Configure github app pem file from environment variable

[dtelaroli]

I'm using atlantis in ECS fargate directly from atlantis docker hub, now I need set the github app pem file, but I want use environment variable to easy configuration from AWS SSM Parameter Store.

Is it possible without customize the image?
If no, would be nice to have.

[dtelaroli]

As workaround I've created an image which replace the entrypoint file to execute a command before startup.
I use a new env variable with the pem content, named ATLANTIS_GH_KEY_VALUE, and on startup the script creates the key file.

ARG ATLANTIS_VERSION

FROM runatlantis/atlantis:$ATLANTIS_VERSION

RUN sed '/^exec.*/i echo "$ATLANTIS_GH_KEY_VALUE" > $ATLANTIS_GH_APP_KEY_FILE' /usr/local/bin/docker-entrypoint.sh

[nishkrishnan]

The api we use specifically requires a file. https://github.com/runatlantis/atlantis/blob/master/server/events/vcs/github_credentials.go#L131 but looks like there's another api available from that library that uses the bytes directly so probably something that can be added.

[vitaly-dt]

Hi, I am trying to use the environment variable ATLANTIS_GH_APP_KEY
I am getting the following error:

Error: initializing server: error initializing github authentication transport: could not parse private key: invalid key: Key must be a PEM encoded PKCS1 or PKCS8 key

How is it configured:
I tried the following methods:

1. One line string: with & without quotes, with & without \n
2. As binary - creating the secret as binary from the aws cli

The string looks ok to the naked eye, but it's not parsed correctly.
Can someone assist, please?

[barth12]

Did you figure it out @vitaly-dt ?

[vitaly-dt]

Did you figure it out @vitaly-dt ?

@barth12 No, I had to mount the key and reference its path for Atlantis.

[wwahlstedt]

I think this is still broken. It must be a bug.

[bilenkis]

Also face the same issue. No matter how I format the PEM key ENV the error is still the same:

Error: initializing server: error initializing github authentication transport: could not parse private key: invalid key: Key must be a PEM encoded PKCS1 or PKCS8 key

[artworkad]

In a containerized environment you can spin up a second side-car container that mounts the same volume as atlantis and writes the key to a pem file. When using https://github.com/terraform-aws-modules/terraform-aws-atlantis on ECS Fargate it would look like:

config = {
  ...
  image = "bash"
  enable_execute_command = true
  command = ["echo \"$ATLANTIS_GH_APP_KEY\" > /home/atlantis/github_app_key.pem"]
  entrypoint = ["sh", "-c"]
}

$ATLANTIS_GH_APP_KEY must be pulled from AWS Secret Manager.