Add atlantis

apps/cluster-admin/templates/atlantis-configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: atlantis
+data:
+  repos.yaml: |
+    repos:
+      - id: github.com/hasadna/hasadna-iac-atlantis
+        branch: /main/
+        allowed_overrides: [workflow]
+        allow_custom_workflows: true

apps/cluster-admin/templates/atlantis-deployment.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: atlantis
+spec:
+  selector:
+    matchLabels:
+      app: atlantis
+  replicas: 1
+  revisionHistoryLimit: 2
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: atlantis
+    spec:
+      terminationGracePeriodSeconds: 10
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: atlantis
+          image: ghcr.io/hasadna/hasadna-iac/atlantis:latest
+          imagePullPolicy: Always
+          resources: {{ toYaml .Values.atlantis.resources | nindent 12 }}
+          args:
+            - server
+            - --atlantis-url=https://atlantis.hasadna.org.il
+            - --gh-token=$(GITHUB_TOKEN)
+            - --gh-user=$(GITHUB_USER)
+            - --gh-webhook-secret=$(GITHUB_WEBHOOK_SECRET)
+            - --repo-allowlist=github.com/hasadna/hasadna-iac-atlantis
+            - --web-basic-auth
+            - --web-username=$(WEB_USERNAME)
+            - --web-password=$(WEB_PASSWORD)
+            - --port=4141
+            - --repo-config=/home/atlantis/config/repos.yaml
+          env:
+            - name: VAULT_ADDR
+              valueFrom:
+                secretKeyRef:
+                  name: atlantis-vault-creds
+                  key: ADDR
+            - name: VAULT_ROLE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: atlantis-vault-creds
+                  key: ROLE_ID
+            - name: VAULT_SECRET_ID
+              valueFrom:
+                secretKeyRef:
+                  name: atlantis-vault-creds
+                  key: SECRET_ID
+          envFrom:
+            - secretRef:
+                name: atlantis-env
+          volumeMounts:
+            - name: data
+              mountPath: /home/atlantis/.atlantis
+            - name: config
+              mountPath: /home/atlantis/config
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: atlantis-data
+        - name: config
+          configMap:
+            name: atlantis

apps/cluster-admin/templates/atlantis-service.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: atlantis
+spec:
+  selector:
+    app: atlantis
+  ports:
+  - port: 4141

apps/cluster-admin/templates/ingresses.yaml

@@ -0,0 +1,31 @@
+{{ if and .Values.enabled .Values.ingresses }}
+{{ range .Values.ingresses }}
+apiVersion: {{ if (gt (atoi $.Capabilities.KubeVersion.Minor) 30) }}networking.k8s.io/v1{{ else }}extensions/v1beta1{{ end }}
+kind: Ingress
+metadata:
+  name: {{ .name }}
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+spec:
+  rules:
+  {{ range .rules }}
+  - host: {{ .host }}
+    http:
+      paths:
+      {{- if (gt (atoi $.Capabilities.KubeVersion.Minor) 30) }}
+      - path: "/"
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .serviceName }}
+            port:
+              number: {{ .servicePort }}
+      {{- else }}
+      - backend:
+          serviceName: {{ .serviceName }}
+          servicePort: {{ .servicePort }}
+      {{- end }}
+  {{ end }}
+---
+{{ end }}
+{{ end }}

apps/cluster-admin/values-hasadna.yaml

@@ -12,6 +12,10 @@ terraformStateDb:
 #  nfsServer: "~iac:hasadna_nfs1_internal_ip~"
 #  nfsPath: "/terraform/state_db"
 
+atlantis:
+  atlantisUrl: "atlantis.~iac:rke2_catchall_hostname~"
+  orgAllowlist: "github.com/hasadna/*"
+
 secrets:
   - name: terraform-state-db
     data:
@@ -20,3 +24,17 @@ secrets:
       #  -keyout server.key -subj "/CN=terraform-state-db.localhost"
       server.key: "~vault:Projects/k8s/terraform:state_db_server.key~"
       server.crt: "~vault:Projects/k8s/terraform:state_db_server.crt~"
+  - name: atlantis-env
+    data:
+      GITHUB_TOKEN: "~vault:Projects/iac/github:atlantis_terraform_repo_token~"
+      GITHUB_USER: "~vault:Projects/iac/github:username~"
+      GITHUB_WEBHOOK_SECRET: "~vault:Projects/iac/atlantis:webhook_secret~"
+      WEB_USERNAME: "~vault:Projects/iac/atlantis:web_username~"
+      WEB_PASSWORD: "~vault:Projects/iac/atlantis:web_password~"
+
+ingresses:
+  - name: atlantis
+    rules:
+      - host: atlantis.hasadna.org.il
+        serviceName: atlantis
+        servicePort: 4141