#atlantis - April 2020

For folks using atlantis.yaml per-repo settings files to define many projects, figured I’d see if I could reduce a lot of repetition in my config file using YAML Anchors and References. Came up with the following anchor system. While atlantis will process the two anchor templates as projects, the directory doesn’t exist so it doesn’t detect any changes and will not run. I couldn’t define the anchors in a separate section as atlantis got mad about it.

projects:
  # Project Definitions
  - &terraform_project
    name: "template-terraform-project"
    dir: '.empty'
    workflow: "make"
    workspace: "default"
    terraform_version: "v0.11.14"
    autoplan:
      when_modified:
        - "Makefile*"
        - "*.tf"
        - "*.tfvars"
        - "*.envrc"
      enabled: true
    apply_requirements:
      - "approved"

  ## Shared Infrastructure
  - <<: *terraform_project
    name: "account-dns"
    dir: "conf/account-dns"

  - <<: *terraform_project
    name: "aws-metrics-role"
    dir: "conf/us-east-1/aws-metrics-role"

  - <<: *terraform_project
    name: "chamber"
    dir: "conf/us-east-1/chamber"

  - <<: *terraform_project
    name: "cloudtrail"
    dir: "conf/cloudtrail"

It’s worked in my limited testing thus far.

trying to use this module to setup fargate but having issues. anyone using the same module and have it working as expected?

https://github.com/terraform-aws-modules/terraform-aws-atlantis

on the https://github.com/cloudposse/terraform-aws-ecs-atlantis/blob/master/main.tf#L286

working with the cloudposse atlantis module I’m having a problem with the github webhooks

i have atlantis working and have

  atlantis_repo_whitelist = [
    "<http://github.com/myorg/*|github.com/myorg/*>",
  ]

  # Atlantis
  # Github repositories where webhook should be created
  atlantis_allowed_repo_names = [
    "myorg/terraform_scripts"
  ]

but almost every pr in my org is receiving comments of atlantis plan when I only want it to show plan for myorg/terraform_scripts

if I set my atlantis_repo_whitelist to only myorg/terraform_scripts, then I see Error: repo not in whitelist or similar as a comment

is there a way to configure it for a single repository in an org without it commenting "error" on all other repo prs ?

thanks! 😄

management doesn't seem to be completely sold on atlantis. besides

• just like we have cicd of code, we can also have cicd of terraform
• auditability of terraform plans
• a number of top companies using it (lyft, shopify, pagerduty, hootsuite, cloudposse) and hashicorp owns it
• locking of modules within prs
• terraform workspace support
• only apply changes that are approved
notable posts
• https://www.runatlantis.io/
• https://medium.com/runatlantis/terraform-and-the-dangers-of-applying-locally-543563782a73
• https://medium.com/runatlantis/introducing-atlantis-6570d6de7281
• https://docs.google.com/presentation/d/1X4VGx-R8UZWE_2s7I8IxcbWsav1kR-QosmHI8kKaIZc/htmlpresent
• https://www.reddit.com/r/devops/comments/cakyfp/psa_love_terraform_love_cicd_you_want_to_run/
are there more reasons to use it?

Dev do not need to set terraform on their machines and TF is run by atlantis using instance profiles that are fully auditable

the changes of infra are in a VCS

GitOps is awesome

Is there a way to limit atlantis what environment to run without workspaces ?

in my case I have one atlantis per aws account = environment

only selected repos can trigger webhooks

and only few people can do applies

using terraform atlantis cloudposse module

but my terraform project structure is :

./
 main.tf
variables.tf
staging.tfvars
staging-backend.tfvars
production.tfvars
production-backend.tfvars

so when we run tf we basically run terraform init -backend-config=staging-backend.tfvars then plan then `apply

but the account or role used is only for the staging account

and atlantis is deployed to each specific account

so I want to limit the scope of what they can run for each atlantis deployment

@Alex Siegman Hows your Atlantis Anchors working out? May need that real soon!

does anybody here have experience with atlantis multi account setup?