Skip to content

Commit 8dd0c60

Browse files
nwthomasnwthomas
committed
Add Atlantis initial config files
1 parent aa3be2e commit 8dd0c60

File tree

15 files changed

+833
-0
lines changed

15 files changed

+833
-0
lines changed

‎.github/pull_request_template.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!-- Please read before opening a pull request: https://github.com/nwthomas/.github/blob/main/CONTRIBUTING.md -->
2+
3+
## Ticket
4+
5+
<!-- Place any references / tickets here -->
6+
7+
## Problem
8+
9+
<!-- What is the problem you're trying to solve with this PR? -->
10+
11+
## Solution
12+
13+
<!-- What is the proposed solution to the above problem implemented in this PR? -->
14+
15+
## Testing
16+
17+
<!-- How did you personally test this and validate the solution? Please be specific. -->

‎ATLANTIS_SETUP.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# Atlantis Setup Guide
2+
3+
This guide will help you set up Atlantis for your GitOps repository to enable Terraform and Helm automation via GitHub comments.
4+
5+
## Prerequisites
6+
7+
1. **GitHub Personal Access Token** or **GitHub App**
8+
2. **Domain name** for Atlantis (or use port-forwarding for testing)
9+
3. **Kubernetes cluster** with ArgoCD running
10+
11+
## Setup Steps
12+
13+
### 1. Create GitHub Personal Access Token
14+
15+
1. Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
16+
2. Click "Generate new token (classic)"
17+
3. Give it a name like "Atlantis GitOps"
18+
4. Select scopes:
19+
- `repo` (Full control of private repositories)
20+
- `write:discussion` (Write team discussions)
21+
- `admin:org` (if using organization webhooks)
22+
5. Copy the token (you won't see it again!)
23+
24+
### 2. Create GitHub App (Alternative to Personal Access Token)
25+
26+
If you prefer using a GitHub App:
27+
28+
1. Go to GitHub Settings → Developer settings → GitHub Apps
29+
2. Click "New GitHub App"
30+
3. Fill in:
31+
- **GitHub App name**: `atlantis-gitops`
32+
- **Homepage URL**: `https://atlantis.yourdomain.com`
33+
- **Webhook URL**: `https://atlantis.yourdomain.com/events`
34+
- **Webhook secret**: Generate a random string
35+
4. Select permissions:
36+
- **Repository permissions**:
37+
- Contents: Read
38+
- Issues: Write
39+
- Pull requests: Write
40+
- Metadata: Read
41+
- **Subscribe to events**:
42+
- Pull request
43+
- Issue comment
44+
- Pull request review
45+
5. Download the private key
46+
47+
### 3. Update Atlantis Configuration
48+
49+
Edit `helm/atlantis/values.yaml`:
50+
51+
```yaml
52+
atlantis:
53+
env:
54+
# Update these values
55+
ATLANTIS_REPO_ALLOWLIST: "github.com/nwthomas/gitops" # Your repo
56+
ATLANTIS_ATLANTIS_URL: "https://atlantis.yourdomain.com" # Your domain
57+
GITHUB_USER: "nwthomas" # Your GitHub username
58+
59+
# If using GitHub App, uncomment and set:
60+
# GITHUB_APP_ID: "123456" # Your GitHub App ID
61+
```
62+
63+
### 4. Create Kubernetes Secret
64+
65+
Create the secret with your GitHub token:
66+
67+
```bash
68+
# For Personal Access Token
69+
kubectl create secret generic atlantis-secrets \
70+
--from-literal=github-token="YOUR_GITHUB_TOKEN" \
71+
-n atlantis
72+
73+
# For GitHub App (also include the private key)
74+
kubectl create secret generic atlantis-secrets \
75+
--from-literal=github-token="YOUR_GITHUB_TOKEN" \
76+
--from-file=github-app-key=path/to/your/private-key.pem \
77+
-n atlantis
78+
```
79+
80+
### 5. Set Up GitHub Webhook
81+
82+
1. Go to your repository settings → Webhooks
83+
2. Click "Add webhook"
84+
3. Fill in:
85+
- **Payload URL**: `https://atlantis.yourdomain.com/events`
86+
- **Content type**: `application/json`
87+
- **Secret**: (if using GitHub App, use the webhook secret)
88+
- **Events**: Select "Let me select individual events"
89+
- Pull requests
90+
- Issue comments
91+
- Pull request reviews
92+
4. Click "Add webhook"
93+
94+
### 6. Deploy Atlantis
95+
96+
1. Commit and push your changes to the repository
97+
2. ArgoCD will automatically deploy Atlantis
98+
3. Check the deployment:
99+
100+
```bash
101+
kubectl get pods -n atlantis
102+
kubectl get svc -n atlantis
103+
kubectl get ingress -n atlantis
104+
```
105+
106+
### 7. Test the Setup
107+
108+
1. Create a test pull request that modifies files in the `/helm` directory
109+
2. Comment on the PR: `atlantis plan`
110+
3. Atlantis should respond with a plan
111+
4. If the plan looks good, comment: `atlantis apply`
112+
5. Atlantis will apply the changes
113+
114+
## Usage
115+
116+
### Available Commands
117+
118+
- `atlantis plan` - Run terraform plan
119+
- `atlantis apply` - Apply terraform changes
120+
- `atlantis plan -p <project>` - Plan specific project
121+
- `atlantis apply -p <project>` - Apply specific project
122+
- `atlantis unlock` - Unlock a locked workspace
123+
- `atlantis help` - Show help
124+
125+
### Project Structure
126+
127+
Atlantis monitors these directories:
128+
- `/helm/*` - Helm charts
129+
- `/terraform` - Terraform configurations
130+
- `/argocd/apps/*` - ArgoCD applications
131+
132+
### Security Features
133+
134+
- **User Restriction**: Only `nwthomas` can run Atlantis commands
135+
- **Approval Required**: All changes require PR approval
136+
- **Mergeable Required**: PR must be mergeable before applying
137+
- **Repository Allowlist**: Only your specific repository is allowed
138+
139+
## Troubleshooting
140+
141+
### Check Atlantis Logs
142+
143+
```bash
144+
kubectl logs -f deployment/atlantis -n atlantis
145+
```
146+
147+
### Verify Webhook Delivery
148+
149+
1. Go to your repository → Settings → Webhooks
150+
2. Click on your webhook
151+
3. Check "Recent Deliveries" for any failed deliveries
152+
153+
### Common Issues
154+
155+
1. **Webhook not working**: Check the webhook URL and secret
156+
2. **Permission denied**: Verify GitHub token has correct permissions
157+
3. **Atlantis not responding**: Check logs and ensure the service is running
158+
4. **Terraform errors**: Check the terraform configuration and state
159+
160+
### Port Forwarding for Testing
161+
162+
If you don't have a domain set up yet:
163+
164+
```bash
165+
kubectl port-forward svc/atlantis 4141:4141 -n atlantis
166+
```
167+
168+
Then use `http://localhost:4141` as your webhook URL temporarily.
169+
170+
## Security Considerations
171+
172+
1. **GitHub Token**: Store securely and rotate regularly
173+
2. **Webhook Secret**: Use a strong, random secret
174+
3. **RBAC**: Atlantis has minimal required permissions
175+
4. **Network**: Use HTTPS for webhook URLs
176+
5. **Monitoring**: Monitor Atlantis logs for suspicious activity
177+
178+
## Next Steps
179+
180+
1. Set up monitoring for Atlantis
181+
2. Configure backup for Atlantis data
182+
3. Set up alerting for failed plans/applies
183+
4. Consider setting up Atlantis for multiple repositories

‎argocd/apps/atlantis/atlantis-app.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: atlantis-app
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argocd.argoproj.io
8+
spec:
9+
project: default
10+
source:
11+
repoURL: https://github.com/nwthomas/gitops.git
12+
targetRevision: main
13+
path: helm/atlantis
14+
helm:
15+
valueFiles:
16+
- values.yaml
17+
destination:
18+
server: https://kubernetes.default.svc
19+
namespace: atlantis
20+
syncPolicy:
21+
syncOptions:
22+
- CreateNamespace=true
23+
- ServerSideApply=true
24+
automated:
25+
prune: true
26+
selfHeal: true

‎argocd/namespaces/atlantis-namespace-app.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: atlantis-namespace-app
5+
namespace: argocd
6+
spec:
7+
project: default
8+
source:
9+
repoURL: https://github.com/nwthomas/gitops.git
10+
targetRevision: main
11+
path: argocd/apps/atlantis
12+
helm:
13+
valueFiles:
14+
- values.yaml
15+
destination:
16+
server: https://kubernetes.default.svc
17+
namespace: atlantis
18+
syncPolicy:
19+
syncOptions:
20+
- CreateNamespace=true
21+
- Prune=true

‎atlantis.yaml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
version: 3
2+
projects:
3+
# Monitor the helm directory for changes
4+
- name: helm-argocd
5+
dir: helm/argocd
6+
workflow: default
7+
autoplan:
8+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
9+
enabled: true
10+
apply_requirements: ["approved", "mergeable"]
11+
allowed_users: ["nwthomas"]
12+
13+
- name: helm-cert-manager
14+
dir: helm/cert-manager
15+
workflow: default
16+
autoplan:
17+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
18+
enabled: true
19+
apply_requirements: ["approved", "mergeable"]
20+
allowed_users: ["nwthomas"]
21+
22+
- name: helm-grafana
23+
dir: helm/grafana
24+
workflow: default
25+
autoplan:
26+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
27+
enabled: true
28+
apply_requirements: ["approved", "mergeable"]
29+
allowed_users: ["nwthomas"]
30+
31+
- name: helm-longhorn
32+
dir: helm/longhorn
33+
workflow: default
34+
autoplan:
35+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
36+
enabled: true
37+
apply_requirements: ["approved", "mergeable"]
38+
allowed_users: ["nwthomas"]
39+
40+
- name: helm-prometheus
41+
dir: helm/prometheus
42+
workflow: default
43+
autoplan:
44+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
45+
enabled: true
46+
apply_requirements: ["approved", "mergeable"]
47+
allowed_users: ["nwthomas"]
48+
49+
- name: helm-prometheus-operator
50+
dir: helm/prometheus-operator
51+
workflow: default
52+
autoplan:
53+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
54+
enabled: true
55+
apply_requirements: ["approved", "mergeable"]
56+
allowed_users: ["nwthomas"]
57+
58+
- name: helm-prometheus-service-monitors
59+
dir: helm/prometheus-service-monitors
60+
workflow: default
61+
autoplan:
62+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
63+
enabled: true
64+
apply_requirements: ["approved", "mergeable"]
65+
allowed_users: ["nwthomas"]
66+
67+
- name: helm-atlantis
68+
dir: helm/atlantis
69+
workflow: default
70+
autoplan:
71+
when_modified: ["**/*.yaml", "**/*.yml", "**/*.tpl"]
72+
enabled: true
73+
apply_requirements: ["approved", "mergeable"]
74+
allowed_users: ["nwthomas"]
75+
76+
# Monitor the terraform directory for changes
77+
- name: terraform-namespaces
78+
dir: terraform
79+
workflow: default
80+
autoplan:
81+
when_modified: ["**/*.tf", "**/*.tfvars"]
82+
enabled: true
83+
apply_requirements: ["approved", "mergeable"]
84+
allowed_users: ["nwthomas"]
85+
86+
workflows:
87+
default:
88+
plan:
89+
steps:
90+
- init
91+
- plan
92+
apply:
93+
steps:
94+
- apply

‎helm/atlantis/Chart.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v2
2+
name: atlantis
3+
description: Atlantis is a tool for Terraform pull request automation
4+
type: application
5+
version: 0.1.0
6+
appVersion: "0.27.0"
7+
keywords:
8+
- atlantis
9+
- terraform
10+
- gitops
11+
- automation
12+
home: https://www.runatlantis.io/
13+
sources:
14+
- https://github.com/runatlantis/atlantis
15+
maintainers:
16+
- name: Atlantis Team
17+
email: [email protected]

0 commit comments

Comments
 (0)