If you push and pull helm charts/images from ECR, you need to make sure that the runner has correct permissions. To do that, you need to create an IRSA role with necessary permissions attached. This is on AWS side. On K8s side you need to attach arn of the role created as an annotation (you’ll find somewhere in docs). In general, CD of Helm Chart is usually 1:1 when compared to image deployment and can be viewed as an extension of image build pipeline. However, the more clusters you have, the less I like it and favor FluxCD, especially in this case as it has insane GitHub/GitLab features. On of the ways to change image version would be to store it after image build/push in GitLab env variable, pass it to helm task, where something similar to helm upgrade —install -n —set image.tag=. Obviously the set flag will differ, depending on structure of your values file. More on reddit.com

Definitely make use of the gitlab reference architectures for your use case . For 30 users you can most certainly get away with the single-node "up to 1000 users" architecture. The omnibus (i.e. package manager dnf/apt-get) installer is usually the simplest and most-maintainable, configurable, and upgradeable route if you can do it. If you want to separate the resources or implement a high-availability environment, the next step up is the 2000-user installation, which uses a lot more separate nodes and becomes a lot more difficult to maintain and upgrade. We're running a few environments up-to-3000k architecture at our (much larger) organization and they can be a slog to maintain when something goes wrong. Upgrading is a few-hour endeavor late at night. Would not be worth it for anything less than several hundred users. I would also highly recommend (even with the single-node architecture) using object storage like s3 for all of the supported objects. In your case, the container registry and possibly package registry is likely going to be the heaviest use-case for that, it's worth it to keep that separate. Most of our smaller environments are just that -- single-node with s3 object storage kept separate. Also backups to a separate share location (or can use cloud for that too). Can do something like a weekly full backup plus nightly incremental repo backups. More on reddit.com

It is defaulting to try to connect to the k8s API on ‘localhost’ but since your script is running inside a container, localhost is not valid. You need to pass in your Kubernetes context with a URL it can connect to. Options: Configure in project settings: https://docs.gitlab.com/ee/user/project/clusters/add_remove_clusters.html#existing-kubernetes-cluster then set environment: name: in your job. It will then pass in kubernetes context as environment variables. (I have not tried this with microk8s, but this is what I use to configure external clusters.) Copy the contents of your ~/.kube/config file and add it to your CI Variables as a “file” type variable named KUBECONFIG. More on reddit.com

Depending on your definition of local? Do you mean not a cloud provider? Either way, yes. More on reddit.com