feat: replace terraform github actions with atlantis - #143
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c31822691
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: ATLANTIS_WEB_USERNAME | ||
| value: gaucho | ||
| - name: ATLANTIS_REPO_CONFIG_JSON | ||
| value: '{"repos":[{"id":"github.com/Gaucho-Racing/infrastructure","apply_requirements":["approved","mergeable"],"plan_requirements":[],"import_requirements":["approved"]}]}' |
There was a problem hiding this comment.
When an untrusted user can open a pull request, the empty plan_requirements lets Atlantis autoplan the contributor-controlled Terraform before any review, inside a pod containing the production AWS and Cloudflare credentials. Terraform planning can execute provider or external data-source code, so a malicious PR can print or exfiltrate those credentials even though apply requires approval; require approval for plans or run them with credentials that cannot affect or expose production.
Useful? React with 👍 / 👎.
1 participant
apps/atlantis.yaml+manifests/atlantis/): StatefulSet with 5Gi PVC, Traefik ingress atatlantis.gauchoracing.com(proxied), secrets via VaultSecretSync fromatlantis-prodinfra/environments/devroot: assume-role into the Gaucho Racing Development account (104050870528), own state key in the shared tfstate bucketatlantis.yamlmanages thedevproject only — prod stays manual/local for now and gets added to Atlantis lateratlantisIAM user (management account) that assumesOrganizationAccountAccessRoleinto member accountsterraform-plan.yml/terraform-apply.ymlworkflows.terraform.lock.hcl(helm provider dropped in chore(prod): remove eks and argocd modules after cluster teardown #142)Not functional until (manual steps): GitHub App created + installed, secrets populated in Vault at
atlantis-prod.