From 0a26c963ce3bbd7c79e1da917aaf0ddcba9fbb11 Mon Sep 17 00:00:00 2001 From: Paul Salaberria Date: Fri, 30 Mar 2018 13:14:45 +0200 Subject: [PATCH 1/2] Add Kubernetes examples --- kubernetes/README.md | 35 ++++++++ kubernetes/atlantis-deployment-dns-ssl.yaml | 96 +++++++++++++++++++++ kubernetes/atlantis-deployment.yaml | 72 ++++++++++++++++ kubernetes/atlantis-persistent-storage.yaml | 88 +++++++++++++++++++ 4 files changed, 291 insertions(+) create mode 100644 kubernetes/README.md create mode 100644 kubernetes/atlantis-deployment-dns-ssl.yaml create mode 100644 kubernetes/atlantis-deployment.yaml create mode 100644 kubernetes/atlantis-persistent-storage.yaml diff --git a/kubernetes/README.md b/kubernetes/README.md new file mode 100644 index 000000000..4bfdf33ce --- /dev/null +++ b/kubernetes/README.md @@ -0,0 +1,35 @@ +# Atlantis in Kubernetes + +Atlantis can be deployed as a Kubernetes +[Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) +or as a [Statefulset](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/). + +## Statefulset vs deployment + +For production it is recommended to deploy it as a statefulset +with a persistent disk. See [atlantis-persistent-storage.yaml](atlantis-persistent-storage.yaml) +for an example. + +If you do not want persistent storage, +have a look at [atlantis-deployment.yaml](atlantis-deployment.yaml). +It configures a deployment with a single replica, and no persistent disk. + +## Creating secrets + +Add the Github token and the webhook secret as a Kubernetes secret. + +``` +echo -n "yourtoken" > token +echo -n "yoursecret" > webhook-secret +kubectl create secret generic atlantis-github --from-file=token --from-file=webhook-secret +``` + +## DNS/SSL + +[atlantis-deployment-dns-ssl.yaml](atlantis-deployment-dns-ssl.yaml) shows an example of how to configure +Atlantis with SSL enabled. In addition, it adds a DNS entry +for the service. + +Dependencies: +- [external-dns](https://github.com/kubernetes-incubator/external-dns) +- [kubernetes-letsencrypt](https://github.com/tazjin/kubernetes-letsencrypt) diff --git a/kubernetes/atlantis-deployment-dns-ssl.yaml b/kubernetes/atlantis-deployment-dns-ssl.yaml new file mode 100644 index 000000000..18abbaef6 --- /dev/null +++ b/kubernetes/atlantis-deployment-dns-ssl.yaml @@ -0,0 +1,96 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: atlantis + namespace: default + labels: + app: atlantis +spec: + replicas: 1 + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + containers: + - name: atlantis + image: runatlantis/atlantis:latest + env: + - name: ATLANTIS_ATLANTIS_URL + value: atlantis.yourdomain.com + - name: ATLANTIS_PORT + value: "4141" + - name: ATLANTIS_GH_USER + value: your-cicd-user + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-github + key: token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-github + key: webhook-secret + - name: ATLANTIS_REPO_WHITELIST + value: github.com/yourorg/terraform-* + - name: ATLANTIS_SSL_CERT_FILE + value: /etc/tls/atlantis-cert.pem + - name: ATLANTIS_SSL_KEY_FILE + value: /etc/tls/atlantis-key.pem + volumeMounts: + - name: atlantis-yourdomain-com-tls + mountPath: /etc/tls + readOnly: true + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + memory: 300Mi + cpu: 1000m + limits: + memory: 300Mi + cpu: 1000m + livenessProbe: + httpGet: + path: / + port: 4141 + scheme: HTTPS + httpHeaders: + - name: Host + value: atlantis.yourdomain.com + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 3 + volumes: + - name: atlantis-yourdomain-com-tls + secret: + secretName: atlantis-yourdomain-com-tls + items: + - key: key.pem + path: atlantis-key.pem + - key: fullchain.pem + path: atlantis-cert.pem +--- +apiVersion: v1 +kind: Service +metadata: + name: atlantis + annotations: + # Setup dns. See https://github.com/kubernetes-incubator/external-dns + external-dns.alpha.kubernetes.io/hostname: atlantis.yourdomain.com. + # Get letsencrypt SSL certs, See https://github.com/tazjin/kubernetes-letsencrypt + acme/certificate: atlantis.yourdomain.com +spec: + ports: + - name: atlantis + port: 443 + targetPort: 4141 + selector: + app: atlantis diff --git a/kubernetes/atlantis-deployment.yaml b/kubernetes/atlantis-deployment.yaml new file mode 100644 index 000000000..e88f12ed2 --- /dev/null +++ b/kubernetes/atlantis-deployment.yaml @@ -0,0 +1,72 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: atlantis + namespace: default + labels: + app: atlantis +spec: + replicas: 1 + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + containers: + - name: atlantis + image: runatlantis/atlantis:latest + env: + - name: ATLANTIS_PORT + value: "4141" + - name: ATLANTIS_GH_USER + value: your-cicd-user + - name: ATLANTIS_LOG_LEVEL + value: debug + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-github + key: token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-github + key: webhook-secret + - name: ATLANTIS_REPO_WHITELIST + value: github.com/yourorg/terraform-* + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + memory: 300Mi + cpu: 1000m + limits: + memory: 300Mi + cpu: 1000m + livenessProbe: + httpGet: + path: / + port: 4141 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 3 +--- +apiVersion: v1 +kind: Service +metadata: + name: atlantis +spec: + ports: + - name: atlantis + port: 80 + targetPort: 4141 + selector: + app: atlantis + diff --git a/kubernetes/atlantis-persistent-storage.yaml b/kubernetes/atlantis-persistent-storage.yaml new file mode 100644 index 000000000..3bab45fe0 --- /dev/null +++ b/kubernetes/atlantis-persistent-storage.yaml @@ -0,0 +1,88 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: atlantis + namespace: default +spec: + serviceName: atlantis + replicas: 1 + updateStrategy: + type: RollingUpdate + rollingUpdate: + partition: 0 # Automatic update + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + securityContext: + fsGroup: 1000 # atlantis group (1000) read/write access to volumes + containers: + - name: atlantis + image: runatlantis/atlantis:latest + env: + - name: ATLANTIS_PORT + value: "4141" + - name: ATLANTIS_DATA_DIR + value: /atlantis + - name: ATLANTIS_GH_USER + value: your-cicd-user + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-github + key: token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-github + key: webhook-secret + - name: ATLANTIS_REPO_WHITELIST + value: github.com/yourorg/terraform-* + volumeMounts: + - name: atlantis-storage + mountPath: /atlantis + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + memory: 300Mi + cpu: 1000m + limits: + memory: 300Mi + cpu: 1000m + livenessProbe: + httpGet: + path: / + port: 4141 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 3 + volumeClaimTemplates: + - metadata: + name: atlantis-storage + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 5Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: atlantis +spec: + ports: + - name: atlantis + port: 80 + targetPort: 4141 + selector: + app: atlantis + From ba8267dda09525e1ea6c4f137502924d2baafc6d Mon Sep 17 00:00:00 2001 From: Luke Kysow Date: Sat, 26 May 2018 12:26:02 +0200 Subject: [PATCH 2/2] Move Kube manifests into README. Since the manifests need to be edited before they're applied to the cluster I thought it best to list them in the README rather than as files so it's more obvious that you can't just kubectl apply them. I also removed the dns-ssl manifest because it was using tazjin/kubernetes-letsencrypt which is no longer maintained and because there are so many ways to do SSL and routing within Kubernetes that I don't have a specific recommendation. --- README.md | 222 ++++++++++++++++++++ kubernetes/README.md | 35 --- kubernetes/atlantis-deployment-dns-ssl.yaml | 96 --------- kubernetes/atlantis-deployment.yaml | 72 ------- kubernetes/atlantis-persistent-storage.yaml | 88 -------- 5 files changed, 222 insertions(+), 291 deletions(-) delete mode 100644 kubernetes/README.md delete mode 100644 kubernetes/atlantis-deployment-dns-ssl.yaml delete mode 100644 kubernetes/atlantis-deployment.yaml delete mode 100644 kubernetes/atlantis-persistent-storage.yaml diff --git a/README.md b/README.md index bacce1079..f8f8b4338 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,7 @@ Read about [Why We Built Atlantis](https://medium.com/runatlantis/introducing-at * [Security](#security) * [Production-Ready Deployment](#production-ready-deployment) * [Docker](#docker) + * [Kubernetes](#kubernetes) * [Server Configuration](#server-configuration) * [AWS Credentials](#aws-credentials) * [Glossary](#glossary) @@ -424,6 +425,227 @@ docker build -t {YOUR_DOCKER_ORG}/atlantis-custom -f Dockerfile-custom . docker run {YOUR_DOCKER_ORG}/atlantis-custom server --gh-user=GITHUB_USERNAME --gh-token=GITHUB_TOKEN ``` +### Kubernetes +Atlantis can be deployed into Kubernetes as a +[Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) +or as a [Statefulset](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) with persistent storage. + +StatefulSet is recommended because Atlantis stores its data on disk and so if your Pod dies +or you upgrade Atlantis, you won't lose the data. On the other hand, the only data that +Atlantis has right now is any plans that haven't been applied and Atlantis locks. If +Atlantis loses that data, you just need to run `atlantis plan` again so it's not the end of the world. + +Regardless of whether you choose a Deployment or StatefulSet, first create a Secret with the webhook secret and access token: +``` +echo -n "yourtoken" > token +echo -n "yoursecret" > webhook-secret +kubectl create secret generic atlantis-vcs --from-file=token --from-file=webhook-secret +``` + +Next, edit the manifests below as follows: +1. Replace `` in `image: runatlantis/atlantis:` with the most recent version from https://github.com/runatlantis/atlantis/releases/latest. + * NOTE: You never want to run with `:latest` because if your Pod moves to a new node, Kubernetes will pull the latest image and you might end +up upgrading Atlantis by accident! +2. Replace `value: github.com/yourorg/*` under `name: ATLANTIS_REPO_WHITELIST` with the whitelist pattern +for your Terraform repos. See [--repo-whitelist](#--repo-whitelist) for more details. +3. If you're using GitHub: + 1. Replace `` with the username of your Atlantis GitHub user without the `@`. + 2. Delete all the `ATLANTIS_GITLAB_*` environment variables. +4. If you're using GitLab: + 1. Replace `` with the username of your Atlantis GitLab user without the `@`. + 2. Delete all the `ATLANTIS_GH_*` environment variables. + +#### StatefulSet Manifest +
+ Expand... + +```yaml +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: atlantis +spec: + serviceName: atlantis + replicas: 1 + updateStrategy: + type: RollingUpdate + rollingUpdate: + partition: 0 + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + securityContext: + fsGroup: 1000 # Atlantis group (1000) read/write access to volumes. + containers: + - name: atlantis + image: runatlantis/atlantis: # 1. Replace with the most recent release. + env: + - name: ATLANTIS_REPO_WHITELIST + value: github.com/yourorg/* # 2. Replace this with your own repo whitelist. + + ### GitHub Config ### + - name: ATLANTIS_GH_USER + value: # 3i. If you're using GitHub replace with the username of your Atlantis GitHub user without the `@`. + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: webhook-secret + + ### GitLab Config ### + - name: ATLANTIS_GITLAB_USER + value: # 4i. If you're using GitLab replace with the username of your Atlantis GitLab user without the `@`. + - name: ATLANTIS_GITLAB_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: token + - name: ATLANTIS_GITLAB_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: webhook-secret + + - name: ATLANTIS_DATA_DIR + value: /atlantis + volumeMounts: + - name: atlantis-data + mountPath: /atlantis + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + volumeClaimTemplates: + - metadata: + name: atlantis-data + spec: + accessModes: ["ReadWriteOnce"] # Volume should not be shared by multiple nodes. + resources: + requests: + # The biggest thing Atlantis stores is the Git repo when it checks it out. + # It deletes the repo after the pull request is merged. + storage: 5Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: atlantis +spec: + ports: + - name: atlantis + port: 80 + targetPort: 4141 + selector: + app: atlantis +``` +
+ + +#### Deployment Manifest +
+ Expand... + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: atlantis + labels: + app: atlantis +spec: + replicas: 1 + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + containers: + - name: atlantis + image: runatlantis/atlantis: # 1. Replace with the most recent release. + env: + - name: ATLANTIS_REPO_WHITELIST + value: github.com/yourorg/* # 2. Replace this with your own repo whitelist. + + ### GitHub Config ### + - name: ATLANTIS_GH_USER + value: # 3i. If you're using GitHub replace with the username of your Atlantis GitHub user without the `@`. + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: webhook-secret + + ### GitLab Config ### + - name: ATLANTIS_GITLAB_USER + value: # 4i. If you're using GitLab replace with the username of your Atlantis GitLab user without the `@`. + - name: ATLANTIS_GITLAB_TOKEN + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: token + - name: ATLANTIS_GITLAB_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: atlantis-vcs + key: webhook-secret + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m +--- +apiVersion: v1 +kind: Service +metadata: + name: atlantis +spec: + ports: + - name: atlantis + port: 80 + targetPort: 4141 + selector: + app: atlantis +``` +
+ +#### Routing and SSL +The manifests above create a Kubernetes `Service` of type `ClusterIP` which isn't accessible outside your cluster. +Depending on how you're doing routing into Kubernetes, you may want to use a `LoadBalancer` so that Atlantis is accessible +to GitHub/GitLab and your internal users. + +If you want to add SSL you can use something like https://github.com/jetstack/cert-manager to generate SSL +certs and mount them into the Pod. Then set the `ATLANTIS_SSL_CERT_FILE` and `ATLANTIS_SSL_KEY_FILE` environment variables to enable SSL. +You could also set up SSL at your LoadBalancer. + ### Testing Out Atlantis on GitHub diff --git a/kubernetes/README.md b/kubernetes/README.md deleted file mode 100644 index 4bfdf33ce..000000000 --- a/kubernetes/README.md +++ /dev/null @@ -1,35 +0,0 @@ -# Atlantis in Kubernetes - -Atlantis can be deployed as a Kubernetes -[Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) -or as a [Statefulset](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/). - -## Statefulset vs deployment - -For production it is recommended to deploy it as a statefulset -with a persistent disk. See [atlantis-persistent-storage.yaml](atlantis-persistent-storage.yaml) -for an example. - -If you do not want persistent storage, -have a look at [atlantis-deployment.yaml](atlantis-deployment.yaml). -It configures a deployment with a single replica, and no persistent disk. - -## Creating secrets - -Add the Github token and the webhook secret as a Kubernetes secret. - -``` -echo -n "yourtoken" > token -echo -n "yoursecret" > webhook-secret -kubectl create secret generic atlantis-github --from-file=token --from-file=webhook-secret -``` - -## DNS/SSL - -[atlantis-deployment-dns-ssl.yaml](atlantis-deployment-dns-ssl.yaml) shows an example of how to configure -Atlantis with SSL enabled. In addition, it adds a DNS entry -for the service. - -Dependencies: -- [external-dns](https://github.com/kubernetes-incubator/external-dns) -- [kubernetes-letsencrypt](https://github.com/tazjin/kubernetes-letsencrypt) diff --git a/kubernetes/atlantis-deployment-dns-ssl.yaml b/kubernetes/atlantis-deployment-dns-ssl.yaml deleted file mode 100644 index 18abbaef6..000000000 --- a/kubernetes/atlantis-deployment-dns-ssl.yaml +++ /dev/null @@ -1,96 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: atlantis - namespace: default - labels: - app: atlantis -spec: - replicas: 1 - selector: - matchLabels: - app: atlantis - template: - metadata: - labels: - app: atlantis - spec: - containers: - - name: atlantis - image: runatlantis/atlantis:latest - env: - - name: ATLANTIS_ATLANTIS_URL - value: atlantis.yourdomain.com - - name: ATLANTIS_PORT - value: "4141" - - name: ATLANTIS_GH_USER - value: your-cicd-user - - name: ATLANTIS_GH_TOKEN - valueFrom: - secretKeyRef: - name: atlantis-github - key: token - - name: ATLANTIS_GH_WEBHOOK_SECRET - valueFrom: - secretKeyRef: - name: atlantis-github - key: webhook-secret - - name: ATLANTIS_REPO_WHITELIST - value: github.com/yourorg/terraform-* - - name: ATLANTIS_SSL_CERT_FILE - value: /etc/tls/atlantis-cert.pem - - name: ATLANTIS_SSL_KEY_FILE - value: /etc/tls/atlantis-key.pem - volumeMounts: - - name: atlantis-yourdomain-com-tls - mountPath: /etc/tls - readOnly: true - ports: - - name: atlantis - containerPort: 4141 - resources: - requests: - memory: 300Mi - cpu: 1000m - limits: - memory: 300Mi - cpu: 1000m - livenessProbe: - httpGet: - path: / - port: 4141 - scheme: HTTPS - httpHeaders: - - name: Host - value: atlantis.yourdomain.com - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 3 - volumes: - - name: atlantis-yourdomain-com-tls - secret: - secretName: atlantis-yourdomain-com-tls - items: - - key: key.pem - path: atlantis-key.pem - - key: fullchain.pem - path: atlantis-cert.pem ---- -apiVersion: v1 -kind: Service -metadata: - name: atlantis - annotations: - # Setup dns. See https://github.com/kubernetes-incubator/external-dns - external-dns.alpha.kubernetes.io/hostname: atlantis.yourdomain.com. - # Get letsencrypt SSL certs, See https://github.com/tazjin/kubernetes-letsencrypt - acme/certificate: atlantis.yourdomain.com -spec: - ports: - - name: atlantis - port: 443 - targetPort: 4141 - selector: - app: atlantis diff --git a/kubernetes/atlantis-deployment.yaml b/kubernetes/atlantis-deployment.yaml deleted file mode 100644 index e88f12ed2..000000000 --- a/kubernetes/atlantis-deployment.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: atlantis - namespace: default - labels: - app: atlantis -spec: - replicas: 1 - selector: - matchLabels: - app: atlantis - template: - metadata: - labels: - app: atlantis - spec: - containers: - - name: atlantis - image: runatlantis/atlantis:latest - env: - - name: ATLANTIS_PORT - value: "4141" - - name: ATLANTIS_GH_USER - value: your-cicd-user - - name: ATLANTIS_LOG_LEVEL - value: debug - - name: ATLANTIS_GH_TOKEN - valueFrom: - secretKeyRef: - name: atlantis-github - key: token - - name: ATLANTIS_GH_WEBHOOK_SECRET - valueFrom: - secretKeyRef: - name: atlantis-github - key: webhook-secret - - name: ATLANTIS_REPO_WHITELIST - value: github.com/yourorg/terraform-* - ports: - - name: atlantis - containerPort: 4141 - resources: - requests: - memory: 300Mi - cpu: 1000m - limits: - memory: 300Mi - cpu: 1000m - livenessProbe: - httpGet: - path: / - port: 4141 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 3 ---- -apiVersion: v1 -kind: Service -metadata: - name: atlantis -spec: - ports: - - name: atlantis - port: 80 - targetPort: 4141 - selector: - app: atlantis - diff --git a/kubernetes/atlantis-persistent-storage.yaml b/kubernetes/atlantis-persistent-storage.yaml deleted file mode 100644 index 3bab45fe0..000000000 --- a/kubernetes/atlantis-persistent-storage.yaml +++ /dev/null @@ -1,88 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: atlantis - namespace: default -spec: - serviceName: atlantis - replicas: 1 - updateStrategy: - type: RollingUpdate - rollingUpdate: - partition: 0 # Automatic update - selector: - matchLabels: - app: atlantis - template: - metadata: - labels: - app: atlantis - spec: - securityContext: - fsGroup: 1000 # atlantis group (1000) read/write access to volumes - containers: - - name: atlantis - image: runatlantis/atlantis:latest - env: - - name: ATLANTIS_PORT - value: "4141" - - name: ATLANTIS_DATA_DIR - value: /atlantis - - name: ATLANTIS_GH_USER - value: your-cicd-user - - name: ATLANTIS_GH_TOKEN - valueFrom: - secretKeyRef: - name: atlantis-github - key: token - - name: ATLANTIS_GH_WEBHOOK_SECRET - valueFrom: - secretKeyRef: - name: atlantis-github - key: webhook-secret - - name: ATLANTIS_REPO_WHITELIST - value: github.com/yourorg/terraform-* - volumeMounts: - - name: atlantis-storage - mountPath: /atlantis - ports: - - name: atlantis - containerPort: 4141 - resources: - requests: - memory: 300Mi - cpu: 1000m - limits: - memory: 300Mi - cpu: 1000m - livenessProbe: - httpGet: - path: / - port: 4141 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 3 - volumeClaimTemplates: - - metadata: - name: atlantis-storage - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 5Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: atlantis -spec: - ports: - - name: atlantis - port: 80 - targetPort: 4141 - selector: - app: atlantis -