#townhall (2018-10)

@mallen has joined the channel

@Steven has joined the channel

wanted to ask about how things were going with CP and Atlantis

There are two hard blockers for using it:

1) https://github.com/runatlantis/atlantis/issues/249 (no response) - to support multiple instances of atlantis in diffferent accounts

2) no way to scope who can run plan or apply other than revoking access to repo

awesome name @tamsky

for 2) you’d like to see github groups perform RBAC ?

i would be satisfied with a hardcoded list of usernames in the server

groups would be icing

I’m really enjoying https://github.com/kislyuk/keymaker - and IAM groups <> UNIX groups

both of those blockers read to me as accurate and missing requirements. I could imagine bypassing 2) by having two Atlantis’s per stage, one RO other R+W.

Perhaps, but how would you scope the access to the r/w and r/o pipelines?

at the oauth proxy?

oh, but all the interaction is via git comments

so what we really need is the google/kubernetes repo bot commands like

ok to test

then I deserve a “whoops”

so i think technically, not too hard to extend

basically, validate git username is in some list

otherwise comment back and say not authorized

i’ve debated if we want to commit the resources to fix 1 & 2

we may just end up using codefresh for v1

prove the concept out

for example, with Zapier, i can act on a comment and trigger a pipeline via webhook

i go back and forth with atlantis b/c we still need to solve the same problem with kops and helm (not just terraform)

so i want a strategy that works well for all 3

@tamsky this was opened/closed today https://github.com/runatlantis/atlantis/pull/306/files

Addresses (1)

@ankur has joined the channel

@Gabe has joined the channel

@Raghu has joined the channel

@Gaurav has joined the channel