path for addons"
   default     = ""
 }
-
-variable "argocd_secret_manager_name_suffix" {
+variable "gitops_addons_path" {
   type        = string
-  description = "Name of secret manager secret for ArgoCD Admin UI Password"
-  default     = "argocd-admin-secret"
+  description = "Git repository path for addons"
+  default     = "bootstrap/control-plane/addons"
+}
+variable "gitops_addons_revision" {
+  type        = string
+  description = "Git repository revision/branch/ref for addons"
+  default     = "HEAD"
 }
diff --git a/examples/blue-green-upgrade/eks-green/main.tf b/examples/blue-green-upgrade/eks-green/main.tf
index 7d4e0c900b..0ecbb15c81 100644
--- a/examples/blue-green-upgrade/eks-green/main.tf
+++ b/examples/blue-green-upgrade/eks-green/main.tf
@@ -44,22 +44,29 @@ module "eks_cluster" {
 
   aws_region      = var.aws_region
   service_name    = "green"
-  cluster_version = "1.26" # Here, we deploy the cluster with the N+1 Kubernetes Version
+  cluster_version = "1.27" # Here, we deploy the cluster with the N+1 Kubernetes Version
 
   argocd_route53_weight      = "0" # We control with theses parameters how we send traffic to the workloads in the new cluster
   route53_weight             = "0"
   ecsfrontend_route53_weight = "0"
 
-  environment_name       = var.environment_name
-  hosted_zone_name       = var.hosted_zone_name
-  eks_admin_role_name    = var.eks_admin_role_name
-  workload_repo_url      = var.workload_repo_url
-  workload_repo_secret   = var.workload_repo_secret
-  workload_repo_revision = var.workload_repo_revision
-  workload_repo_path     = var.workload_repo_path
+  environment_name    = var.environment_name
+  hosted_zone_name    = var.hosted_zone_name
+  eks_admin_role_name = var.eks_admin_role_name
 
-  addons_repo_url = var.addons_repo_url
+  aws_secret_manager_git_private_ssh_key_name = var.aws_secret_manager_git_private_ssh_key_name
+  argocd_secret_manager_name_suffix           = var.argocd_secret_manager_name_suffix
+  ingress_type                                = var.ingress_type
+
+  gitops_addons_org      = var.gitops_addons_org
+  gitops_addons_repo     = var.gitops_addons_repo
+  gitops_addons_basepath = var.gitops_addons_basepath
+  gitops_addons_path     = var.gitops_addons_path
+  gitops_addons_revision = var.gitops_addons_revision
+
+  gitops_workloads_org      = var.gitops_workloads_org
+  gitops_workloads_repo     = var.gitops_workloads_repo
+  gitops_workloads_revision = var.gitops_workloads_revision
+  gitops_workloads_path     = var.gitops_workloads_path
 
-  iam_platform_user                 = var.iam_platform_user
-  argocd_secret_manager_name_suffix = var.argocd_secret_manager_name_suffix
 }
diff --git a/examples/blue-green-upgrade/eks-green/outputs.tf b/examples/blue-green-upgrade/eks-green/outputs.tf
index 210da14f30..06ac616086 100644
--- a/examples/blue-green-upgrade/eks-green/outputs.tf
+++ b/examples/blue-green-upgrade/eks-green/outputs.tf
@@ -3,8 +3,13 @@ output "eks_cluster_id" {
   value       = module.eks_cluster.eks_cluster_id
 }
 
+output "configure_kubectl" {
+  description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  value       = module.eks_cluster.configure_kubectl
+}
+
 output "eks_blueprints_platform_teams_configure_kubectl" {
-  description = "Configure kubectl Platform Team: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  description = "Configure kubectl for Platform Team: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = module.eks_cluster.eks_blueprints_platform_teams_configure_kubectl
 }
 
@@ -14,6 +19,17 @@ output "eks_blueprints_dev_teams_configure_kubectl" {
 }
 
 output "eks_blueprints_ecsdemo_teams_configure_kubectl" {
-  description = "Configure kubectl for each ECSDEMO Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  description = "Configure kubectl for each Application Teams: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = module.eks_cluster.eks_blueprints_ecsdemo_teams_configure_kubectl
 }
+
+output "access_argocd" {
+  description = "ArgoCD Access"
+  value       = module.eks_cluster.access_argocd
+}
+
+output "gitops_metadata" {
+  description = "export gitops_metadata"
+  value       = module.eks_cluster.gitops_metadata
+  sensitive   = true
+}
diff --git a/examples/blue-green-upgrade/eks-green/providers.tf b/examples/blue-green-upgrade/eks-green/providers.tf
index 30c08a8dfc..fac76269c2 100644
--- a/examples/blue-green-upgrade/eks-green/providers.tf
+++ b/examples/blue-green-upgrade/eks-green/providers.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/examples/blue-green-upgrade/eks-green/variables.tf b/examples/blue-green-upgrade/eks-green/variables.tf
index 98e8976dff..d7b1f6125a 100644
--- a/examples/blue-green-upgrade/eks-green/variables.tf
+++ b/examples/blue-green-upgrade/eks-green/variables.tf
@@ -22,44 +22,63 @@ variable "eks_admin_role_name" {
   default     = ""
 }
 
-variable "workload_repo_url" {
+variable "aws_secret_manager_git_private_ssh_key_name" {
   type        = string
-  description = "Git repo URL for the ArgoCD workload deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-workloads.git"
+  description = "Secret Manager secret name for hosting Github SSH-Key to Access private repository"
+  default     = "github-blueprint-ssh-key"
 }
 
-variable "workload_repo_secret" {
+variable "argocd_secret_manager_name_suffix" {
   type        = string
-  description = "Secret Manager secret name for hosting Github SSH-Key to Access private repository"
-  default     = "github-blueprint-ssh-key"
+  description = "Name of secret manager secret for ArgoCD Admin UI Password"
+  default     = "argocd-admin-secret"
+}
+
+variable "gitops_workloads_org" {
+  type        = string
+  description = "Git repository org/user contains for workloads"
+  default     = "https://github.com/aws-samples"
 }
 
-variable "workload_repo_revision" {
+variable "gitops_workloads_repo" {
+  type        = string
+  description = "Git repository contains for workloads"
+  default     = "eks-blueprints-workloads"
+}
+
+variable "gitops_workloads_revision" {
   type        = string
   description = "Git repo revision in workload_repo_url for the ArgoCD workload deployment"
   default     = "main"
 }
 
-variable "workload_repo_path" {
+variable "gitops_workloads_path" {
   type        = string
   description = "Git repo path in workload_repo_url for the ArgoCD workload deployment"
   default     = "envs/dev"
 }
-
-variable "addons_repo_url" {
+variable "gitops_addons_org" {
   type        = string
-  description = "Git repo URL for the ArgoCD addons deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-add-ons.git"
+  description = "Git repository org/user contains for addons"
+  default     = "https://github.com/gitops-bridge-dev"
 }
-
-variable "iam_platform_user" {
+variable "gitops_addons_repo" {
   type        = string
-  description = "IAM user used as platform-user"
+  description = "Git repository contains for addons"
+  default     = "gitops-bridge-argocd-control-plane-template"
+}
+variable "gitops_addons_basepath" {
+  type        = string
+  description = "Git repository base path for addons"
   default     = ""
 }
-
-variable "argocd_secret_manager_name_suffix" {
+variable "gitops_addons_path" {
   type        = string
-  description = "Name of secret manager secret for ArgoCD Admin UI Password"
-  default     = "argocd-admin-secret"
+  description = "Git repository path for addons"
+  default     = "bootstrap/control-plane/addons"
+}
+variable "gitops_addons_revision" {
+  type        = string
+  description = "Git repository revision/branch/ref for addons"
+  default     = "HEAD"
 }
diff --git a/examples/blue-green-upgrade/environment/main.tf b/examples/blue-green-upgrade/environment/main.tf
index cdf3503a36..ee29c7803d 100644
--- a/examples/blue-green-upgrade/environment/main.tf
+++ b/examples/blue-green-upgrade/environment/main.tf
@@ -12,6 +12,8 @@ locals {
 
   argocd_secret_manager_name = var.argocd_secret_manager_name_suffix
 
+  hosted_zone_name = var.hosted_zone_name
+
   tags = {
     Blueprint  = local.name
     GithubRepo = "github.com/aws-ia/terraform-aws-eks-blueprints"
@@ -47,18 +49,18 @@ module "vpc" {
 
 # Retrieve existing root hosted zone
 data "aws_route53_zone" "root" {
-  name = var.hosted_zone_name
+  name = local.hosted_zone_name
 }
 
 # Create Sub HostedZone four our deployment
 resource "aws_route53_zone" "sub" {
-  name = "${local.name}.${var.hosted_zone_name}"
+  name = "${local.name}.${local.hosted_zone_name}"
 }
 
 # Validate records for the new HostedZone
 resource "aws_route53_record" "ns" {
   zone_id = data.aws_route53_zone.root.zone_id
-  name    = "${local.name}.${var.hosted_zone_name}"
+  name    = "${local.name}.${local.hosted_zone_name}"
   type    = "NS"
   ttl     = "30"
   records = aws_route53_zone.sub.name_servers
@@ -68,17 +70,17 @@ module "acm" {
   source  = "terraform-aws-modules/acm/aws"
   version = "~> 4.0"
 
-  domain_name = "${local.name}.${var.hosted_zone_name}"
+  domain_name = "${local.name}.${local.hosted_zone_name}"
   zone_id     = aws_route53_zone.sub.zone_id
 
   subject_alternative_names = [
-    "*.${local.name}.${var.hosted_zone_name}"
+    "*.${local.name}.${local.hosted_zone_name}"
   ]
 
   wait_for_validation = true
 
   tags = {
-    Name = "${local.name}.${var.hosted_zone_name}"
+    Name = "${local.name}.${local.hosted_zone_name}"
   }
 }
 
diff --git a/examples/blue-green-upgrade/modules/eks_cluster/main.tf b/examples/blue-green-upgrade/modules/eks_cluster/main.tf
index cdcbab28dd..b96f0a0450 100644
--- a/examples/blue-green-upgrade/modules/eks_cluster/main.tf
+++ b/examples/blue-green-upgrade/modules/eks_cluster/main.tf
@@ -7,33 +7,27 @@ provider "aws" {
 locals {
   environment = var.environment_name
   service     = var.service_name
+  region      = var.aws_region
 
-  env  = local.environment
+  env  = local.service
   name = "${local.environment}-${local.service}"
 
-
   # Mapping
-  hosted_zone_name           = var.hosted_zone_name
-  addons_repo_url            = var.addons_repo_url
-  workload_repo_secret       = var.workload_repo_secret
-  cluster_version            = var.cluster_version
-  argocd_secret_manager_name = var.argocd_secret_manager_name_suffix
-  workload_repo_path         = var.workload_repo_path
-  workload_repo_url          = var.workload_repo_url
-  workload_repo_revision     = var.workload_repo_revision
-  eks_admin_role_name        = var.eks_admin_role_name
-  iam_platform_user          = var.iam_platform_user
-
-  metrics_server               = true
-  aws_load_balancer_controller = true
-  karpenter                    = true
-  aws_for_fluentbit            = true
-  cert_manager                 = true
-  cloudwatch_metrics           = true
-  external_dns                 = true
-  vpa                          = true
-  kubecost                     = true
-  argo_rollouts                = true
+  hosted_zone_name                            = var.hosted_zone_name
+  ingress_type                                = var.ingress_type
+  aws_secret_manager_git_private_ssh_key_name = var.aws_secret_manager_git_private_ssh_key_name
+  cluster_version                             = var.cluster_version
+  argocd_secret_manager_name                  = var.argocd_secret_manager_name_suffix
+  eks_admin_role_name                         = var.eks_admin_role_name
+
+  gitops_workloads_url      = "${var.gitops_workloads_org}/${var.gitops_workloads_repo}"
+  gitops_workloads_path     = var.gitops_workloads_path
+  gitops_workloads_revision = var.gitops_workloads_revision
+
+  gitops_addons_url      = "${var.gitops_addons_org}/${var.gitops_addons_repo}"
+  gitops_addons_basepath = var.gitops_addons_basepath
+  gitops_addons_path     = var.gitops_addons_path
+  gitops_addons_revision = var.gitops_addons_revision
 
   # Route 53 Ingress Weights
   argocd_route53_weight      = var.argocd_route53_weight
@@ -48,203 +42,100 @@ locals {
 
   node_group_name = "managed-ondemand"
 
-
   #---------------------------------------------------------------
   # ARGOCD ADD-ON APPLICATION
   #---------------------------------------------------------------
 
-  #At this time (with new v5 addon repository), the Addons need to be managed by Terrform and not ArgoCD
-  addons_application = {
-    path                = "chart"
-    repo_url            = local.addons_repo_url
-    ssh_key_secret_name = local.workload_repo_secret
-    add_on_application  = true
+  aws_addons = {
+    enable_cert_manager          = true
+    enable_aws_ebs_csi_resources = true # generate gp2 and gp3 storage classes for ebs-csi
+    #enable_aws_efs_csi_driver                    = true
+    #enable_aws_fsx_csi_driver                    = true
+    enable_aws_cloudwatch_metrics = true
+    #enable_aws_privateca_issuer                  = true
+    #enable_cluster_autoscaler                    = true
+    enable_external_dns                 = true
+    enable_external_secrets             = true
+    enable_aws_load_balancer_controller = true
+    #enable_fargate_fluentbit                     = true
+    enable_aws_for_fluentbit = true
+    #enable_aws_node_termination_handler          = true
+    enable_karpenter = true
+    #enable_velero                                = true
+    #enable_aws_gateway_api_controller            = true
+    #enable_aws_secrets_store_csi_driver_provider = true
   }
+  oss_addons = {
+    #enable_argo_rollouts                         = true
+    #enable_argo_workflows                        = true
+    #enable_cluster_proportional_autoscaler       = true
+    #enable_gatekeeper                            = true
+    #enable_gpu_operator                          = true
+    enable_ingress_nginx = true
+    enable_kyverno       = true
+    #enable_kube_prometheus_stack                 = true
+    enable_metrics_server = true
+    #enable_prometheus_adapter                    = true
+    #enable_secrets_store_csi_driver              = true
+    #enable_vpa                                   = true
+    #enable_foo                                   = true # you can add any addon here, make sure to update the gitops repo with the corresponding application set
+  }
+  addons = merge(local.aws_addons, local.oss_addons, { kubernetes_version = local.cluster_version })
 
-  #---------------------------------------------------------------
-  # ARGOCD WORKLOAD APPLICATION
-  #---------------------------------------------------------------
+  #----------------------------------------------------------------
+  # GitOps Bridge, define metadatas to pass from Terraform to ArgoCD
+  #----------------------------------------------------------------
 
-  workload_application = {
-    path                = local.workload_repo_path # <-- we could also to blue/green on the workload repo path like: envs/dev-blue / envs/dev-green
-    repo_url            = local.workload_repo_url
-    target_revision     = local.workload_repo_revision
-    ssh_key_secret_name = local.workload_repo_secret
-    add_on_application  = false
-    values = {
-      labels = {
-        env   = local.env
-        myapp = "myvalue"
-      }
-      spec = {
-        source = {
-          repoURL        = local.workload_repo_url
-          targetRevision = local.workload_repo_revision
-        }
-        blueprint                = "terraform"
-        clusterName              = local.name
-        karpenterInstanceProfile = module.karpenter.instance_profile_name
-        env                      = local.env
-        ingress = {
-          type                  = "alb"
-          host                  = local.eks_cluster_domain
-          route53_weight        = local.route53_weight # <-- You can control the weight of the route53 weighted records between clusters
-          argocd_route53_weight = local.argocd_route53_weight
-        }
-      }
+  addons_metadata = merge(
+    module.eks_blueprints_addons.gitops_metadata, # eks blueprints addons automatically expose metadatas
+    {
+      aws_cluster_name = module.eks.cluster_name
+      aws_region       = local.region
+      aws_account_id   = data.aws_caller_identity.current.account_id
+      aws_vpc_id       = data.aws_vpc.vpc.id
+      cluster_endpoint = module.eks.cluster_endpoint
+      env              = local.env
+    },
+    {
+      argocd_password                             = bcrypt(data.aws_secretsmanager_secret_version.admin_password_version.secret_string)
+      aws_secret_manager_git_private_ssh_key_name = local.aws_secret_manager_git_private_ssh_key_name
+
+      gitops_workloads_url      = local.gitops_workloads_url
+      gitops_workloads_path     = local.gitops_workloads_path
+      gitops_workloads_revision = local.gitops_workloads_revision
+
+      addons_repo_url      = local.gitops_addons_url
+      addons_repo_basepath = local.gitops_addons_basepath
+      addons_repo_path     = local.gitops_addons_path
+      addons_repo_revision = local.gitops_addons_revision
+    },
+    {
+      eks_cluster_domain         = local.eks_cluster_domain
+      external_dns_policy        = "sync"
+      ingress_type               = local.ingress_type
+      argocd_route53_weight      = local.argocd_route53_weight
+      route53_weight             = local.route53_weight
+      ecsfrontend_route53_weight = local.ecsfrontend_route53_weight
+      #target_group_arn = local.service == "blue" ? data.aws_lb_target_group.tg_blue.arn : data.aws_lb_target_group.tg_green.arn # <-- Add this line
+      #      external_lb_dns = data.aws_lb.alb.dns_name
     }
-  }
+  )
 
   #---------------------------------------------------------------
-  # ARGOCD ECSDEMO APPLICATION
+  # Manifests for bootstraping the cluster for addons & workloads
   #---------------------------------------------------------------
 
-  ecsdemo_application = {
-    path                = "multi-repo/argo-app-of-apps/dev"
-    repo_url            = local.workload_repo_url
-    target_revision     = local.workload_repo_revision
-    ssh_key_secret_name = local.workload_repo_secret
-    add_on_application  = false
-    values = {
-      spec = {
-        blueprint                = "terraform"
-        clusterName              = local.name
-        karpenterInstanceProfile = module.karpenter.instance_profile_name
-
-        apps = {
-          ecsdemoNodejs = {
-            replicaCount = "9"
-            nodeSelector = {
-              "karpenter.sh/provisioner-name" = "default"
-            }
-            tolerations = [
-              {
-                key      = "karpenter"
-                operator = "Exists"
-                effect   = "NoSchedule"
-              }
-            ]
-            topologyAwareHints = "true"
-            topologySpreadConstraints = [
-              {
-                maxSkew           = 1
-                topologyKey       = "topology.kubernetes.io/zone"
-                whenUnsatisfiable = "DoNotSchedule"
-                labelSelector = {
-                  matchLabels = {
-                    "app.kubernetes.io/name" = "ecsdemo-nodejs"
-                  }
-                }
-              }
-            ]
-          }
-
-          ecsdemoCrystal = {
-            replicaCount = "9"
-            nodeSelector = {
-              "karpenter.sh/provisioner-name" = "default"
-            }
-            tolerations = [
-              {
-                key      = "karpenter"
-                operator = "Exists"
-                effect   = "NoSchedule"
-              }
-            ]
-            topologyAwareHints = "true"
-            topologySpreadConstraints = [
-              {
-                maxSkew           = 1
-                topologyKey       = "topology.kubernetes.io/zone"
-                whenUnsatisfiable = "DoNotSchedule"
-                labelSelector = {
-                  matchLabels = {
-                    "app.kubernetes.io/name" = "ecsdemo-crystal"
-                  }
-                }
-              }
-            ]
-          }
-
-          ecsdemoFrontend = {
-            repoURL        = "https://github.com/allamand/ecsdemo-frontend"
-            targetRevision = "main"
-            image = {
-              repository = "public.ecr.aws/seb-demo/ecsdemo-frontend"
-              tag        = "latest"
-            }
-            ingress = {
-              enabled   = "true"
-              className = "alb"
-              annotations = {
-                "alb.ingress.kubernetes.io/scheme"                = "internet-facing"
-                "alb.ingress.kubernetes.io/group.name"            = "ecsdemo"
-                "alb.ingress.kubernetes.io/listen-ports"          = "[{\\\"HTTPS\\\": 443}]"
-                "alb.ingress.kubernetes.io/ssl-redirect"          = "443"
-                "alb.ingress.kubernetes.io/target-type"           = "ip"
-                "external-dns.alpha.kubernetes.io/set-identifier" = local.name
-                "external-dns.alpha.kubernetes.io/aws-weight"     = local.ecsfrontend_route53_weight
-              }
-              hosts = [
-                {
-                  host = "frontend.${local.eks_cluster_domain}"
-                  paths = [
-                    {
-                      path     = "/"
-                      pathType = "Prefix"
-                    }
-                  ]
-                }
-              ]
-            }
-            resources = {
-              requests = {
-                cpu    = "1"
-                memory = "256Mi"
-              }
-              limits = {
-                cpu    = "1"
-                memory = "512Mi"
-              }
-            }
-            autoscaling = {
-              enabled                        = "true"
-              minReplicas                    = "9"
-              maxReplicas                    = "100"
-              targetCPUUtilizationPercentage = "60"
-            }
-            nodeSelector = {
-              "karpenter.sh/provisioner-name" = "default"
-            }
-            tolerations = [
-              {
-                key      = "karpenter"
-                operator = "Exists"
-                effect   = "NoSchedule"
-              }
-            ]
-            topologySpreadConstraints = [
-              {
-                maxSkew           = 1
-                topologyKey       = "topology.kubernetes.io/zone"
-                whenUnsatisfiable = "DoNotSchedule"
-                labelSelector = {
-                  matchLabels = {
-                    "app.kubernetes.io/name" = "ecsdemo-frontend"
-                  }
-                }
-              }
-            ]
-          }
-        }
-      }
-    }
+  argocd_bootstrap_app_of_apps = {
+    addons    = file("${path.module}/../../bootstrap/addons.yaml")
+    workloads = file("${path.module}/../../bootstrap/workloads.yaml")
   }
 
+
   tags = {
     Blueprint  = local.name
     GithubRepo = "github.com/aws-ia/terraform-aws-eks-blueprints"
   }
+
 }
 
 # Find the user currently in use by AWS
@@ -287,11 +178,14 @@ resource "aws_ec2_tag" "public_subnets" {
   value       = "shared"
 }
 
-# Create Sub HostedZone four our deployment
+# Get HostedZone four our deployment
 data "aws_route53_zone" "sub" {
   name = "${local.environment}.${local.hosted_zone_name}"
 }
 
+################################################################################
+# AWS Secret Manager for argocd password
+################################################################################
 
 data "aws_secretsmanager_secret" "argocd" {
   name = "${local.argocd_secret_manager_name}.${local.environment}"
@@ -301,10 +195,9 @@ data "aws_secretsmanager_secret_version" "admin_password_version" {
   secret_id = data.aws_secretsmanager_secret.argocd.id
 }
 
-# data "aws_ecrpublic_authorization_token" "token" {
-#   provider = aws.virginia
-# }
-
+################################################################################
+# EKS Cluster
+################################################################################
 #tfsec:ignore:aws-eks-enable-control-plane-logging
 module "eks" {
   source  = "terraform-aws-modules/eks/aws"
@@ -337,7 +230,7 @@ module "eks" {
     [
       module.eks_blueprints_platform_teams.aws_auth_configmap_role,
       {
-        rolearn  = module.karpenter.role_arn
+        rolearn  = module.eks_blueprints_addons.karpenter.node_iam_role_arn
         username = "system:node:{{EC2PrivateDNSName}}"
         groups = [
           "system:bootstrappers",
@@ -360,16 +253,14 @@ module "eks" {
   })
 }
 
-data "aws_iam_user" "platform_user" {
-  count     = local.iam_platform_user != "" ? 1 : 0
-  user_name = local.iam_platform_user
-}
-
 data "aws_iam_role" "eks_admin_role_name" {
   count = local.eks_admin_role_name != "" ? 1 : 0
   name  = local.eks_admin_role_name
 }
 
+################################################################################
+# EKS Blueprints Teams
+################################################################################
 module "eks_blueprints_platform_teams" {
   source  = "aws-ia/eks-blueprints-teams/aws"
   version = "~> 1.0"
@@ -382,7 +273,6 @@ module "eks_blueprints_platform_teams" {
   # Define who can impersonate the team-platform Role
   users = [
     data.aws_caller_identity.current.arn,
-    try(data.aws_iam_user.platform_user[0].arn, data.aws_caller_identity.current.arn),
     try(data.aws_iam_role.eks_admin_role_name[0].arn, data.aws_caller_identity.current.arn),
   ]
   cluster_arn       = module.eks.cluster_arn
@@ -434,6 +324,7 @@ module "eks_blueprints_platform_teams" {
           }
         ]
       }
+
     }
 
   }
@@ -615,109 +506,171 @@ module "eks_blueprints_ecsdemo_teams" {
   tags = local.tags
 }
 
-module "kubernetes_addons" {
-  source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons?ref=v4.32.1"
+################################################################################
+# GitOps Bridge: Private ssh keys for git
+################################################################################
+data "aws_secretsmanager_secret" "workload_repo_secret" {
+  name = local.aws_secret_manager_git_private_ssh_key_name
+}
 
-  eks_cluster_id     = module.eks.cluster_name
-  eks_cluster_domain = local.eks_cluster_domain
+data "aws_secretsmanager_secret_version" "workload_repo_secret" {
+  secret_id = data.aws_secretsmanager_secret.workload_repo_secret.id
+}
 
-  #---------------------------------------------------------------
-  # ARGO CD ADD-ON
-  #---------------------------------------------------------------
+resource "kubernetes_namespace" "argocd" {
+  depends_on = [module.eks_blueprints_addons]
+  metadata {
+    name = "argocd"
+  }
+}
 
-  enable_argocd         = true
-  argocd_manage_add_ons = true # Indicates that ArgoCD is responsible for managing/deploying Add-ons.
+resource "kubernetes_secret" "git_secrets" {
 
-  argocd_applications = {
-    addons    = local.addons_application
-    workloads = local.workload_application
-    ecsdemo   = local.ecsdemo_application
+  for_each = {
+    git-addons = {
+      type = "git"
+      url  = local.gitops_addons_url
+      # comment if you want to uses public repo wigh syntax "https://github.com/xxx" syntax, uncomment when using syntax "git@github.com:xxx"
+      sshPrivateKey = data.aws_secretsmanager_secret_version.workload_repo_secret.secret_string
+    }
+    git-workloads = {
+      type = "git"
+      url  = local.gitops_workloads_url
+      # comment if you want to uses public repo wigh syntax "https://github.com/xxx" syntax, uncomment when using syntax "git@github.com:xxx"
+      #sshPrivateKey = data.aws_secretsmanager_secret_version.workload_repo_secret.secret_string
+    }
   }
+  metadata {
+    name      = each.key
+    namespace = kubernetes_namespace.argocd.metadata[0].name
+    labels = {
+      "argocd.argoproj.io/secret-type" = "repo-creds"
+    }
+  }
+  data = each.value
+}
 
-  # This example shows how to set default ArgoCD Admin Password using SecretsManager with Helm Chart set_sensitive values.
-  argocd_helm_config = {
-    set_sensitive = [
-      {
-        name  = "configs.secret.argocdServerAdminPassword"
-        value = bcrypt(data.aws_secretsmanager_secret_version.admin_password_version.secret_string)
-      }
-    ]
+################################################################################
+# GitOps Bridge: Metadata
+################################################################################
+module "gitops_bridge_metadata" {
+  source = "github.com/gitops-bridge-dev/gitops-bridge-argocd-metadata-terraform?ref=v1.0.0"
+
+  cluster_name = module.eks.cluster_name
+  metadata     = local.addons_metadata
+  environment  = local.environment
+  addons       = local.addons
+}
+
+################################################################################
+# GitOps Bridge: Bootstrap
+################################################################################
+
+module "gitops_bridge_bootstrap" {
+  source = "github.com/gitops-bridge-dev/gitops-bridge-argocd-bootstrap-terraform?ref=v1.0.0"
+
+  argocd_cluster               = module.gitops_bridge_metadata.argocd
+  argocd_bootstrap_app_of_apps = local.argocd_bootstrap_app_of_apps
+  #argocd                       = { create_namespace = false }
+  argocd = {
+    create_namespace = false
     set = [
       {
         name  = "server.service.type"
         value = "LoadBalancer"
       }
     ]
+    set_sensitive = [
+      {
+        name  = "configs.secret.argocdServerAdminPassword"
+        value = bcrypt(data.aws_secretsmanager_secret_version.admin_password_version.secret_string)
+      }
+    ]
   }
+  depends_on = [kubernetes_secret.git_secrets]
+}
 
-  #---------------------------------------------------------------
-  # EKS Managed AddOns
-  # https://aws-ia.github.io/terraform-aws-eks-blueprints/add-ons/
-  #---------------------------------------------------------------
+################################################################################
+# EKS Blueprints Addons
+################################################################################
+module "eks_blueprints_addons" {
+  source = "aws-ia/eks-blueprints-addons/aws"
 
-  enable_amazon_eks_coredns = true
-  amazon_eks_coredns_config = {
-    most_recent        = true
-    kubernetes_version = local.cluster_version
-    resolve_conflicts  = "OVERWRITE"
-  }
+  cluster_name      = module.eks.cluster_name
+  cluster_endpoint  = module.eks.cluster_endpoint
+  cluster_version   = module.eks.cluster_version
+  oidc_provider_arn = module.eks.oidc_provider_arn
 
-  enable_amazon_eks_aws_ebs_csi_driver = true
-  amazon_eks_aws_ebs_csi_driver_config = {
-    most_recent        = true
-    kubernetes_version = local.cluster_version
-    resolve_conflicts  = "OVERWRITE"
-  }
+  # Using GitOps Bridge
+  create_kubernetes_resources = false
 
-  enable_amazon_eks_kube_proxy = true
-  amazon_eks_kube_proxy_config = {
-    most_recent        = true
-    kubernetes_version = local.cluster_version
-    resolve_conflicts  = "OVERWRITE"
-  }
+  eks_addons = {
 
-  enable_amazon_eks_vpc_cni = true
-  amazon_eks_vpc_cni_config = {
-    most_recent        = true
-    kubernetes_version = local.cluster_version
-    resolve_conflicts  = "OVERWRITE"
+    # Remove for workshop as ebs-csi is long to provision (15mn)
+    # aws-ebs-csi-driver = {
+    #   most_recent              = true
+    #   service_account_role_arn = module.ebs_csi_driver_irsa.iam_role_arn
+    # }
+    coredns = {
+      most_recent = true
+    }
+    vpc-cni = {
+      # Specify the VPC CNI addon should be deployed before compute to ensure
+      # the addon is configured before data plane compute resources are created
+      # See README for further details
+      service_account_role_arn = module.vpc_cni_irsa.iam_role_arn
+      before_compute           = true
+      #addon_version  = "v1.12.2-eksbuild.1"
+      most_recent = true # To ensure access to the latest settings provided
+      configuration_values = jsonencode({
+        env = {
+          # Reference docs https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html
+          ENABLE_PREFIX_DELEGATION = "true"
+          WARM_PREFIX_TARGET       = "1"
+        }
+      })
+    }
+    kube-proxy = {
+      most_recent = true
+    }
   }
 
-  #---------------------------------------------------------------
-  # ADD-ONS - You can add additional addons here
-  # https://aws-ia.github.io/terraform-aws-eks-blueprints/add-ons/
-  #---------------------------------------------------------------
-
-  enable_metrics_server               = local.metrics_server
-  enable_vpa                          = local.vpa
-  enable_aws_load_balancer_controller = local.aws_load_balancer_controller
-  aws_load_balancer_controller_helm_config = {
-    service_account = "aws-lb-sa"
-  }
-  enable_karpenter              = local.karpenter
-  enable_aws_for_fluentbit      = local.aws_for_fluentbit
-  enable_aws_cloudwatch_metrics = local.cloudwatch_metrics
-
-  #to view the result : terraform state show 'module.kubernetes_addons.module.external_dns[0].module.helm_addon.helm_release.addon[0]'
-  enable_external_dns = local.external_dns
-
-  external_dns_helm_config = {
-    txtOwnerId   = local.name
-    zoneIdFilter = data.aws_route53_zone.sub.zone_id # Note: this uses GitOpsBridge
-    policy       = "sync"
-    logLevel     = "debug"
+  # EKS Blueprints Addons
+  enable_cert_manager = try(local.aws_addons.enable_cert_manager, false)
+  #enable_aws_ebs_csi_resources  = try(local.aws_addons.enable_aws_ebs_csi_resources, false)
+  enable_aws_efs_csi_driver           = try(local.aws_addons.enable_aws_efs_csi_driver, false)
+  enable_aws_fsx_csi_driver           = try(local.aws_addons.enable_aws_fsx_csi_driver, false)
+  enable_aws_cloudwatch_metrics       = try(local.aws_addons.enable_aws_cloudwatch_metrics, false)
+  enable_aws_privateca_issuer         = try(local.aws_addons.enable_aws_privateca_issuer, false)
+  enable_cluster_autoscaler           = try(local.aws_addons.enable_cluster_autoscaler, false)
+  enable_external_dns                 = try(local.aws_addons.enable_external_dns, false)
+  external_dns_route53_zone_arns      = [data.aws_route53_zone.sub.arn]
+  enable_external_secrets             = try(local.aws_addons.enable_external_secrets, false)
+  enable_aws_load_balancer_controller = try(local.aws_addons.enable_aws_load_balancer_controller, false)
+  aws_load_balancer_controller = {
+    service_account_name = "aws-lb-sa"
   }
 
-  enable_kubecost      = local.kubecost
-  enable_cert_manager  = local.cert_manager
-  enable_argo_rollouts = local.argo_rollouts
+  enable_fargate_fluentbit              = try(local.aws_addons.enable_fargate_fluentbit, false)
+  enable_aws_for_fluentbit              = try(local.aws_addons.enable_aws_for_fluentbit, false)
+  enable_aws_node_termination_handler   = try(local.aws_addons.enable_aws_node_termination_handler, false)
+  aws_node_termination_handler_asg_arns = [for asg in module.eks.self_managed_node_groups : asg.autoscaling_group_arn]
+  enable_karpenter                      = try(local.aws_addons.enable_karpenter, false)
+  enable_velero                         = try(local.aws_addons.enable_velero, false)
+  #velero = {
+  #  s3_backup_location = "${module.velero_backup_s3_bucket.s3_bucket_arn}/backups"
+  #}
+  enable_aws_gateway_api_controller = try(local.aws_addons.enable_aws_gateway_api_controller, false)
+  #enable_aws_secrets_store_csi_driver_provider = try(local.enable_aws_secrets_store_csi_driver_provider, false)
 
+  tags = local.tags
 }
+
 module "ebs_csi_driver_irsa" {
   source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
   version = "~> 5.20"
 
-  role_name_prefix = "${module.eks.cluster_name}-ebs-csi-driver-"
+  role_name_prefix = "${module.eks.cluster_name}-ebs-csi-"
 
   attach_ebs_csi_policy = true
 
@@ -749,18 +702,3 @@ module "vpc_cni_irsa" {
 
   tags = local.tags
 }
-################################################################################
-# Karpenter
-################################################################################
-
-# Creates Karpenter native node termination handler resources and IAM instance profile
-module "karpenter" {
-  source  = "terraform-aws-modules/eks/aws//modules/karpenter"
-  version = "~> 19.15.2"
-
-  cluster_name           = module.eks.cluster_name
-  irsa_oidc_provider_arn = module.eks.oidc_provider_arn
-  create_irsa            = false # IRSA will be created by the kubernetes-addons module
-
-  tags = local.tags
-}
diff --git a/examples/blue-green-upgrade/modules/eks_cluster/outputs.tf b/examples/blue-green-upgrade/modules/eks_cluster/outputs.tf
index dba52fc9fd..8c8c5f5a90 100644
--- a/examples/blue-green-upgrade/modules/eks_cluster/outputs.tf
+++ b/examples/blue-green-upgrade/modules/eks_cluster/outputs.tf
@@ -3,6 +3,11 @@ output "eks_cluster_id" {
   value       = module.eks.cluster_name
 }
 
+output "configure_kubectl" {
+  description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
+  value       = "aws eks --region ${var.aws_region} update-kubeconfig --name ${module.eks.cluster_name}"
+}
+
 output "eks_blueprints_platform_teams_configure_kubectl" {
   description = "Configure kubectl Platform Team: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
   value       = "aws eks --region ${var.aws_region} update-kubeconfig --name ${module.eks.cluster_name}  --role-arn ${module.eks_blueprints_platform_teams.iam_role_arn}"
@@ -27,3 +32,27 @@ output "cluster_certificate_authority_data" {
   description = "cluster_certificate_authority_data"
   value       = module.eks.cluster_certificate_authority_data
 }
+
+output "access_argocd" {
+  description = "ArgoCD Access"
+  value       = <<-EOT
+    export KUBECONFIG="/tmp/${module.eks.cluster_name}"
+    aws eks --region ${local.region} update-kubeconfig --name ${module.eks.cluster_name}
+    echo "ArgoCD URL: https://$(kubectl get svc -n argocd argo-cd-argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
+    echo "ArgoCD Username: admin"
+    echo "ArgoCD Password: $(aws secretsmanager get-secret-value --secret-id argocd-admin-secret.${local.environment} --query SecretString --output text --region ${local.region})"
+  EOT
+}
+
+output "gitops_metadata" {
+  description = "export gitops_metadata"
+  value       = local.addons_metadata
+  sensitive   = true
+}
+
+# output "debug" {
+#   description = "debug output"
+#   #value = data.template_file.addons_template.rendered
+#   value = data.template_file.workloads_template.rendered
+#   #value = file("${path.module}/../../bootstrap/addons.yaml")
+# }
diff --git a/examples/blue-green-upgrade/modules/eks_cluster/variables.tf b/examples/blue-green-upgrade/modules/eks_cluster/variables.tf
index dbd4fca8fe..b23b3ca254 100644
--- a/examples/blue-green-upgrade/modules/eks_cluster/variables.tf
+++ b/examples/blue-green-upgrade/modules/eks_cluster/variables.tf
@@ -21,52 +21,78 @@ variable "cluster_version" {
   default     = "1.25"
 }
 
+variable "gitops_addons_org" {
+  type        = string
+  description = "Git repository org/user contains for addons"
+  default     = "https://github.com/gitops-bridge-dev"
+}
+variable "gitops_addons_repo" {
+  type        = string
+  description = "Git repository contains for addons"
+  default     = "gitops-bridge-argocd-control-plane-template"
+}
+variable "gitops_addons_basepath" {
+  type        = string
+  description = "Git repository base path for addons"
+  default     = ""
+}
+variable "gitops_addons_path" {
+  type        = string
+  description = "Git repository path for addons"
+  default     = "bootstrap/control-plane/addons"
+}
+variable "gitops_addons_revision" {
+  type        = string
+  description = "Git repository revision/branch/ref for addons"
+  default     = "HEAD"
+}
+
 variable "hosted_zone_name" {
   type        = string
   description = "Route53 domain for the cluster."
   default     = ""
 }
 
-variable "eks_admin_role_name" {
+variable "ingress_type" {
   type        = string
-  description = "Additional IAM role to be admin in the cluster"
-  default     = ""
+  description = "Type of ingress to uses (alb | nginx | ...). this parameter will be sent to arocd via gitops bridge"
+  default     = "alb"
 }
 
-variable "workload_repo_url" {
+variable "eks_admin_role_name" {
   type        = string
-  description = "Git repo URL for the ArgoCD workload deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-workloads.git"
+  description = "Additional IAM role to be admin in the cluster"
+  default     = ""
 }
 
-variable "workload_repo_secret" {
+variable "aws_secret_manager_git_private_ssh_key_name" {
   type        = string
   description = "Secret Manager secret name for hosting Github SSH-Key to Access private repository"
   default     = "github-blueprint-ssh-key"
 }
 
-variable "workload_repo_revision" {
+variable "gitops_workloads_org" {
   type        = string
-  description = "Git repo revision in workload_repo_url for the ArgoCD workload deployment"
-  default     = "main"
+  description = "Git repository org/user contains for workloads"
+  default     = "https://github.com/aws-samples"
 }
 
-variable "workload_repo_path" {
+variable "gitops_workloads_repo" {
   type        = string
-  description = "Git repo path in workload_repo_url for the ArgoCD workload deployment"
-  default     = "envs/dev"
+  description = "Git repository contains for workloads"
+  default     = "eks-blueprints-workloads"
 }
 
-variable "addons_repo_url" {
+variable "gitops_workloads_path" {
   type        = string
-  description = "Git repo URL for the ArgoCD addons deployment"
-  default     = "https://github.com/aws-samples/eks-blueprints-add-ons.git"
+  description = "Git repo path in workload_repo_url for the ArgoCD workload deployment"
+  default     = "envs/dev"
 }
 
-variable "iam_platform_user" {
+variable "gitops_workloads_revision" {
   type        = string
-  description = "IAM user used as platform-user"
-  default     = ""
+  description = "Git repo revision in gitops_workloads_url  for the ArgoCD workload deployment"
+  default     = "main"
 }
 
 variable "argocd_secret_manager_name_suffix" {
diff --git a/examples/blue-green-upgrade/modules/eks_cluster/versions.tf b/examples/blue-green-upgrade/modules/eks_cluster/versions.tf
index 729454b581..eda2864d1e 100644
--- a/examples/blue-green-upgrade/modules/eks_cluster/versions.tf
+++ b/examples/blue-green-upgrade/modules/eks_cluster/versions.tf
@@ -1,10 +1,19 @@
 terraform {
-  required_version = ">= 1.0"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
       version = ">= 5.0.0"
     }
+
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.22.0"
+    }
+    template = {
+      source  = "hashicorp/template"
+      version = ">= 2.2.0"
+    }
   }
 }
diff --git a/examples/blue-green-upgrade/tear-down-applications.sh b/examples/blue-green-upgrade/tear-down-applications.sh
new file mode 100755
index 0000000000..0cdf0fe830
--- /dev/null
+++ b/examples/blue-green-upgrade/tear-down-applications.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -e
+
+# First tear down Applications
+kubectl delete provisioners.karpenter.sh --all # this is ok if no addons are deployed on Karpenter.
+kubectl delete application bootstrap-workloads -n argocd || (echo "error deleting bootstrap-workloads application" && exit -1)
+kubectl delete application -l argocd.argoproj.io/application-set-name=eks-blueprints-workloads -n argocd || (echo "error deleting workloads application"; exit -1)
+
+#kubectl delete application ecsdemo -n argocd || (echo "error deleting ecsdemo application" && exit -1)
+
+#namespace geordie was stuck
+#kubectl get applications  -o=jsonpath='{range .items[*]}{.metadata.name}{"\n"}' | xargs -I {} kubectl patch application {}  --type=json -p='[{"op": "remove", "path": "/metadata/finalizers"}]'
+
+for x in $(kubectl get namespaces -o=jsonpath='{range .items[*]}{.metadata.name}{"\n"}') ; do
+  echo $x
+  kubectl get -n $x ingress  -o=jsonpath='{range .items[*]}{.metadata.name}{"\n"}' | xargs -I {} kubectl patch -n $x ingress {}  --type=json -p='[{"op": "remove", "path": "/metadata/finalizers"}]'
+done
+
+#Error from server (InternalError): Internal error occurred: failed calling webhook "vingress.elbv2.k8s.aws": failed to call webhook: Post "https://aws-load-balancer-webhook-service.kube-system.svc:443/validate-networking-v1-ingress?timeout=10s": no endpoints available for service "aws-load-balancer-webhook-service"
+
+echo "Tear Down Applications OK"
diff --git a/examples/blue-green-upgrade/tear-down.sh b/examples/blue-green-upgrade/tear-down.sh
index 66fe877400..826a5d3165 100755
--- a/examples/blue-green-upgrade/tear-down.sh
+++ b/examples/blue-green-upgrade/tear-down.sh
@@ -1,10 +1,28 @@
 #!/bin/bash
 set -e
 
-# First tear down Applications
-kubectl delete provisioners.karpenter.sh --all # this is ok if no addons are deployed on Karpenter.
-kubectl delete application workloads -n argocd || (echo "error deleting workloads application"; exit -1)
-kubectl delete application ecsdemo -n argocd || (echo "error deleting ecsdemo application" && exit -1)
+# Get the directory of the currently executing script (shell1.sh)
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+{ "$SCRIPT_DIR/tear-down-applications.sh"; } || {
+  echo "Error occurred while deleting application"
+
+  # Ask the user if they want to continue
+  read -p "Do you want to continue with cluster deletion (y/n)? " choice
+  case "$choice" in
+    y|Y ) echo "Continuing with the rest of shell1.sh";;
+    * ) echo "Exiting.."; exit;;
+  esac
+}
+
+kubectl delete svc -n argocd argo-cd-argocd-server
+
+# terraform destroy -target="module.gitops_bridge_bootstrap" -auto-approve
+# terraform destroy -target="module.eks_blueprints_addons" -auto-approve
+# terraform destroy -target="module.eks" -auto-approve
+# terraform destroy -target="module.vpc" -auto-approve
+# terraform destroy -auto-approve
+
 
 # Then Tear down the cluster
 terraform apply -destroy -target="module.eks_cluster.module.kubernetes_addons" -auto-approve || (echo "error deleting module.eks_cluster.module.kubernetes_addons" && exit -1)
diff --git a/examples/blue-green-upgrade/terraform.tfvars.example b/examples/blue-green-upgrade/terraform.tfvars.example
index 6ff5fcc5c3..4687c83db5 100644
--- a/examples/blue-green-upgrade/terraform.tfvars.example
+++ b/examples/blue-green-upgrade/terraform.tfvars.example
@@ -6,7 +6,8 @@ hosted_zone_name    = "eks.mydomain.org" # your Existing Hosted Zone
 eks_admin_role_name = "Admin" # Additional role admin in the cluster (usually the role I use in the AWS console)
 
 # EKS Blueprint AddOns ArgoCD App of App repository
-addons_repo_url = "git@github.com:aws-samples/eks-blueprints-add-ons.git"
+gitops_bridge_repo_url = "git@github.com:gitops-bridge-dev/gitops-bridge-argocd-control-plane-template"
+gitops_bridge_repo_revision = "HEAD"
 
 # EKS Blueprint Workloads ArgoCD App of App repository
 workload_repo_url      = "git@github.com:aws-samples/eks-blueprints-workloads.git"