#atmos - August 2025

cd components/terraform/eks/cluster/
terraform init
terraform workspace list
terraform workspace new plat-use1-dev-eks-cluster
terraform workspace select plat-use1-dev-eks-cluster
terraform state pull > plat-use1-dev-eks.tfstate
terraform state push plat-use1-dev-eks.tfstate

terraform workspace select plat-use1-dev-eks-cluster
terraform state list

terraform workspace select plat-use1-dev-eks-cluster-ops
terraform state list

atmos terraform plan eks/cluster --stack plat-use1-dev

configuration_values: |
{
  "ExampleAttr1": "static-prefix-{{.vars.environment}}-{{.vars.tenant}}-{{.vars.stage}}",
  "ExampleAttr2": ...
}               

name_template: "{{.settings.context.tenant}}-{{.settings.context.env}}-{{.settings.context.resource.name}}-{{.settings.context.region}}-{{.settings.context.resource.number}}"

!store dev/ssm vpc-networking "public_subnet_objects | query select(.tags.Name == ""bastion_subnet_us_east_2c"") | .id"

config:
  plan: &plan
    - command: terraform generate planfile transit-gateway -f "{{ /atmos/tenable/{{ .vars.stage }}-transit-gateway.tfplan.json }}"
    - command: terraform generate planfile tgw-routing -f "{{ /atmos/tenable/{{ .vars.stage }}-tgw-routing.tfplan.json }}"
workflows:
  plan-ue1:
    description: |
      The steps in this workflow are run when a pull request is opened or updated.
      This workflow will plan the component with mock outputs for dependencies.
      It will not apply any changes.
    stack: cfsb-it-network-ue1
    steps: *plan

The following command failed to execute:
 atmos terraform generate planfile transit-gateway -f "{{ /atmos/tenable/{{ .vars.stage }}-transit-gateway.tfplan.json }}" -s cfsb-it-network-ue1

To resume the workflow from this step, run:
 atmos workflow plan-ue1 -f run --from-step step1 -s cfsb-it-network-ue1

# Atmos Stores
# <https://atmos.tools/core-concepts/projects/configuration/stores/>
stores:
  use1/ssm:
    type: aws-ssm-parameter-store
    options:
      region: us-east-1
  usw2/ssm:
    type: aws-ssm-parameter-store
    options:
      region: us-west-2

          - name: "AWS-AWSManagedRulesBotControlRuleSet"
            priority: 100
            statement:
              # <https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html>
              name: AWSManagedRulesBotControlRuleSet
              vendor_name: AWS
              scope_down_not_statement_enabled: true
              scope_down_statement:
                byte_match_statement:
                  field_to_match:
                    single_header:
                      name: "secret-token"
                  positional_constraint: "EXACTLY"
                  search_string: !store use1/ssm waf/defaults /waf/defaults/secret_token
                  text_transformation:
                    - priority: 101
                      type: "NONE"

==> Binaries will be located at: /opt/hostedtoolcache/opentofu/opentofu/v1.8.4/linux-x64
Warning: Failed to restore: Cache service responded with 400
==> File extension matching disabled
searching for tofu_1.8.4_386.apk with (linux|x86_64|x64|amd64).*(linux|x86_64|x64|amd64).*

The 400 error from the cache service is occurring because GitHub migrated to a new cache service on February 1st, 2025, and deprecated older versions. The
  cloudposse-github-actions/install-gh-releases@v1 action is using an outdated cache implementation.

vars:
  connection_string: |
    printf "<postgres://username>:%s@%s:5432/dbname" 
      !terraform.output rds-postgres-resources .additional_users | .username.db_user_password
      !terraform.output rds-postgres rds_address

components:
  terraform:
    myrepo:
      metadata:
        component: aws-github-repository
      vars:
        enabled: true
        owner: acme-github-org
        repository:
          name: "my-repository"
          description: "My repository"
          homepage_url: "<http://example.com/>"
          topics:
            - terraform
            - github
            - test
        default_branch: "main"
        secrets:
          MY_SECRET: "my-secret-value"
          MY_SECRET_2: "nacl:dGVzdC12YWx1ZS0yCg=="
          MY_SECRET_3: "<ssm://my/secret/path>"
          MY_SECRET_4: "sm:secret-name"
        variables:
          MY_VARIABLE: "my-variable-value"
          MY_VARIABLE_2: "<ssm://my/variable/path>"
          MY_VARIABLE_3: "sm:variable-name"

    vpc-attachments:
      vars:
        vpc_attachments:
          vpc:
            subnet_ids: !terraform.state vpc "intra_subnets // ""[MOCK__subnet_0, MOCK__subnet_1, MOCK__subnet_2]"""
            # Atmos supports YQ expressions on state outputs <https://atmos.tools/core-concepts/stacks/yaml-functions/terraform.state#using-yq-expressions-to-retrieve-items-from-complex-output-types>
            # See YQ merge for concatenating multiple lists <https://mikefarah.gitbook.io/yq/operators/add#concatenate-arrays>
            vpc_route_table_ids: !terraform.state vpc ".private_route_table_ids + .intra_route_table_ids + .database_route_table_ids" // ""[MOCK__route_table_id_0, MOCK__route_table_id_1, MOCK__route_table_id_2]"""
        tgw_vpc_attachment_tags:
          Name: "{{ .atmos_stack }}-tgw-attachment"

ProcessYAMLConfigFile: Merge: Deep-merge the stack manifest and all the imports: Error: cannot override two slices with different type ([]interface {}, string)

<https://mikefarah.gitbook.io/yq/operators/add#concatenate-arrays>

github_repository.default[0]: Creating...
Error: PATCH <https://api.github.com/repos/redacted/argocd-prod>: 404 Not Found []

Error: POST <https://api.github.com/orgs/redacted/repos>: 422 Repository creation failed. 
[{Resource:Repository Field:name Code:custom Message:name already exists on this account}]

├── atmos.yaml
├── components
│   └── terraform
│       └── vpc
└── stacks
    ├── environment
    │   ├── _defaults.yaml
    │   ├── sandbox
    │   │   └── networking.yaml
    │   └── staging
    │       └── networking.yaml
    └── mixins
        └── environment
            ├── sandbox.yaml
            └── staging.yaml

base_path: "./"

components:
  terraform:
    base_path: "components/terraform"
    apply_auto_approve: false
    deploy_run_init: true
    init_run_reconfigure: true
    auto_generate_backend_file: true

stacks:
  base_path: "stacks"
  included_paths:
    - "environment/**/*"
  excluded_paths:
    - "environment/_defaults.yaml"
  name_pattern: "{environment}"

logs:
  file: "/dev/stderr"
  level: Info

imports:
  - mixins/environment/sandbox
  - environment/_defaults

vars:
  environment: sandbox

components:
  terraform:
    vpc:
      backend:
        s3:
          workspace_key_prefix: sandbox
      vars:
        vpc_ipv4_cidr: "10.1.0.0/16"

{
  "terraform": {
    "backend": {
      "": {}
    }
  }
}

…/home/IaC 󰊢-main* ❯ ⎈ default:netbird-system atmos list components -s prod-oci-k8s
capacity_report
instance_pool
kubeconfig
…/home/IaC 󰊢-main* ❯ ⎈ default:netbird-system atmos list components -s prod-oci-k8s
argocd_gitops_repo
capacity_report
cloudflared_tunnel
instance_pool
kubeconfig
namespaces
privileged_namespaces