This message was deleted Atlantis #atlantis-community

Join Slack

This message was deleted.

# atlantis-community

Slackbot

11/08/2023, 10:25 AM

This message was deleted.

Felippe Bueno

11/08/2023, 12:01 PM

You can use sops + helm secrets

Felippe Bueno

11/08/2023, 12:01 PM

That if you want to store in the repository

Daniel Boca

11/08/2023, 12:12 PM

awesome ! thank you !

11/08/2023, 1:11 PM

You can also use aws secrets csi driver to pull secrets from aws secrets manager and mount them into the container

🙌 1

Daniel Boca

11/08/2023, 1:14 PM

i am on Azure, but yes, that's what i am working on right now. Since we're here, i have a few questions: • does vcsSecretName reference the `secret`field of

githubApp

from the

values.yaml

file ? ( inside the

statefulset.yaml

template it only seems to reference the key, so i added:

Copy code

{{- if .Values.githubApp }}
      {{- if or .Values.githubApp.key .Values.vcsSecretName}}
      - name: github-app-key-volume
        secret:
          secretName: {{ template "atlantis.vcsSecretName" . }}
          items:
          - key: key.pem
            path: key.pem
          - key: secret <-- this 
            path: secret <-- and this

• for the volume mount, i guess i can use this field from the `values.yaml`file:

Copy code

# Optionally specify additional volume mounts for the container.
extraVolumeMounts: []
# extraVolumeMounts:
#   - name: some-volume-name
#     mountPath: /path/in/container

Daniel Boca

11/08/2023, 4:57 PM

ok, so i wanted to have the `secret`in a mount just like the

key

, and i ended up customizing the

statefulset.yaml

like this:

Copy code

{{- if or .Values.githubApp.secret .Values.vcsSecretName}}
          - name: ATLANTIS_GH_WEBHOOK_SECRET
            value: "/var/github-app-secret/secret.txt" 
            # valueFrom:
            #   secretKeyRef:
            #     name: {{ template "atlantis.vcsSecretName" . }}
            #     key: github_secret
          {{- end }}

then modified this:

Copy code

# to mount the githubApp secret in a volume, just like the key
          {{- if .Values.githubApp }}
          {{- if or .Values.githubApp.secret .Values.vcsSecretName}}
          - name: github-app-secret-volume
            mountPath: /var/github-app-secret
            readOnly: true
          {{- end }}
          {{- end }}

and in the `values.yaml`file:

Copy code

githubApp:
   id: 54353453
   slug: slug-name
   vcsSecretName: "secret-from-k8s"

and i think all that remains is to configure the

extraVolumeMounts

for the

key

and

secret

2 Views

Open in Slack

Previous Next