Add runatlantis

atlantis.yaml

@@ -0,0 +1,5 @@
+version: 3
+projects:
+- dir: .
+  autoplan:
+    when_modified: ["manifests/**/*.yaml", "*.tf*", "manifests/**.yaml"]

manifests/kustomization.yaml

@@ -7,3 +7,4 @@ bases:
 - cert-manager
 - day2-tech-nl-redirect
 - day2meet-com-redirect
+- runatlantis

manifests/runatlantis/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespace.yaml
+- runatlantis.yaml
+- secret.yaml
+
+namespace: runatlantis
+
+commonLabels:
+  app: runatlantis

manifests/runatlantis/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: runatlantis

manifests/runatlantis/runatlantis.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: atlantis
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+      - name: atlantis
+        image: runatlantis/atlantis:v0.12.0
+        env:
+        - name: ATLANTIS_REPO_WHITELIST
+          value: github.com/day2tech/* 
+        ### GitHub Config ###
+        - name: ATLANTIS_GH_USER
+          value: day2bot
+        - name: ATLANTIS_GH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: atlantis-vcs
+              key: token
+        - name: ATLANTIS_GH_WEBHOOK_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: atlantis-vcs
+              key: webhook-secret
+        ### End GitHub Config ###
+        - name: DIGITALOCEAN_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: atlantis-vcs
+              key: digitalocean-token
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: atlantis-vcs
+              key: aws-access-key
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: atlantis-vcs
+              key: aws-secret-key
+        - name: ATLANTIS_PORT
+          value: "4141" # Kubernetes sets an ATLANTIS_PORT variable so we need to override.
+        ports:
+        - name: atlantis
+          containerPort: 4141
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 100m
+          limits:
+            memory: 256Mi
+            cpu: 100m
+        livenessProbe:
+          # We only need to check every 60s since Atlantis is not a
+          # high-throughput service.
+          periodSeconds: 60
+          httpGet:
+            path: /healthz
+            port: 4141
+            scheme: HTTP
+        readinessProbe:
+          periodSeconds: 60
+          httpGet:
+            path: /healthz
+            port: 4141
+            scheme: HTTP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: atlantis
+spec:
+  type: ClusterIP
+  ports:
+  - name: atlantis
+    port: 80
+    targetPort: 4141
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: runatlantis
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+spec:
+  tls:
+  - hosts:
+    - runatlantis.day2.tech
+    secretName: runatlantis-day2-tech
+  rules:
+  - host: runatlantis.day2.tech
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: atlantis
+          servicePort: 4141

manifests/runatlantis/secret.yaml

@@ -0,0 +1,20 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: atlantis-vcs
+  namespace: runatlantis
+spec:
+  encryptedData:
+    aws-access-key: AgCN4uENMoLKCyQhr0u9SjPvK+QgUWXwTLR9hg7YMCvU3NjdQm/G75K6QYz5/WI/7TB+Uf4XGS/dpxQEkfjoHiqr1jlYQj2vaAwYYUVqEJYsi8S+ccNvqsUp6YFdFoaiCot3nGn2M2bOE5kS2IFte/SLtklKT/K/EP1ZwmL60UNhJL88eSLAmx76KWtH4fgLrBu7Hs9Htr02HkxP/I06LHPknay84X1Z+tjy/PbV4qlDf1D/6/WOpevoJHDcprffsqeIBUZ67X0p/DeN5QpniY29wXgNJNuBQ+qSvfR0ntX1sUh7dkYqH1my1MUTMFIz6XQH1hz2NUoh1p4uZnoslB8eBOigHDDZFOarkIZYJ4baDW1GmxC9vGWoC1cB6rf5Tt6sJXtokrwSO2zPtj3DA/bTj0/Cd7mG/Qm9zGHvgrRhtr3Ifame3IPGcMqaGoHSL0irAhr+/wy+tDTvk5aoMOYs8/ocx+JzgY94f3TxJJJbZ6EbyD7frIzwJnk3Wx0aAhvXg4DcZ7IWC3ykxtgAu8l47qyISiBOJ5bQOCdQUQ+yGmo6S/rq13Xp4VqpBviZTlvjDt/nWlU1lePyoGtumvHJwwqKnUZvtqDzNyf200q/FPJqLwoNQxSpfG3SjIomFbdqgklyOiO+P2q500xYCPgHclw/WPEDk7A4QTIA8xoNY6vpubhL6TeyjGXh1/4A8lYpzdxMotdLZVZoymP82N6T+6FqCg==
+    aws-secret-key: AgBa73eHGxg2x5z58/GGdYEzIo5RtX1K+J6IoWotgC5rZyB2MiQtTMIwNF/iDzoPS+2womXnI1xdwXXqaSkXGgtdvjG8C965IwTQww6RjasGV1m8BF+BwI8E87zQOBt3C2DVbP/idT1RU3Q8pEB4BHPq9tb0izkkpgKtDkgSKCyNGSyKjN6zZYZkC+B0SxomIBcaBF+cTJC2bi24OTCvmZ40yg7JS70Zo1bhZMg4Slqdu7KkZvyhTo1YfS6CWcC8qS7WYgvKCzEjJ4p4evHNZyRfY+8VxHsgAconkOKtMksMLxIkMHTCNyEBgIZ97dZLx5ZPcxO+WDJ4VNTSRZpYcwbi02EV//ZPbXc0n91ySwwMOBRhLUl0AfZlqcYu/TG4CbLlFbfftrXjdqLDwfbBIdZc20z51AQKBW6zA3N5DkvT+5gFCuRgllksbKoEmOkNYXarMPOcgVgFhxYH6yJrNIO/hgzHYn9ajV8BkbTxdD/Dn0CNigXWtY8LCG1qqbcgmW7EEjsrAhh8jJg99tHhCpPk4acy0zz3zUYSv8uPpHr41fi4ijjhKZHlsDNn/avd0hlhK1XhdTdXSNc27ezjMFJ4hWuw6uFdbyuQTSQk0UBeaB6IPbYsOqFCGn5xP+dWFoOw8qXSz1gx0Tfd6Ni5nG2PaDqh7P4+cEJNo/RdkVzWwGi3pqCwKbJNzRqhxOC3HCQSsT6OwVtcswyN/gTnfZOB0EPEccGQ9jgFv4nyoxj30IX5Qal47geOrouk
+    digitalocean-token: AgCKfc8N/5zrzcnh4mS+beuKYqh4/1zJe3nRauetlQL3mCwE+UrSaB6LstEcFyAgw/WwXJP4Vls2mUEh3bjv2c4NU7vFT/rxHGdcfOhpHlEPA80Ny0AklCUjYZ+ZZBYYZ/Mn+oPIm2ZdwiECAIMnEpnQYVRXGExzN+FUYEYSD3BELkQqtYRXUHPUaVOeNvn02Hdkzhu4MtTeqVUrTlkX5Ml97zO/0UEpGU73zEe9Q2cyRcBsc8B3WU4gp0UJKQzhkt35HtxbKkvuWDIcUFjS4KZJH6SkHaLQAuvUrIld12BADj8SUfLb3ttBbS8LIr70d43hz4b20EdClmrxOxQ5x2lNXOaZdRrA8LjERnm5+Uhf5Cu1AvdvS/zDHJBnUWYiTup/Zs04s0RsLbXctNwoU2nt52inemVTuyxWHujfvpXEDdbsAzlGdk1+HZHMyO3Ird4QlcvM5DSq3HzH8vdlkpC99lox9ortE3oNvsuePFtInwTQh9l1vUMrKhurvhnI/lqpZQ9bmRdJvEMDckb9JX08lrP+f/xEiLbY6m71MuS3QTEq7fzoFBFIK6gn3qiY1BFfLe0MH7Alp2fessvF0jr5bLNZKhq0YMuD1JU9eNPbVQITR1ZM+5vIOVlHM4qj5DYx4bny4j5y3Pll+M9lMu0hyj4J0KZ0EGd9SdrLodWbelzMQ1X5ujAx4c+nwWjt2cZPVwWomcdTtqWl1QuvEaABcey1LT3wzDItc28t+6lMXf6gTPvQio1zwrL6MqX9W+KZsk11hyog1IEqd9+i1PQx
+    token: AgCr3RB2H8/NVa2MOGm9QCFuvDIEXphC3R9v9NFNxJDWBaAOZb9KkPRMQUx8thexfOuRvzPbXXq3MWArvRMNMu1jGGfZ8hxkh9DCHzkH0xOn0skKoEG9vb1+jYkYwKJSrHBUrgzl2lHOWpLAsxL2IiFln+X6D6qKDKfWznCtlbEfzCwOSAkye/8Q53ZNfEd5AaGy/+6uWJXO+47F/xgUIbV+bJLBavwv3U/ypAP83hwKxuX4/Lg/6HiDvtp8GOroppr5qSSDWYMZP3HovlmYSQKUaRflZUDDNgH8DGT5ml2DFFvpx0e2Z+2kfpooulbJgRY1GhEe2zLw7/+1flzOV7QVZ7xSy+MzuZZKZfIn46YWPFAgGOBDDAm3v7+mZ7QxJLW/3JjyIR/Bz52843e2crn32Khhu8MEwTDnjGw+KP35laMCHRZSPiZldRxbDnuTMRdcCEEh45ejXgD7/BEOzkTX9hxITUXyAS3pZ58XG6j5DiyRJVWnLtVUv2fOejdVxEVBajHyu3LQTJSnfhWjpkDH/4Fv+el+tNoD+wjZu6yZt5OszE2g8HMM9ReaZjsuy2h4jhvsdfPsV5vBpEDemlOg/+XxTUi+IRbc06blMT7IiFE5U0aiaZcfyPOka6PrM8/U5fiEuhg2qYBNRwBCkDSEmMFE5uy6zlrL/eHf/h9iRGtbsl7YcPwkdNgOcfnOA9tb/D0BTQVk+/K9zfdDH7cl6tKQ4odkA/W3VuJ/jrHldiqIZlC9SBJp
+    webhook-secret: AgAWEumdwGo66kc16do5VHGfiE3k8W1edgXwJyXc/Jk+hULmde+0uiBozidv8qPjAXbmsAtb91cGC9xBTSA2y4qVDwELrW5mcFGLqeK1bJzY/DqQpjruiSqgi7sCN1qQNiqPhDWBcoIh6TKziG/Qh5h5/IZWR4yBYBRflyDBM11X8kcL3CtC1vVJ+FvWyPGYrXqHmXRVvXKVkaqAYFXNNOpNvZUIRfgOpikl6Ovx/WjN2/BMOE+nZvNRme3KdsA2OP3b3MM1DUtI1zAqdjJEZPQbqCbLFNUxGLgPLOpCqNXd/ISRBI8QlvDKnYptDfZYoYTuINHoBSRviUEspIycmIb53nVLphWtm8gCHPK+Q6lHYw7WMvnEG2tEL3vpE2daQTsW5rOGoRlaLUdNUSBx1Cn923ONKE992d4x7rQh+lJ3QulhBFjuWnQUVolS/Vp2EbXpf/XJJceI7QCp3G1F3bEWEs/VbTJvegEhd5BZzNPUrDyTCqX/NZPhkR+aqB0hJBOo30nyp71ZATeRzi+qbkHCZNGAuF8tzt2fRRJtZqMRC0rp6XgEydIbKMXNia8XLCfSXhrPOG5Es8dGf9KyvbvaHyUIk2y1JzRWggZ59nYSp+DOMIV4uXnt7UW8zUjy50e4qxxCE17cUcf997EUr03BrphLGKjZhnWkl9K1AtazXWTy5gy2K8ZDCUsJKNGuf0gbQDG8Dd53K7t1VxsCN4QmBY7hFQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: atlantis-vcs
+      namespace: runatlantis
+    type: Opaque
+