diff --git a/stable/atlantis/Chart.yaml b/stable/atlantis/Chart.yaml index a610d4a8ab..d6b6fbf58e 100644 --- a/stable/atlantis/Chart.yaml +++ b/stable/atlantis/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 -appVersion: "v0.4.11" +appVersion: "v0.6.0" description: A Helm chart for Atlantis https://www.runatlantis.io name: atlantis -version: 1.2.0 +version: 2.0.0 keywords: - terraform home: https://www.runatlantis.io diff --git a/stable/atlantis/README.md b/stable/atlantis/README.md index a2db9fbaba..097451189b 100644 --- a/stable/atlantis/README.md +++ b/stable/atlantis/README.md @@ -1,20 +1,15 @@ # Atlantis - [Atlantis](https://www.runatlantis.io/) is a tool for safe collaboration on [Terraform](https://www.terraform.io/) repositories. ## Introduction - This chart creates a single pod in a StatefulSet running Atlantis. Atlantis persists Terraform [plan files](https://www.terraform.io/docs/commands/plan.html) and [lock files](https://www.terraform.io/docs/state/locking.html) to disk for the duration of a Pull/Merge Request. These files are stored in a PersistentVolumeClaim to survive Pod failures. ## Prerequisites - - Kubernetes 1.9+ - PersistentVolume support ## Required Configuration - -In order for Atlantis to start and run successfully, all of the following must be true: - +In order for Atlantis to start and run successfully: 1. At least one of the following sets of credentials must be defined: - `github` - `gitlab` @@ -22,51 +17,55 @@ In order for Atlantis to start and run successfully, all of the following must b Refer to [values.yaml](values.yaml) for detailed examples. -1. Supply a value for `orgWhitelist`, e.g. `github.org/my_company/*`. +1. Supply a value for `orgWhitelist`, e.g. `github.org/myorg/*`. ## Customization - The following options are supported. See [values.yaml](values.yaml) for more detailed documentation and examples: -| Parameter | Description | Default | -| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -| `allowRepoConfig` | Whether to allow the use of [atlantis.yaml files](https://www.runatlantis.io/docs/atlantis-yaml-reference.html). | `false` | -| `atlantisDataStorage` | The amount of storage available for Atlantis' data directory (mostly used to check out git repositories). | `5Gi` | -| `aws.config` | Contents of a file to be mounted to `~atlantis/.aws/config`. | n/a | -| `aws.credentials` | Contents of a file to be mounted to `~atlantis/.aws/credentials`. | n/a | -| `bitbucket.user` | The name of the Atlantis Bitbucket user.,This value should not be defined if Atlantis is not working against Bitbucket repositories. | n/a | -| `bitbucket.token` | The personal access token for the Atlantis Bitbucket user.,This value should not be defined if Atlantis is not integrated with Bitbucket repositories. | n/a | -| `bitbucket.secret` | Bitbucket Server only: The webhook secret for Bitbucket repositories. | n/a | -| `bitbucket.baseUrl` | Bitbucket Server only: The hostname of your Bitbucket Server installation. | n/a | -| `environment` | Additional environment variables for the container. | n/a | -| `imagePullSecrets` | Specify a secret for pulling images from a private registry. | n/a | -| `gitconfig` | Contents of a file to be mounted to `~atlantis/.gitconfig`. Use to allow redirection for Terraform modules in private git repositories. | n/a | -| `github.user` | The name of the Atlantis GitHub user. This value should defined if Atlantis is not working against GitHub repositories. | n/a | -| `github.token` | The personal access token for the Atlantis GitHub user.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | -| `github.secret` | The repository or organization-wide secret for the Atlantis GitHub integration.,All repositories in GitHub that are to be integrated with Atlantis must share the same value.,For this reason, the Atlantis maintainers recommend an organization-scoped webhook.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | -| `github.hostname` | GitHub Enterprise only: The hostname of your GitHub Enterprise installation. | n/a | -| `gitlab.user` | The repository or organization-wide secret for the Atlantis GitLab,integration.,All repositories in GitHub that are to be integrated with,Atlantis must share the same value.,For this reason, the Atlantis,maintainers recommend an organization-scoped webhook.,This value should,not be defined if Atlantis is not integrated with GitLab repositories. | n/a | -| `gitlab.token` | The personal access token for the Atlantis GitHub user.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | -| `gitlab.secret` | The repository secret for the Atlantis GitLab integration.,All repositories in GitLab that are to be integrated with,Atlantis must share the same value.,(Unlike GitHub, GitLab does not support organization-wide integrations.) | n/a | -| `gitlab.hostname` | GitLab Enterprise only: The hostname of your GitLab Enterprise installation. | n/a | -| `podTemplate.annotations` | Specifies additional annotations to use for the StatefulSet | n/a | -| `logLevel` | The level to use for logging. | n/a | -| `orgWhiteList` | A whitelist of repositories from which Atlantis will accept webhooks. **This value must be changed for Atlantis to function correctly.** Accepts wildcard characters (`*`). Multiple values may be comma-separated. | `github.com/yourorg/*` | -| `requireApproval` | Whether to require pull request approval prior to applies. See [Approved Requirement](https://www.runatlantis.io/docs/apply-requirements.html#approved). | `false` | -| `requireMergeable` | Whether to require pull request to meet repository mergeability requirements prior to applies. See [Approved Requirement](https://www.runatlantis.io/docs/apply-requirements.html#mergeable). | `false` | -| `serviceAccount.create` | Whether to create a Kubernetes ServiceAccount if no account matching `serviceAccount.name` exists. | `true` | -| `serviceAccount.name` | The name of the Kubernetes ServiceAccount under which Atlantis should run.

If no value is specified and `serviceAccount.create` is `true`, Atlantis will be run under a ServiceAccount whose name is the FullName of the Helm chart's instance.

If no value is specified and `serviceAccount.create` is `false`, Atlantis will be run under the `default` ServiceAccount. | n/a | -| `serviceAccountSecrets.credentials` | JSON object representing secrets for a Google Cloud Platform production service account. Only applicable if hosting Atlantis on GKE. | n/a | -| `serviceAccountSecrets.credentials-staging` | JSON object representing secrets for a Google Cloud Platform staging,service account. Only applicable if hosting Atlantis on GKE. | n/a | -| `service.port` | Specifies the port of the service. | `80` | -| `service.loadBalancerSourceRanges` | An array of whitelisted IP addresses for the Atlantis Service in Kubernetes. If no value is specified, the Service will allow incoming traffic from all IP addresses (0.0.0.0/0). | n/a | -| `storageClassName` | Storage class of the volume mounted for the Atlantis data directory. | n/a | -| `tlsSecretName` | The name of a Kubernetes Secret for Atlantis' HTTPS certificate containing the following data items `tls.crt` with the public certificate and `tls.key` with the private key. | n/a | - +| Parameter | Description | Default | +|---------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------| +| `allowRepoConfig` | Whether to allow the use of [atlantis.yaml files](https://www.runatlantis.io/docs/atlantis-yaml-reference.html). | `false` | +| `dataStorage` | Amount of storage available for Atlantis' data directory (mostly used to check out git repositories). | `5Gi` | +| `aws.config` | Contents of a file to be mounted to `~/.aws/config`. | n/a | +| `aws.credentials` | Contents of a file to be mounted to `~/.aws/credentials`. | n/a | +| `bitbucket.user` | Name of the Atlantis Bitbucket user. | n/a | +| `bitbucket.token` | Personal access token for the Atlantis Bitbucket user. | n/a | +| `bitbucket.secret` | Webhook secret for Bitbucket repositories (Bitbucket Server only). | n/a | +| `bitbucket.baseURL` | Base URL of Bitbucket Server installation. | n/a | +| `environment` | Map of environment variables for the container. | `{}` | +| `imagePullSecrets` | List of secrets for pulling images from private registries. | `[]` | +| `gitconfig` | Contents of a file to be mounted to `~/.gitconfig`. Use to allow redirection for Terraform modules in private git repositories. | n/a | +| `github.user` | Name of the Atlantis GitHub user. | n/a | +| `github.token` | Personal access token for the Atlantis GitHub user. | n/a | +| `github.secret` | Repository or organization-wide webhook secret for the Atlantis GitHub integration. All repositories in GitHub that are to be integrated with Atlantis must share the same value. | n/a | +| `github.hostname` | Hostname of your GitHub Enterprise installation. | n/a | +| `gitlab.user` | Repository or organization-wide secret for the Atlantis GitLab,integration. All repositories in GitLab that are to be integrated with Atlantis must share the same value. | n/a | +| `gitlab.token` | Personal access token for the Atlantis GitLab user. | n/a | +| `gitlab.secret` | Webhook secret for the Atlantis GitLab integration. All repositories in GitLab that are to be integrated with Atlantis must share the same value. | n/a | +| `gitlab.hostname` | Hostname of your GitLab Enterprise installation. | n/a | +| `podTemplate.annotations` | Additional annotations to use for the StatefulSet. | n/a | +| `logLevel` | Level to use for logging. Either debug, info, warn, or error. | n/a | +| `orgWhiteList` | Whitelist of repositories from which Atlantis will accept webhooks. **This value must be set for Atlantis to function correctly.** Accepts wildcard characters (`*`). Multiple values may be comma-separated. | none | +| `requireApproval` | Whether to require pull request approval prior to applies. See [Approved Requirement](https://www.runatlantis.io/docs/apply-requirements.html#approved). | `false` | +| `requireMergeable` | Whether to require pull request to be mergeable prior to applies. See [Mergeable Requirement](https://www.runatlantis.io/docs/apply-requirements.html#mergeable). | `false` | +| `serviceAccount.create` | Whether to create a Kubernetes ServiceAccount if no account matching `serviceAccount.name` exists. | `true` | +| `serviceAccount.name` | Name of the Kubernetes ServiceAccount under which Atlantis should run. If no value is specified and `serviceAccount.create` is `true`, Atlantis will be run under a ServiceAccount whose name is the FullName of the Helm chart's instance, else Atlantis will be run under the `default` ServiceAccount. | n/a | +| `serviceAccountSecrets.credentials` | JSON string representing secrets for a Google Cloud Platform production service account. Only applicable if hosting Atlantis on GKE. | n/a | +| `serviceAccountSecrets.credentials-staging` | JSON string representing secrets for a Google Cloud Platform staging service account. Only applicable if hosting Atlantis on GKE. | n/a | +| `service.port` | Port of the `Service`. | `80` | +| `service.loadBalancerSourceRanges` | Array of whitelisted IP addresses for the Atlantis Service. If no value is specified, the Service will allow incoming traffic from all IP addresses (0.0.0.0/0). | n/a | +| `storageClassName` | Storage class of the volume mounted for the Atlantis data directory. | n/a | +| `tlsSecretName` | Name of a Secret for Atlantis' HTTPS certificate containing the following data items `tls.crt` with the public certificate and `tls.key` with the private key. | n/a | +## Upgrading +### From 1.* to 2.* +* The following value names have changed: + * `allow_repo_config` => `allowRepoConfig` + * `atlantis_data_storage` => `dataStorage` **NOTE: more than just a snake_case change** + * `atlantis_data_storageClass` => `storageClassName` **NOTE: more than just a snake_case change** + * `bitbucket.base_url` => `bitbucket.baseURL` ## Testing the Deployment - To perform a smoke test of the deployment (i.e. ensure that the Atlantis UI is up and running): 1. Install the chart. Supply your own values file or use `test-values.yaml`, which has a minimal set of values required in order for Atlantis to start. diff --git a/stable/atlantis/templates/statefulset.yaml b/stable/atlantis/templates/statefulset.yaml index 41513303fc..afb6b79e02 100644 --- a/stable/atlantis/templates/statefulset.yaml +++ b/stable/atlantis/templates/statefulset.yaml @@ -51,6 +51,12 @@ spec: secret: secretName: {{ template "atlantis.fullname" . }}-aws {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" @@ -141,9 +147,9 @@ spec: secretKeyRef: name: {{ template "atlantis.fullname" . }}-webhook key: bitbucket_token - {{- if .Values.bitbucket.baseUrl }} + {{- if .Values.bitbucket.baseURL }} - name: ATLANTIS_BITBUCKET_BASE_URL - value: {{ .Values.bitbucket.baseUrl }} + value: {{ .Values.bitbucket.baseURL }} - name: ATLANTIS_BITBUCKET_WEBHOOK_SECRET valueFrom: secretKeyRef: @@ -193,12 +199,12 @@ spec: {{- end }} {{- if .Values.gitconfig}} - name: gitconfig-volume - readonly: true + readOnly: true mountPath: /etc/secret-gitconfig {{- end }} {{- if .Values.aws}} - name: aws-volume - readonly: true + readOnly: true mountPath: /home/atlantis/.aws {{- end }} {{- if .Values.tlsSecretName }} @@ -206,10 +212,6 @@ spec: mountPath: /etc/tls/ {{- end }} resources: - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - - name: {{ .Values.imagePullSecrets }} - {{- end }} {{ toYaml .Values.resources | indent 12 }} {{- with .Values.nodeSelector }} nodeSelector: @@ -235,4 +237,4 @@ spec: requests: # The biggest thing Atlantis stores is the Git repo when it checks it out. # It deletes the repo after the pull request is merged. - storage: {{ .Values.atlantisDataStorage }} + storage: {{ .Values.dataStorage }} diff --git a/stable/atlantis/values.yaml b/stable/atlantis/values.yaml index 5b8f7d1ef8..6fb8f07eee 100644 --- a/stable/atlantis/values.yaml +++ b/stable/atlantis/values.yaml @@ -7,7 +7,7 @@ # atlantisUrl: http://10.0.0.0 # Replace this with your own repo whitelist: -orgWhitelist: github.com/yourorg/* +orgWhitelist: # logLevel: "debug" # If using GitHub, specify like the following: @@ -40,7 +40,7 @@ orgWhitelist: github.com/yourorg/* # When referencing Terraform modules in private repositories, it may be helpful # (necessary?) to use redirection in a .gitconfig like so: -# gitconfig: +# gitconfig: | # [url "https://YOUR_GH_TOKEN@github.com"] # insteadOf = https://github.com # [url "https://YOUR_GH_TOKEN@github.com"] @@ -75,9 +75,16 @@ serviceAccountSecrets: image: repository: runatlantis/atlantis - tag: v0.4.13 + tag: v0.6.0 pullPolicy: IfNotPresent +## Optionally specify an array of imagePullSecrets. +## Secrets must be manually created in the namespace. +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +## +# imagePullSecrets: +# - myRegistryKeySecretName + ## enable using atlantis.yaml file allowRepoConfig: false @@ -138,7 +145,7 @@ resources: cpu: 100m # Disk space for Atlantis to check out repositories -atlantisDataStorage: 5Gi +dataStorage: 5Gi replicaCount: 1