```environmentSecrets name ATLANTIS GH APP KEY secretKeyRef

Question

```environmentSecrets name ATLANTIS GH APP KEY secretKeyRef name atlantis github config key ATLANTIS GH APP KEY name ATLANTIS GH TOKEN secretKeyRef name atlantis github config key ATLANTIS GH TOKEN name ATLANTIS GH WEBHOOK SECRET secretKeyRef name atlantis github config key ATLANTIS GH WEBHOOK SECRET``` from the atlantis helm chart

Seth Floyd · Answer

What do I do about this section then Do I comment this out ``` github user my user token ghp 123123123123 secret 1234567890987654321234567890987654321```

Seth Floyd · Answer

I already have everything working I just need to do something with my secrets so they arent commited to our repo

Ben Parafina (grimaldi) · Answer

I use environment raw to pass that in

Ben Parafina (grimaldi) · Answer

and all that is commented out

Ben Parafina (grimaldi) · Answer

`environmentRaw `

Ben Parafina (grimaldi) · Answer

the user however is ` fake ` if it s an app

Ben Parafina (grimaldi) · Answer

but basically any non privileged info goes into environmentRaw

Seth Floyd · Answer

So what is this for To me that sounds like what I need since I already have my secrets setup in aws and the role thats assumed by atlantis has permissions to access them ``` To reference an already existing Secret object with AWS credentials awsSecretName mysecretwithawscreds ```

Ben Parafina (grimaldi) · Answer

its so you don t check in secrets

Ben Parafina (grimaldi) · Answer

instead of reading the secrets in the config you point the chart at a secret object you create seperately

Ben Parafina (grimaldi) · Answer

the operator just abstracts the need for your service role to access anything or do a get on secrets manager

Ben Parafina (grimaldi) · Answer

and the reason you don t have what you need is because in order for the atlantis pod to start you need a valid set of configs So unless you ship them in with a sidecar or something you have to provide the config at runtime to the service

Seth Floyd · Answer

Whats wrong with just having eks look at the secret in secret manager Its using a role that has the access it needs same account same region Im just not following why the 10K ways of doing this

Ben Parafina (grimaldi) · Answer

because the pod the container doesn t have the mechanism to satisfy that at startup

Ben Parafina (grimaldi) · Answer

if the rule is that a container should only do 1 thing and you satisfy the rest of the conditions why would you have the first thing it does not be launch the process it s running

Ben Parafina (grimaldi) · Answer

and instead fetch a secret to then init the pid of atlantis

Ben Parafina (grimaldi) · Answer

then your problem is that your process is no longer at the root of your container

Ben Parafina (grimaldi) · Answer

and what I m telling you is that in the example I gave you EKS is looking into secrets manager with a tool specifically built to do so

Ben Parafina (grimaldi) · Answer

the external secrets operator is a k8s operator that just takes external secrets yaml objects and generates secrets for you to use

Seth Floyd · Answer

ok starting to make more sense

Seth Floyd · Answer

so this `ghe webhook secret` whatever you call that I notice one of the ones in your example is `ghe app key` Is that just something you made up a name for or is that like from some official list of whatever those are called I need to make one for the UI password also Can I use that app key or is there something more specific to use for the UI password ``` Optionally specify an username and a password for basic authentication basicAuth username password ```

Ben Parafina (grimaldi) · Answer

we use an app

Ben Parafina (grimaldi) · Answer

but you could use the user pass shit if you need

Ben Parafina (grimaldi) · Answer

Ben Parafina (grimaldi) · Answer

full list of valid things

Ben Parafina (grimaldi) · Answer