#atlantis (2021-03)

There’s gotta be an XKCD that applies here

yeh i thought as much but just wanted to double check

No

you would be fine on some changes, but cannot lobotomize itself.

that sounds accurate

Yup, I did that extensively Worked pretty well with the ECS on Fargate Terraform module

I also manage atlantis in terraform/terragrunt. It works pretty well, as when the terraform applies it just updates my autoscaling group, it doesn’t actually kill my old server.

@Vlad Ionescu (he/him) i use the ECS on Fargate module as well

what module is this?

https://github.com/terraform-aws-modules/terraform-aws-atlantis

https://github.com/terraform-aws-modules/terraform-aws-atlantis

It’s a great one. I made some very small edits to turn it into an autoscaling EC2 cluster because I can attach more storage, but I’m not sure if fargate ever got around to allowing over 10gb or not

you will be fine until you delete the webhook lol

but I did applied Atlantis to Atlantis

what happens when you delete the webhook?

next apply just will not happen

the webbhook ot github app is the way Atlantis know about the changes

gotcha

yeh we don’t delete them

we only add nowadays

Also, there’s conceivably 2 SDLCs here. There’s the module for atlantis, and the docker image for atlantis.

Our terraform-aws-atlantis module handles the latter

yes that is because the atlantis user does not have admin rights on the ORG or repo to read and manage webhooks

I think this is all repo config, there is a PR for docs you can check

Cool, ta

i can’t wait for this to arrive its going to be

Are you using OPA/conftest @Steve Wade (swade1987)?

yes we use it lots

both in CI for our k8s repos as well as inside k8s using gatekeeper

What kinda things for? Anything particularly interesting? We’ve got allowed actions on resource types check, i.e cannot delete a production DDB, checking expected tags are all set on all taggable resources, make sure IAM roles have permissions_boundaries attached…

https://github.com/Scalr/sample-tf-opa-policies is

i wrote and maintain https://github.com/swade1987/deprek8ion

Sweet, makes sense

we have a few more at work but they are all private repos

Aye

there was yes

i found it its still a PR

but we can’t get people to work on it

this is the recommended way

I never enabled automerge before

maybe thats my issue

I do not know gitlab that well but in github you can do approvers list etc to that requires someone to approve before is merged

yeh we have that

i think the issue might be the auto merge

it could be

Make your precommit check required before merging

Then it’s impossible to merge while it is running

i added it to my gitignore

That works @loren was talking to me about terraform-bundle as well as an option

Can 0.14 read 0.13 state and vice versa?

tf lock files get commited to source control, terragrunt bubbles them up, so just add as we go

Have been bitten by a few surprises before

0.14 can read 0.13, not the other way around

0.14 forward should be backwards compat IIRC

(although they may have backported)

The issue with the lock files is we don’t want to (plus we won’t remember to) run terraform init constantly for each directory

Also keep in mind that the lock files are architecture dependent

(I see developers running terraform on their Mac workstations and subsequently committing these files, which has no impact since Atlantis is usually running on Linux). Of course using geodesic locally would mitigate that :-)

Good luck I’m running a beast these days (also running from Docker so)

terraform providers lock -platform=windows_amd64 -platform=darwin_amd64 -platform=linux_amd64

will generate a lock file for all 3 platforms