Zack
12/15/2025, 6:30 PMvendor.yaml (renovate bit us) etc and looking at how to implement properly with abstract includesZack
12/15/2025, 6:31 PMZack
12/15/2025, 6:37 PMvendor.yaml, mixins, imported components etc. We are not currently versioning our "targets"
ex
vendor.yaml
apiVersion: atmos/v1
kind: AtmosVendorConfig
metadata:
name: example-vendor-config
description: Atmos vendoring manifest
spec:
# `imports` or `sources` (or both) must be defined in a vendoring manifest
imports: []
sources:
# `source` supports the following protocols: local paths (absolute and relative), OCI (<https://opencontainers.org>),
# Git, Mercurial, HTTP, HTTPS, Amazon S3, Google GCP,
# and all URL and archive formats as described in <https://github.com/hashicorp/go-getter>.
# In 'source', Golang templates are supported <https://pkg.go.dev/text/template>.
# If 'version' is provided, '{{.Version}}' will be replaced with the 'version' value before pulling the files from 'source'.
- component: "vpc"
source: "github.com/cloudposse/terraform-aws-components.git//modules/vpc?ref={{.Version}}"
version: "1.398.0"
targets:
- "components/terraform/vpc"
say we update the one vendor.yaml for vpc to 2.0.0, and there's breaking changes ( need new input variables or whatever ) since the target directory isn't versioned, we need to update the variables everywhere at the same time that uses this component (like ~60 stacks)Zack
12/15/2025, 6:41 PM./components/terraform directoryZack
12/15/2025, 6:47 PMvendor.yaml files, right?Erik Osterman (Cloud Posse)
12/15/2025, 8:03 PMErik Osterman (Cloud Posse)
12/15/2025, 8:03 PMErik Osterman (Cloud Posse)
12/15/2025, 8:04 PMErik Osterman (Cloud Posse)
12/15/2025, 8:04 PMThere's not a sane way to have multipleVendoring supportsfiles, right?vendor.yaml
importErik Osterman (Cloud Posse)
12/15/2025, 8:04 PMErik Osterman (Cloud Posse)
12/15/2025, 8:06 PMdo you guys have an example of a "mature" atmos repo publicly?We don't - this is actually what we sell with our "Quickstart" and "Jumpstart" packages.
Erik Osterman (Cloud Posse)
12/15/2025, 8:06 PMZack
12/15/2025, 9:17 PMZack
12/15/2025, 9:17 PMErik Osterman (Cloud Posse)
12/15/2025, 10:07 PMimport keywordErik Osterman (Cloud Posse)
12/15/2025, 10:07 PMErik Osterman (Cloud Posse)
12/15/2025, 10:07 PMErik Osterman (Cloud Posse)
12/15/2025, 10:07 PMErik Osterman (Cloud Posse)
12/15/2025, 10:09 PMcomponents:
terraform:
something:
metadata:
source: https://..some..vendor..url/
workdir: true
Which will vendor that source "just in time" automaticallyErik Osterman (Cloud Posse)
12/15/2025, 10:10 PMZack
12/15/2025, 10:17 PMZack
12/15/2025, 10:25 PMvars:
module_versions:
vpc: 1.2.3
components:
terraform:
something:
metadata:
source: "https://..some..vendor..url/?ref={{ .vars.module_versions.vpc }}"
workdir: trueErik Osterman (Cloud Posse)
12/16/2025, 4:42 AMErik Osterman (Cloud Posse)
12/16/2025, 4:44 AMZack
12/16/2025, 5:28 PMZack
12/16/2025, 5:28 PMErik Osterman (Cloud Posse)
12/16/2025, 6:29 PMyeah I'm not sure how my team is going to want to handle thisMeaning before the
metadata.source feature or afterErik Osterman (Cloud Posse)
12/16/2025, 9:59 PMZack
12/16/2025, 11:30 PMmetadata.source feature or after
I think once metadata.source is introduced, we would probably lean towards the just-in-time vendoring
There's just many ways to handle this and conceptualize solutions. Today I've been going down the rabbit hole of importing stack level vendor.yaml files, and using tags to define what stack should pull what, but with that we'd need to move tags around to promote what stack is using what and potentially think in terms of like different release tracks - stable, latest.. etc
Apparently there's a atmos vendor pull --stack stack switch that doesn't work yet unfortunately, guessing that's related to the JIT featureErik Osterman (Cloud Posse)
12/17/2025, 2:42 PMApparently there's athat might be a regressionstack switch that doesn't work yet unfortunately, guessing that's related to the JIT feature (edited)atmos vendor pull --stack