diff --git a/stable/atlantis/.helmignore b/stable/atlantis/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/atlantis/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/atlantis/Chart.yaml b/stable/atlantis/Chart.yaml new file mode 100644 index 0000000000..6c59e166bd --- /dev/null +++ b/stable/atlantis/Chart.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +appVersion: "v0.4.11" +description: A Helm chart for Atlantis https://www.runatlantis.io +name: atlantis +version: 1.0.0 +keywords: +- terraform +home: https://www.runatlantis.io +icon: https://www.runatlantis.io/hero.png +sources: +- https://github.com/runatlantis/atlantis +maintainers: +- name: jkodroff +- name: callmeradical +- name: jeff-knurek +- name: lkysow diff --git a/stable/atlantis/OWNERS b/stable/atlantis/OWNERS new file mode 100644 index 0000000000..8e1ed1f60d --- /dev/null +++ b/stable/atlantis/OWNERS @@ -0,0 +1,12 @@ +approvers: +- jkodroff +- callmeradical +- lkysow +- jeff-knurek +- sstarcher +reviewers: +- jkodroff +- callmeradical +- lkysow +- jeff-knurek +- sstarcher \ No newline at end of file diff --git a/stable/atlantis/README.md b/stable/atlantis/README.md new file mode 100644 index 0000000000..39e6c481a0 --- /dev/null +++ b/stable/atlantis/README.md @@ -0,0 +1,69 @@ +# Atlantis + +[Atlantis](https://www.runatlantis.io/) is a tool for safe collaboration on [Terraform](https://www.terraform.io/) repositories. + +## Introduction + +This chart creates a single pod in a StatefulSet running Atlantis. Atlantis persists Terraform [plan files](https://www.terraform.io/docs/commands/plan.html) and [lock files](https://www.terraform.io/docs/state/locking.html) to disk for the duration of a Pull/Merge Request. These files are stored in a PersistentVolumeClaim to survive Pod failures. + +## Prerequisites + +- Kubernetes 1.9+ +- PersistentVolume support + +## Required Configuration + +In order for Atlantis to start and run successfully, all of the following must be true: + +1. At least one of the following sets of credentials must be defined: + - `github` + - `gitlab` + - `bitbucket` + + Refer to [values.yaml](values.yaml) for detailed examples. + +1. Supply a value for `orgWhitelist`, e.g. `github.org/my_company/*`. + +## Customization + +The following options are supported. See [values.yaml](values.yaml) for more detailed documentation and examples: + +| Parameter | Description | Default | +| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | +| `allow_repo_config` | Whether to allow the use of [atlantis.yaml files](https://www.runatlantis.io/docs/atlantis-yaml-reference.html). | `false` | +| `atlantis_data_storage` | The amount of storage available for Atlantis' data directory (mostly used to check out git repositories). | `5Gi` | +| `aws.config` | Contents of a file to be mounted to `~atlantis/.aws/config`. | n/a | +| `aws.credentials` | Contents of a file to be mounted to `~atlantis/.aws/credentials`. | n/a | +| `bitbucket.user` | The name of the Atlantis Bitbucket user.,This value should not be defined if Atlantis is not working against Bitbucket repositories. | n/a | +| `bitbucket.token` | The personal access token for the Atlantis Bitbucket user.,This value should not be defined if Atlantis is not integrated with Bitbucket repositories. | n/a | +| `bitbucket.secret` | Bitbucket Server only: The webhook secret for Bitbucket repositories. | n/a | +| `bitbucket.base_url` | Bitbucket Server only: The hostname of your Bitbucket Server installation. | n/a | +| `gitconfig` | Contents of a file to be mounted to `~atlantis/.gitconfig`. Use to allow redirection for Terraform modules in private git repositories. | n/a | +| `github.user` | The name of the Atlantis GitHub user. This value should defined if Atlantis is not working against GitHub repositories. | n/a | +| `github.token` | The personal access token for the Atlantis GitHub user.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | +| `github.secret` | The repository or organization-wide secret for the Atlantis GitHub integration.,All repositories in GitHub that are to be integrated with Atlantis must share the same value.,For this reason, the Atlantis maintainers recommend an organization-scoped webhook.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | +| `github.hostname` | GitHub Enterprise only: The hostname of your GitHub Enterprise installation. | n/a | +| `gitlab.user` | The repository or organization-wide secret for the Atlantis GitLab,integration.,All repositories in GitHub that are to be integrated with,Atlantis must share the same value.,For this reason, the Atlantis,maintainers recommend an organization-scoped webhook.,This value should,not be defined if Atlantis is not integrated with GitLab repositories. | n/a | +| `gitlab.token` | The personal access token for the Atlantis GitHub user.,This value should not be defined if Atlantis is not integrated with GitHub repositories. | n/a | +| `gitlab.secret` | The repository secret for the Atlantis GitLab integration.,All repositories in GitLab that are to be integrated with,Atlantis must share the same value.,(Unlike GitHub, GitLab does not support organization-wide integrations.) | n/a | +| `gitlab.hostname` | GitLab Enterprise only: The hostname of your GitLab Enterprise installation. | n/a | +| `orgWhiteList` | A whitelist of repositories from which Atlantis will accept webhooks. **This value must be changed for Atlantis to function correctly.** Accepts wildcard characters (`*`). Multiple values may be comma-separated. | `github.com/yourorg/*` | +| `serviceAccount.create` | Whether to create a Kubernetes ServiceAccount if no account matching `serviceAccount.name` exists. | `true` | +| `serviceAccount.name` | The name of the Kubernetes ServiceAccount under which Atlantis should run.

If no value is specified and `serviceAccount.create` is `true`, Atlantis will be run under a ServiceAccount whose name is the FullName of the Helm chart's instance.

If no value is specified and `serviceAccount.create` is `false`, Atlantis will be run under the `default` ServiceAccount. | n/a | +| `serviceAccountSecrets.credentials` | JSON object representing secrets for a Google Cloud Platform production service account. Only applicable if hosting Atlantis on GKE. | n/a | +| `serviceAccountSecrets.credentials-staging` | JSON object representing secrets for a Google Cloud Platform staging,service account. Only applicable if hosting Atlantis on GKE. | n/a | + +## Testing the Deployment + +To perform a smoke test of the deployment (i.e. ensure that the Atlantis UI is up and running): + +1. Install the chart. Supply your own values file or use `test-values.yaml`, which has a minimal set of values required in order for Atlantis to start. + + ```bash + helm install -f test-values.yaml --name my-atlantis stable/atlantis --debug + ``` + +1. Run the tests: + ```bash + helm test my-atlantis + ``` diff --git a/stable/atlantis/ci/ci-values.yaml b/stable/atlantis/ci/ci-values.yaml new file mode 100644 index 0000000000..a86821360a --- /dev/null +++ b/stable/atlantis/ci/ci-values.yaml @@ -0,0 +1,5 @@ +--- +github: + user: foo + token: bar + secret: baz diff --git a/stable/atlantis/templates/NOTES.txt b/stable/atlantis/templates/NOTES.txt new file mode 100644 index 0000000000..9195340ebc --- /dev/null +++ b/stable/atlantis/templates/NOTES.txt @@ -0,0 +1,23 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "atlantis.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "atlantis.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "atlantis.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "atlantis.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:80 +{{- end }} +2. Atlantis will not start successfully unless at least one of the following sets of credentials are specified (see values.yaml for detailed usage): + - github + - gitlab + - bitbucket \ No newline at end of file diff --git a/stable/atlantis/templates/_helpers.tpl b/stable/atlantis/templates/_helpers.tpl new file mode 100644 index 0000000000..e0797908b8 --- /dev/null +++ b/stable/atlantis/templates/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "atlantis.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "atlantis.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "atlantis.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "atlantis.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "atlantis.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/stable/atlantis/templates/ingress.yaml b/stable/atlantis/templates/ingress.yaml new file mode 100644 index 0000000000..b2c73969a7 --- /dev/null +++ b/stable/atlantis/templates/ingress.yaml @@ -0,0 +1,29 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "atlantis.fullname" . -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: +{{ toYaml .Values.ingress.tls | indent 4 }} +{{- end }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: {{ .Values.ingress.path }} + backend: + serviceName: {{ $fullName }} + servicePort: 4141 +{{- end }} diff --git a/stable/atlantis/templates/secret-aws.yaml b/stable/atlantis/templates/secret-aws.yaml new file mode 100644 index 0000000000..0a41f08f01 --- /dev/null +++ b/stable/atlantis/templates/secret-aws.yaml @@ -0,0 +1,14 @@ +{{- if .Values.aws}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "atlantis.fullname" . }}-aws + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + credentials: {{ .Values.aws.credentials | b64enc }} + config: {{ .Values.aws.config | b64enc }} +{{- end }} \ No newline at end of file diff --git a/stable/atlantis/templates/secret-gitconfig.yaml b/stable/atlantis/templates/secret-gitconfig.yaml new file mode 100644 index 0000000000..7fcc829fa2 --- /dev/null +++ b/stable/atlantis/templates/secret-gitconfig.yaml @@ -0,0 +1,13 @@ +{{- if .Values.gitconfig}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "atlantis.fullname" . }}-gitconfig + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + gitconfig: {{ .Values.gitconfig | b64enc }} +{{- end }} \ No newline at end of file diff --git a/stable/atlantis/templates/secret-service-account.yaml b/stable/atlantis/templates/secret-service-account.yaml new file mode 100644 index 0000000000..5a9fddb948 --- /dev/null +++ b/stable/atlantis/templates/secret-service-account.yaml @@ -0,0 +1,16 @@ +{{- $all := . -}} +{{ range $name, $secret := .Values.serviceAccountSecrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $name }} + labels: + app: {{ $name }} + chart: {{ template "atlantis.chart" $all }} + component: service-account-secret + heritage: {{ $all.Release.Service }} + release: {{ $all.Release.Name }} +data: + service-account.json: {{ $secret }} +--- +{{ end }} \ No newline at end of file diff --git a/stable/atlantis/templates/secret-webhook.yaml b/stable/atlantis/templates/secret-webhook.yaml new file mode 100644 index 0000000000..0ca10ee845 --- /dev/null +++ b/stable/atlantis/templates/secret-webhook.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "atlantis.fullname" . }}-webhook + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + {{- if .Values.github }} + github_token: {{ required "github.token is required if github configuration is specified." .Values.github.token | b64enc }} + github_secret: {{ required "github.secret is required if github configuration is specified." .Values.github.secret | b64enc }} + {{- end}} + {{- if .Values.gitlab }} + gitlab_token: {{ required "gitlab.token is required if gitlab configuration is specified." .Values.gitlab.token | b64enc }} + gitlab_secret: {{ required "gitlab.secret is required if gitlab configuration is specified." .Values.gitlab.secret | b64enc }} + {{- end}} + {{- if .Values.bitbucket }} + bitbucket_token: {{ required "bitbucket.token is required if bitbucket configuration is specified." .Values.bitbucket.token | b64enc }} + {{- if .Values.bitbucket.base_url }} + bitbucket_secret: {{ required "bitbucket.secret is required if bitbucket.baseurl is specified." .Values.bitbucket.secret | b64enc }} + {{- end}} + {{- end }} diff --git a/stable/atlantis/templates/service.yaml b/stable/atlantis/templates/service.yaml new file mode 100644 index 0000000000..ebe095613c --- /dev/null +++ b/stable/atlantis/templates/service.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "atlantis.fullname" . }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.service.annotations }} + annotations: +{{ toYaml . | indent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + template: + metadata: +{{- with .Values.podTemplate.annotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} + ports: + - port: {{ .Values.service.port }} + targetPort: 4141 + protocol: TCP + name: atlantis + selector: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} diff --git a/stable/atlantis/templates/serviceaccount.yaml b/stable/atlantis/templates/serviceaccount.yaml new file mode 100644 index 0000000000..7a079d13a6 --- /dev/null +++ b/stable/atlantis/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "atlantis.serviceAccountName" . }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end -}} diff --git a/stable/atlantis/templates/statefulset.yaml b/stable/atlantis/templates/statefulset.yaml new file mode 100644 index 0000000000..ee49cd5001 --- /dev/null +++ b/stable/atlantis/templates/statefulset.yaml @@ -0,0 +1,197 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "atlantis.fullname" . }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.statefulSet.annotations }} + annotations: +{{ toYaml . | indent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} + spec: + serviceAccountName: {{ template "atlantis.serviceAccountName" . }} + securityContext: + fsGroup: 1000 + volumes: + {{- range $name, $_ := .Values.serviceAccountSecrets }} + - name: {{ $name }}-volume + secret: + secretName: {{ $name }} + {{- end }} + {{- if .Values.gitconfig }} + - name: gitconfig-volume + secret: + secretName: {{ template "atlantis.fullname" . }}-gitconfig + {{- end }} + {{- if .Values.aws }} + - name: aws-volume + secret: + secretName: {{ template "atlantis.fullname" . }}-aws + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.gitconfig }} + lifecycle: + postStart: + exec: + command: ["/bin/sh", "-c", "cp /etc/secret-gitconfig/gitconfig /home/atlantis/.gitconfig && chown atlantis /home/atlantis/.gitconfig"] + {{- end}} + cmd: atlantis + args: + - server + {{- if .Values.allowRepoConfig }} + - --allow-repo-config + {{- end }} + ports: + - name: atlantis + containerPort: 4141 + env: + - name: ATLANTIS_DATA_DIR + value: /atlantis-data + - name: ATLANTIS_REPO_WHITELIST + value: {{ .Values.orgWhitelist }} + - name: ATLANTIS_PORT + value: "4141" + {{- if .Values.atlantisUrl }} + - name: ATLANTIS_ATLANTIS_URL + value: {{ .Values.atlantisUrl }} + {{- else if .Values.ingress.enabled }} + - name: ATLANTIS_ATLANTIS_URL + value: http://{{ .Values.ingress.host }} + {{- end }} + {{- if .Values.github }} + - name: ATLANTIS_GH_USER + value: {{ required "github.user is required if github configuration is specified." .Values.github.user }} + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.fullname" . }}-webhook + key: github_token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.fullname" . }}-webhook + key: github_secret + {{- if .Values.github.hostname }} + - name: ATLANTIS_GH_HOSTNAME + value: {{ .Values.github.hostname }} + {{- end }} + {{- end}} + {{- if .Values.gitlab }} + - name: ATLANTIS_GITLAB_USER + value: {{ required "gitlab.user is required if gitlab configuration is specified." .Values.gitlab.user }} + - name: ATLANTIS_GITLAB_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: gitlab_token + - name: ATLANTIS_GITLAB_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.fullname" . }}-webhook + key: gitlab_secret + {{- if .Values.gitlab.hostname }} + - name: ATLANTIS_GITLAB_HOSTNAME + value: {{ .Values.gitlab.hostname }} + {{- end }} + {{- end}} + {{- if .Values.bitbucket }} + - name: ATLANTIS_BITBUCKET_USER + value: {{ required "bitbucket.user is required if bitbucket configuration is specified." .Values.bitbucket.user }} + - name: ATLANTIS_BITBUCKET_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.fullname" . }}-webhook + key: bitbucket_token + {{- if .Values.bitbucket.base_url }} + - name: ATLANTIS_BITBUCKET_BASE_URL + value: {{ .Values.bitbucket.base_url }} + - name: ATLANTIS_BITBUCKET_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.fullname" . }}-webhook + key: bitbucket_secret + {{- end }} + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /healthz + port: 4141 + scheme: {{ .Values.livenessProbe.scheme }} + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /healthz + port: 4141 + scheme: {{ .Values.readinessProbe.scheme }} + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + volumeMounts: + - name: atlantis-data + mountPath: /atlantis-data + {{- range $name, $_ := .Values.serviceAccountSecrets }} + - name: {{ $name }}-volume + readOnly: true + mountPath: /etc/{{ $name }} + {{- end }} + {{- if .Values.gitconfig}} + - name: gitconfig-volume + readonly: true + mountPath: /etc/secret-gitconfig + {{- end }} + {{- if .Values.aws}} + - name: aws-volume + readonly: true + mountPath: /home/atlantis/.aws + {{- end }} + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + volumeClaimTemplates: + - metadata: + name: atlantis-data + spec: + accessModes: ["ReadWriteOnce"] # Volume should not be shared by multiple nodes. + resources: + requests: + # The biggest thing Atlantis stores is the Git repo when it checks it out. + # It deletes the repo after the pull request is merged. + storage: {{ .Values.atlantis_data_storage }} \ No newline at end of file diff --git a/stable/atlantis/templates/tests/test-atlantis-configmap.yaml b/stable/atlantis/templates/tests/test-atlantis-configmap.yaml new file mode 100644 index 0000000000..5c1f51f695 --- /dev/null +++ b/stable/atlantis/templates/tests/test-atlantis-configmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "atlantis.fullname" . }}-tests +data: + run.sh: |- + @test "Atlantis UI is available" { + ATLANTIS_URL=http://{{ template "atlantis.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }} + echo "Trying Atlantis at: $ATLANTIS_URL" + curl $ATLANTIS_URL + } diff --git a/stable/atlantis/templates/tests/test-atlantis-pod.yaml b/stable/atlantis/templates/tests/test-atlantis-pod.yaml new file mode 100644 index 0000000000..7f3ac476dc --- /dev/null +++ b/stable/atlantis/templates/tests/test-atlantis-pod.yaml @@ -0,0 +1,37 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ .Release.Name }}-ui-test-{{ randAlphaNum 5 | lower }}" + annotations: + "helm.sh/hook": test-success +spec: + initContainers: + - name: test-framework + image: dduportal/bats:0.4.0 + command: + - "bash" + - "-c" + - | + set -ex + # copy bats to tools dir + cp -R /usr/local/libexec/ /tools/bats/ + volumeMounts: + - mountPath: /tools + name: tools + containers: + - name: {{ .Release.Name }}-ui-test + image: {{ .Values.test.image }}:{{ .Values.test.imageTag }} + command: ["/tools/bats/bats", "-t", "/tests/run.sh"] + volumeMounts: + - mountPath: /tests + name: tests + readOnly: true + - mountPath: /tools + name: tools + volumes: + - name: tests + configMap: + name: {{ template "atlantis.fullname" . }}-tests + - name: tools + emptyDir: {} + restartPolicy: Never diff --git a/stable/atlantis/test-values.yaml b/stable/atlantis/test-values.yaml new file mode 100644 index 0000000000..aa75734af8 --- /dev/null +++ b/stable/atlantis/test-values.yaml @@ -0,0 +1,23 @@ +# In order to Atlantis to start, it must have at least one source control +# provider configured. However, we do not want to define a default in +# values.yaml as this would require all users of this chart who are not using +# GitHub to override the value. +github: + user: foo + token: bar + secret: baz + +service: + annotations: + serviceAnnotation1: value1 + serviceAnnotation2: value2 + +podTemplate: + annotations: + podTemplateAnnotation1: value3 + podTemplateAnnotation2: value4 + +statefulSet: + annotations: + statefulSetAnnotation1: value5 + statefulSetAnnotation2: value6 \ No newline at end of file diff --git a/stable/atlantis/values.yaml b/stable/atlantis/values.yaml new file mode 100644 index 0000000000..100417debf --- /dev/null +++ b/stable/atlantis/values.yaml @@ -0,0 +1,154 @@ +## -------------------------- ## +# Values to override for your instance. +## -------------------------- ## + +## An option to override the atlantis url, +## if not using an ingress, set it to the external IP. +# atlantisUrl: http://10.0.0.0 + +# Replace this with your own repo whitelist: +orgWhitelist: github.com/yourorg/* + +# If using GitHub, specify like the following: +# github: +# user: foo +# token: bar +# secret: baz +# GitHub Enterprise only: +# hostname: github.your.org +# (The chart will perform the base64 encoding for you for values that are stored in secrets.) + +# If using GitLab, specify like the following: +# gitlab: +# user: foo +# token: bar +# secret: baz +# GitLab Enterprise only: +# hostname: gitlab.your.org +# (The chart will perform the base64 encoding for you for values that are stored in secrets.) + +# If using Bitbucket, specify like the following: +# bitbucket: +# user: foo +# token: bar +# Bitbucket Server only: +# secret: baz +# base_url: https://bitbucket.yourorganization.com +# (The chart will perform the base64 encoding for you for values that are stored in secrets.) + + +# When referencing Terraform modules in private repositories, it may be helpful +# (necessary?) to use redirection in a .gitconfig like so: +# gitconfig: + # [url "https://YOUR_GH_TOKEN@github.com"] + # insteadOf = https://github.com + # [url "https://YOUR_GH_TOKEN@github.com"] + # insteadOf = ssh://git@github.com + # [url "https://oauth2:YOUR_GITLAB_TOKEN@gitlab.com"] + # insteadOf = https://gitlab.com + # [url "https://oauth2:YOUR_GITLAB_TOKEN@gitlab.com"] + # insteadOf = ssh://git@gitlab.com +# Source: https://stackoverflow.com/questions/42148841/github-clone-with-oauth-access-token + +# To specify AWS credentials to be mapped to ~/.aws: +# aws: +# credentials: | +# [default] +# aws_access_key_id=YOUR_ACCESS_KEY_ID +# aws_secret_access_key=YOUR_SECRET_ACCESS_KEY +# region=us-east-1 +# config: | +# [profile a_role_to_assume] +# role_arn = arn:aws:iam::123456789:role/service-role/roleToAssume +# source_profile = default + +## To be used for mounting credential files (when using google provider). +serviceAccountSecrets: + # credentials: + # credentials-staging: + + +## -------------------------- ## +# Default values for atlantis (override as needed). +## -------------------------- ## + +image: + repository: runatlantis/atlantis + tag: v0.4.11 + pullPolicy: IfNotPresent + +## enable using atlantis.yaml file +allowRepoConfig: false + +# We only need to check every 60s since Atlantis is not a high-throughput service. +livenessProbe: + enabled: true + periodSeconds: 60 + initialDelaySeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + scheme: HTTP +readinessProbe: + enabled: true + periodSeconds: 60 + initialDelaySeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + scheme: HTTP + +service: + type: NodePort + port: 80 + +podTemplate: + annotations: {} + # kube2iam example: + # iam.amazonaws.com/role: role-arn + +statefulSet: + annotations: {} + +ingress: + enabled: true + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + host: chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + requests: + memory: 1Gi + cpu: 100m + limits: + memory: 1Gi + cpu: 100m + +# Disk space for Atlantis to check out repositories +atlantis_data_storage: 5Gi + +replicaCount: 1 + +## test container details +test: + image: lachlanevenson/k8s-kubectl + imageTag: v1.4.8-bash + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: