Collaborative Terraform with Atlantis

Ferenc Kovács
Ferenc Kovácsdeveloper at ustream.tv
Collaborative Terraform
with Atlantis
2023-06-30 @ Let’s Code meetup
Introduction
Ferenc Kovács
DevOps guy from Budapest, Hungary
Infrastructure Tech Lead at IBM Budapest Lab
FLOSS enthusiast
What is Terraform?
“Terraform is an infrastructure as code
tool that lets you build, change, and
version cloud and on-prem resources
safely and efficiently.”
No but really, what is Terraform?
“Random” IaC code executed on
someone’s laptop, then not properly
merged to git.
What is the problem with local apply?
- Prone to “works on my machine” issues
- Diverging tf and provider versions.
- Diverging tf/environment vars.
- Lack of visibility/auditability
- Who applied what/when and what was the
output/error?
- People need access to the remote state.
- People need credentials for the providers.
What is the problem with local apply?
- Even if you do code reviews in Github it is
cumbersome to copy/paste plan outputs and
apply can always fail regardless(we are
dependent not just our code correctness but
the state/availability of the provider APIs).
The solution
We need a predictable, trusted and audited
environment where terraform actions can be
executed and preferably integrated with VCS.
Terraform Cloud/Enterprise
- It’s a solution from Hashicorp, it is tightly integrated with
terraform itself.
- Allows you to use remote terraform execution and it
allows you to centrally manage the env
variables/secrets.
- Requires you to store the remote state there, but they
have a self-hosted Enterprise install($$$).
- The free-tier plan is really nice, if you have max 5
people using it and you don’t mind using a closed
source third party solution.
Env0
- It is a more complex solution, supports most of the
available IaC tools (TF, CF, Pulumi, etc.).
- This is also a closed source 3rd party, but as part of
their Business/Enterprise offering they also provide
Self-hosted agents which allows you to keep your
workload and secrets on-prem.
- They have nice documentation comparing their offering
to TF Cloud and Atlantis.
- No free plan, only free-trial.
Garden.io
- It is a more complex solution, supports most of the
available IaC tools (TF, CF, Pulumi, etc.).
- It makes it possible to declare all of your heterogen
stack declaration/pipelines in an uniform way and chain
them together. Creating a new environment from a
single command.
- The Garden core tool is open-source, but the
centralized execution environment is a paid (closed
source) feature.
- They also have a self-hosted Enterprise offering.
Scalr
- They only focus on Terraform, much simpler than Env0
or Garden.
- They also provide local agents as part of the enterprise
offering, but you can’t host your secrets for yourself.
- They have a free plan of 50 runs per month, max 50
users and max 100 workspaces.
Spacelift
- It is a more complex solution, supports most of the
available IaC tools (TF, CF, Pulumi, etc.).
- This is also a closed source 3rd party, but as part of
their Enterprise offering they also provide a hybrid-saas
and a self-hosted option which allows you to keep your
workload and secrets on-prem.
- They have nice documentation comparing their offering
to TF Cloud and Atlantis.
- They have a forever free plan for 2 users.
But what about Atlantis?
- https://runatlantis.io/
- It is mostly for Terraform (but stuff like Terragrunt and
cdktf are also supported).
- It is a truly open-source solution, with a permissive
Apache license.
- Because it’s open-source there is a bunch of integration
with all kind of tools and services.
- It has an extendable workflow system, and if something
is still lacking you can send a Pull Request.
- But you have to configure and host it for yourself.
(Average)Atlantis workflow
1. You create a Pull Request with your changes.
2. You “atlantis plan” (if autoplan is not enabled), atlantis
executes terraform init & plan and comments the result
to the PR. You iterate until your plan is successful and
looks good.
3. Somebody reviews and approves your PR.
4. You “atlantis apply” (if autoapply is not enabled), atlantis
executes terraform apply and comments the result to
the PR. You iterate until your apply is successful.
5. Merge the PR.
Atlantis workflow behind the scenes
Supported Installation Methods
● Docker container
● Helm chart
● Kubernetes Manifest
● Kubernetes Kustomize
● Terraform module for AWS Fargate
● Terraform module for GCE
● Terraform module for Azure (but helm chart also works)
● Roll your own (it’s just running a single binary, really)
● For dev/test purposes you can also just run it and
expose with Ngrok (but don’t forget restricting it).
Supported VCSs
● Github/Github enterprise, with user+pat or with Github
App integration
● Gitlab/Gitlab enterprise with pat
● Bitbucket Cloud with pat
● Bitbucket Server with pat
● Azure Devops with pat
Terraform version support
● Atlantis will honor the required_version in your
workspace, but you can also explicitly specify a default
and a workspace specific terraform version in your
atlantis.yaml.
● Atlantis will resolve and install your providers/plugins as
it would happen if you manually executed terraform init.
● From personal experience if you decide to
change/bump your version constraints mid-plan you will
need to discard your current plan and plan again.
Atlantis locking
Atlantis introduces an additional lock mechanism, any
terraform workspace which have an active Atlantis plan will
be locked, so concurrent Pull Requests won’t be able to
plan for the same workspace until the previous plan is
either applied or discarded.
You can discard plans from the github PR or from the
atlantis UI.
Customizing Atlantis
1. You can have global configuration options which can be
set through arguments/config file values or environment
variables passed to the Atlantis binary.
2. For repository specific settings you can use a
Server-Side Repo Config.
3. You can also have an atlantis.yaml file in the root of
your terraform repositories, which can modify atlantis
behavior on a repo or workspace level.
Repo structures
● You can have a terraform workspace in your repo.
● You can have multiple workspaces as top level
directories in your repo.
● You can have workspace directories in a tree-like
structure.
● You can declare relations between your workspaces in
atlantis.yaml, and atlantis will help you to cascade the
plans between workspaces.
● You can have multiple repositories managed by a single
Atlantis instance.
Command Requirements
● Atlantis supports the following requirements:
○ Approved
○ Mergeable
○ UnDiverged
● You can use these as to specify when can plan, apply
and import execute.
● By default after the apply requirement are met (plan is
green, PR is approved, etc.) anybody who can comment
can atlantis apply, you can change this with
gh-team-allowlist.
Security
● Make sure to read through the security documentation:
○ https://www.runatlantis.io/docs/security.html
● Follow your company’s Security Standards and consider
Atlantis as a critical production asset.
● Use webhook secrets and you can also additionally
firewall atlantis to restrict webhook access from your
VCS only.
● You can also put a WAF in front of it just in case.
Thanks for your attention!
Slides will be here:
http://www.slideshare.net/Tyrael
If you have any questions:
tyrael@tyrael.hu
@Tyr43l
1 of 24

Recommended

Understanding Monorepos by
Understanding MonoreposUnderstanding Monorepos
Understanding MonoreposBenjamin Cabanes
522 views82 slides
Using Git and BitBucket by
Using Git and BitBucketUsing Git and BitBucket
Using Git and BitBucketMedhat Dawoud
21.4K views51 slides
Introduction to Git(BitBucket) , Continuous Integration (Bamboo) & Confluence by
Introduction to Git(BitBucket) , Continuous Integration (Bamboo) & Confluence Introduction to Git(BitBucket) , Continuous Integration (Bamboo) & Confluence
Introduction to Git(BitBucket) , Continuous Integration (Bamboo) & Confluence Parag Gajbhiye
6.5K views23 slides
Collective Intelligence by
Collective IntelligenceCollective Intelligence
Collective Intelligenceevilmonkey89
17.1K views13 slides
01 - Introduction to Hyperledger : A Blockchain Technology for Business by
01 - Introduction to Hyperledger : A Blockchain Technology for Business01 - Introduction to Hyperledger : A Blockchain Technology for Business
01 - Introduction to Hyperledger : A Blockchain Technology for BusinessMerlec Mpyana
550 views37 slides
Mono Repo by
Mono RepoMono Repo
Mono RepoZacky Pickholz
1.4K views50 slides

More Related Content

What's hot

What is NFT (Non-fungible token) & How do they work? by
What is NFT (Non-fungible token) & How do they work?What is NFT (Non-fungible token) & How do they work?
What is NFT (Non-fungible token) & How do they work?Finlaw Consultancy Pvt Ltd
534 views13 slides
Lucene solr 4 spatial extended deep dive by
Lucene solr 4 spatial   extended deep diveLucene solr 4 spatial   extended deep dive
Lucene solr 4 spatial extended deep divelucenerevolution
13.3K views58 slides
DevOps at Tokopedia - DevOps Indonesia by
DevOps at Tokopedia - DevOps IndonesiaDevOps at Tokopedia - DevOps Indonesia
DevOps at Tokopedia - DevOps IndonesiaKhairul Zebua
147 views33 slides
Provisional Persona Workshop 1.0 by
Provisional Persona Workshop 1.0Provisional Persona Workshop 1.0
Provisional Persona Workshop 1.0Mo Goltz
31.8K views39 slides
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018) by
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)Svetlin Nakov
1.1K views26 slides
Git and GitHub | Concept about Git and GitHub Process | Git Process overview by
Git and GitHub | Concept about Git and GitHub Process | Git Process overviewGit and GitHub | Concept about Git and GitHub Process | Git Process overview
Git and GitHub | Concept about Git and GitHub Process | Git Process overviewRueful Robin
399 views21 slides

What's hot(6)

Lucene solr 4 spatial extended deep dive by lucenerevolution
Lucene solr 4 spatial   extended deep diveLucene solr 4 spatial   extended deep dive
Lucene solr 4 spatial extended deep dive
lucenerevolution13.3K views
DevOps at Tokopedia - DevOps Indonesia by Khairul Zebua
DevOps at Tokopedia - DevOps IndonesiaDevOps at Tokopedia - DevOps Indonesia
DevOps at Tokopedia - DevOps Indonesia
Khairul Zebua147 views
Provisional Persona Workshop 1.0 by Mo Goltz
Provisional Persona Workshop 1.0Provisional Persona Workshop 1.0
Provisional Persona Workshop 1.0
Mo Goltz31.8K views
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018) by Svetlin Nakov
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)
Consensus Algorithms - Nakov at CryptoBlockCon - Las Vegas (2018)
Svetlin Nakov1.1K views
Git and GitHub | Concept about Git and GitHub Process | Git Process overview by Rueful Robin
Git and GitHub | Concept about Git and GitHub Process | Git Process overviewGit and GitHub | Concept about Git and GitHub Process | Git Process overview
Git and GitHub | Concept about Git and GitHub Process | Git Process overview
Rueful Robin399 views

Similar to Collaborative Terraform with Atlantis

Self-service PR-based Terraform by
Self-service PR-based TerraformSelf-service PR-based Terraform
Self-service PR-based TerraformAndrew Kirkpatrick
119 views82 slides
Terraform + ansible talk by
Terraform + ansible talkTerraform + ansible talk
Terraform + ansible talkJames Strong
116 views23 slides
Terraform vs Pulumi by
Terraform vs PulumiTerraform vs Pulumi
Terraform vs PulumiHoaiNam307
108 views20 slides
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi... by
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...Deltares
167 views25 slides
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdf by
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdfHashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdf
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdfssuser705051
13 views52 slides
Terraform-2.pdf by
Terraform-2.pdfTerraform-2.pdf
Terraform-2.pdfrutiksankapal21
6 views52 slides

Similar to Collaborative Terraform with Atlantis(20)

Terraform + ansible talk by James Strong
Terraform + ansible talkTerraform + ansible talk
Terraform + ansible talk
James Strong116 views
Terraform vs Pulumi by HoaiNam307
Terraform vs PulumiTerraform vs Pulumi
Terraform vs Pulumi
HoaiNam307108 views
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi... by Deltares
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...
DSD-INT 2022 Singularity containers - simplifying the use of Delft3D FM on Hi...
Deltares167 views
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdf by ssuser705051
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdfHashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdf
Hashicorp-Terraform-Deep-Dive-with-no-Fear-Victor-Turbinsky-Texuna.pdf
ssuser70505113 views
Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform by Drew Malone
Devops Columbia October 2020 - Gabriel Alix: A Discussion on TerraformDevops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform
Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform
Drew Malone70 views
Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform by DevOpsColumbia
Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform
Devops Columbia October 2020 - Gabriel Alix: A Discussion on Terraform
DevOpsColumbia146 views
distage: Purely Functional Staged Dependency Injection; bonus: Faking Kind Po... by 7mind
distage: Purely Functional Staged Dependency Injection; bonus: Faking Kind Po...distage: Purely Functional Staged Dependency Injection; bonus: Faking Kind Po...
distage: Purely Functional Staged Dependency Injection; bonus: Faking Kind Po...
7mind1.7K views
Migraine Drupal - syncing your staging and live sites by drupalindia
Migraine Drupal - syncing your staging and live sitesMigraine Drupal - syncing your staging and live sites
Migraine Drupal - syncing your staging and live sites
drupalindia7.7K views
Terraform Q&A - HashiCorp User Group Oslo by Anton Babenko
Terraform Q&A - HashiCorp User Group OsloTerraform Q&A - HashiCorp User Group Oslo
Terraform Q&A - HashiCorp User Group Oslo
Anton Babenko303 views
Building Cloud Virtual Topologies with Ravello and Ansible by Damien Garros
Building Cloud Virtual Topologies with Ravello and AnsibleBuilding Cloud Virtual Topologies with Ravello and Ansible
Building Cloud Virtual Topologies with Ravello and Ansible
Damien Garros1.1K views
Terraform modules and (some of) best practices by Anton Babenko
Terraform modules and (some of) best practicesTerraform modules and (some of) best practices
Terraform modules and (some of) best practices
Anton Babenko608 views
Habitat Overview by Mandi Walls
Habitat OverviewHabitat Overview
Habitat Overview
Mandi Walls587 views
Tampere Technical University - Seminar Presentation in testind day 2016 - Sca... by Sakari Hoisko
Tampere Technical University - Seminar Presentation in testind day 2016 - Sca...Tampere Technical University - Seminar Presentation in testind day 2016 - Sca...
Tampere Technical University - Seminar Presentation in testind day 2016 - Sca...
Sakari Hoisko358 views

More from Ferenc Kovács

Php 5.6 From the Inside Out by
Php 5.6 From the Inside OutPhp 5.6 From the Inside Out
Php 5.6 From the Inside OutFerenc Kovács
1.3K views30 slides
Monitorama by
MonitoramaMonitorama
MonitoramaFerenc Kovács
756 views19 slides
A PHP 5.5 újdonságai. by
A PHP 5.5 újdonságai.A PHP 5.5 újdonságai.
A PHP 5.5 újdonságai.Ferenc Kovács
1.8K views27 slides
Php 5.5 by
Php 5.5Php 5.5
Php 5.5Ferenc Kovács
1.2K views17 slides
A PHP 5.4 újdonságai by
A PHP 5.4 újdonságaiA PHP 5.4 újdonságai
A PHP 5.4 újdonságaiFerenc Kovács
2K views45 slides
Biztonságos webalkalmazások fejlesztése by
Biztonságos webalkalmazások fejlesztéseBiztonságos webalkalmazások fejlesztése
Biztonságos webalkalmazások fejlesztéseFerenc Kovács
6.3K views37 slides

More from Ferenc Kovács(8)

Php 5.6 From the Inside Out by Ferenc Kovács
Php 5.6 From the Inside OutPhp 5.6 From the Inside Out
Php 5.6 From the Inside Out
Ferenc Kovács1.3K views
Biztonságos webalkalmazások fejlesztése by Ferenc Kovács
Biztonságos webalkalmazások fejlesztéseBiztonságos webalkalmazások fejlesztése
Biztonságos webalkalmazások fejlesztése
Ferenc Kovács6.3K views
Webalkalmazások teljesítményoptimalizálása by Ferenc Kovács
Webalkalmazások teljesítményoptimalizálásaWebalkalmazások teljesítményoptimalizálása
Webalkalmazások teljesítményoptimalizálása
Ferenc Kovács6K views
PHP alkalmazások minőségbiztosítása by Ferenc Kovács
PHP alkalmazások minőségbiztosításaPHP alkalmazások minőségbiztosítása
PHP alkalmazások minőségbiztosítása
Ferenc Kovács1.5K views

Recently uploaded

SAP FOR CONTRACT MANUFACTURING.pdf by
SAP FOR CONTRACT MANUFACTURING.pdfSAP FOR CONTRACT MANUFACTURING.pdf
SAP FOR CONTRACT MANUFACTURING.pdfVirendra Rai, PMP
13 views2 slides
DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t... by
DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...
DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...Deltares
9 views26 slides
Short_Story_PPT.pdf by
Short_Story_PPT.pdfShort_Story_PPT.pdf
Short_Story_PPT.pdfutkarshsatishkumarsh
5 views16 slides
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with... by
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...sparkfabrik
5 views46 slides
Copilot Prompting Toolkit_All Resources.pdf by
Copilot Prompting Toolkit_All Resources.pdfCopilot Prompting Toolkit_All Resources.pdf
Copilot Prompting Toolkit_All Resources.pdfRiccardo Zamana
8 views4 slides
Sprint 226 by
Sprint 226Sprint 226
Sprint 226ManageIQ
5 views18 slides

Recently uploaded(20)

DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t... by Deltares
DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...
DSD-INT 2023 Thermobaricity in 3D DCSM-FM - taking pressure into account in t...
Deltares9 views
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with... by sparkfabrik
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...
20231129 - Platform @ localhost 2023 - Application-driven infrastructure with...
sparkfabrik5 views
Copilot Prompting Toolkit_All Resources.pdf by Riccardo Zamana
Copilot Prompting Toolkit_All Resources.pdfCopilot Prompting Toolkit_All Resources.pdf
Copilot Prompting Toolkit_All Resources.pdf
Riccardo Zamana8 views
Sprint 226 by ManageIQ
Sprint 226Sprint 226
Sprint 226
ManageIQ5 views
DSD-INT 2023 3D hydrodynamic modelling of microplastic transport in lakes - J... by Deltares
DSD-INT 2023 3D hydrodynamic modelling of microplastic transport in lakes - J...DSD-INT 2023 3D hydrodynamic modelling of microplastic transport in lakes - J...
DSD-INT 2023 3D hydrodynamic modelling of microplastic transport in lakes - J...
Deltares9 views
Navigating container technology for enhanced security by Niklas Saari by Metosin Oy
Navigating container technology for enhanced security by Niklas SaariNavigating container technology for enhanced security by Niklas Saari
Navigating container technology for enhanced security by Niklas Saari
Metosin Oy14 views
Headless JS UG Presentation.pptx by Jack Spektor
Headless JS UG Presentation.pptxHeadless JS UG Presentation.pptx
Headless JS UG Presentation.pptx
Jack Spektor7 views
AI and Ml presentation .pptx by FayazAli87
AI and Ml presentation .pptxAI and Ml presentation .pptx
AI and Ml presentation .pptx
FayazAli8711 views
DSD-INT 2023 Leveraging the results of a 3D hydrodynamic model to improve the... by Deltares
DSD-INT 2023 Leveraging the results of a 3D hydrodynamic model to improve the...DSD-INT 2023 Leveraging the results of a 3D hydrodynamic model to improve the...
DSD-INT 2023 Leveraging the results of a 3D hydrodynamic model to improve the...
Deltares6 views
DSD-INT 2023 Machine learning in hydraulic engineering - Exploring unseen fut... by Deltares
DSD-INT 2023 Machine learning in hydraulic engineering - Exploring unseen fut...DSD-INT 2023 Machine learning in hydraulic engineering - Exploring unseen fut...
DSD-INT 2023 Machine learning in hydraulic engineering - Exploring unseen fut...
Deltares7 views
DSD-INT 2023 Delft3D FM Suite 2024.01 1D2D - Beta testing programme - Geertsema by Deltares
DSD-INT 2023 Delft3D FM Suite 2024.01 1D2D - Beta testing programme - GeertsemaDSD-INT 2023 Delft3D FM Suite 2024.01 1D2D - Beta testing programme - Geertsema
DSD-INT 2023 Delft3D FM Suite 2024.01 1D2D - Beta testing programme - Geertsema
Deltares17 views
Myths and Facts About Hospice Care: Busting Common Misconceptions by Care Coordinations
Myths and Facts About Hospice Care: Busting Common MisconceptionsMyths and Facts About Hospice Care: Busting Common Misconceptions
Myths and Facts About Hospice Care: Busting Common Misconceptions
Quality Engineer: A Day in the Life by John Valentino
Quality Engineer: A Day in the LifeQuality Engineer: A Day in the Life
Quality Engineer: A Day in the Life
John Valentino6 views
Airline Booking Software by SharmiMehta
Airline Booking SoftwareAirline Booking Software
Airline Booking Software
SharmiMehta6 views
DSD-INT 2023 Simulating a falling apron in Delft3D 4 - Engineering Practice -... by Deltares
DSD-INT 2023 Simulating a falling apron in Delft3D 4 - Engineering Practice -...DSD-INT 2023 Simulating a falling apron in Delft3D 4 - Engineering Practice -...
DSD-INT 2023 Simulating a falling apron in Delft3D 4 - Engineering Practice -...
Deltares6 views
Dev-HRE-Ops - Addressing the _Last Mile DevOps Challenge_ in Highly Regulated... by TomHalpin9
Dev-HRE-Ops - Addressing the _Last Mile DevOps Challenge_ in Highly Regulated...Dev-HRE-Ops - Addressing the _Last Mile DevOps Challenge_ in Highly Regulated...
Dev-HRE-Ops - Addressing the _Last Mile DevOps Challenge_ in Highly Regulated...
TomHalpin96 views
Dev-Cloud Conference 2023 - Continuous Deployment Showdown: Traditionelles CI... by Marc Müller
Dev-Cloud Conference 2023 - Continuous Deployment Showdown: Traditionelles CI...Dev-Cloud Conference 2023 - Continuous Deployment Showdown: Traditionelles CI...
Dev-Cloud Conference 2023 - Continuous Deployment Showdown: Traditionelles CI...
Marc Müller37 views

Collaborative Terraform with Atlantis

  • 2. Introduction Ferenc Kovács DevOps guy from Budapest, Hungary Infrastructure Tech Lead at IBM Budapest Lab FLOSS enthusiast
  • 3. What is Terraform? “Terraform is an infrastructure as code tool that lets you build, change, and version cloud and on-prem resources safely and efficiently.”
  • 4. No but really, what is Terraform? “Random” IaC code executed on someone’s laptop, then not properly merged to git.
  • 5. What is the problem with local apply? - Prone to “works on my machine” issues - Diverging tf and provider versions. - Diverging tf/environment vars. - Lack of visibility/auditability - Who applied what/when and what was the output/error? - People need access to the remote state. - People need credentials for the providers.
  • 6. What is the problem with local apply? - Even if you do code reviews in Github it is cumbersome to copy/paste plan outputs and apply can always fail regardless(we are dependent not just our code correctness but the state/availability of the provider APIs).
  • 7. The solution We need a predictable, trusted and audited environment where terraform actions can be executed and preferably integrated with VCS.
  • 8. Terraform Cloud/Enterprise - It’s a solution from Hashicorp, it is tightly integrated with terraform itself. - Allows you to use remote terraform execution and it allows you to centrally manage the env variables/secrets. - Requires you to store the remote state there, but they have a self-hosted Enterprise install($$$). - The free-tier plan is really nice, if you have max 5 people using it and you don’t mind using a closed source third party solution.
  • 9. Env0 - It is a more complex solution, supports most of the available IaC tools (TF, CF, Pulumi, etc.). - This is also a closed source 3rd party, but as part of their Business/Enterprise offering they also provide Self-hosted agents which allows you to keep your workload and secrets on-prem. - They have nice documentation comparing their offering to TF Cloud and Atlantis. - No free plan, only free-trial.
  • 10. Garden.io - It is a more complex solution, supports most of the available IaC tools (TF, CF, Pulumi, etc.). - It makes it possible to declare all of your heterogen stack declaration/pipelines in an uniform way and chain them together. Creating a new environment from a single command. - The Garden core tool is open-source, but the centralized execution environment is a paid (closed source) feature. - They also have a self-hosted Enterprise offering.
  • 11. Scalr - They only focus on Terraform, much simpler than Env0 or Garden. - They also provide local agents as part of the enterprise offering, but you can’t host your secrets for yourself. - They have a free plan of 50 runs per month, max 50 users and max 100 workspaces.
  • 12. Spacelift - It is a more complex solution, supports most of the available IaC tools (TF, CF, Pulumi, etc.). - This is also a closed source 3rd party, but as part of their Enterprise offering they also provide a hybrid-saas and a self-hosted option which allows you to keep your workload and secrets on-prem. - They have nice documentation comparing their offering to TF Cloud and Atlantis. - They have a forever free plan for 2 users.
  • 13. But what about Atlantis? - https://runatlantis.io/ - It is mostly for Terraform (but stuff like Terragrunt and cdktf are also supported). - It is a truly open-source solution, with a permissive Apache license. - Because it’s open-source there is a bunch of integration with all kind of tools and services. - It has an extendable workflow system, and if something is still lacking you can send a Pull Request. - But you have to configure and host it for yourself.
  • 14. (Average)Atlantis workflow 1. You create a Pull Request with your changes. 2. You “atlantis plan” (if autoplan is not enabled), atlantis executes terraform init & plan and comments the result to the PR. You iterate until your plan is successful and looks good. 3. Somebody reviews and approves your PR. 4. You “atlantis apply” (if autoapply is not enabled), atlantis executes terraform apply and comments the result to the PR. You iterate until your apply is successful. 5. Merge the PR.
  • 16. Supported Installation Methods ● Docker container ● Helm chart ● Kubernetes Manifest ● Kubernetes Kustomize ● Terraform module for AWS Fargate ● Terraform module for GCE ● Terraform module for Azure (but helm chart also works) ● Roll your own (it’s just running a single binary, really) ● For dev/test purposes you can also just run it and expose with Ngrok (but don’t forget restricting it).
  • 17. Supported VCSs ● Github/Github enterprise, with user+pat or with Github App integration ● Gitlab/Gitlab enterprise with pat ● Bitbucket Cloud with pat ● Bitbucket Server with pat ● Azure Devops with pat
  • 18. Terraform version support ● Atlantis will honor the required_version in your workspace, but you can also explicitly specify a default and a workspace specific terraform version in your atlantis.yaml. ● Atlantis will resolve and install your providers/plugins as it would happen if you manually executed terraform init. ● From personal experience if you decide to change/bump your version constraints mid-plan you will need to discard your current plan and plan again.
  • 19. Atlantis locking Atlantis introduces an additional lock mechanism, any terraform workspace which have an active Atlantis plan will be locked, so concurrent Pull Requests won’t be able to plan for the same workspace until the previous plan is either applied or discarded. You can discard plans from the github PR or from the atlantis UI.
  • 20. Customizing Atlantis 1. You can have global configuration options which can be set through arguments/config file values or environment variables passed to the Atlantis binary. 2. For repository specific settings you can use a Server-Side Repo Config. 3. You can also have an atlantis.yaml file in the root of your terraform repositories, which can modify atlantis behavior on a repo or workspace level.
  • 21. Repo structures ● You can have a terraform workspace in your repo. ● You can have multiple workspaces as top level directories in your repo. ● You can have workspace directories in a tree-like structure. ● You can declare relations between your workspaces in atlantis.yaml, and atlantis will help you to cascade the plans between workspaces. ● You can have multiple repositories managed by a single Atlantis instance.
  • 22. Command Requirements ● Atlantis supports the following requirements: ○ Approved ○ Mergeable ○ UnDiverged ● You can use these as to specify when can plan, apply and import execute. ● By default after the apply requirement are met (plan is green, PR is approved, etc.) anybody who can comment can atlantis apply, you can change this with gh-team-allowlist.
  • 23. Security ● Make sure to read through the security documentation: ○ https://www.runatlantis.io/docs/security.html ● Follow your company’s Security Standards and consider Atlantis as a critical production asset. ● Use webhook secrets and you can also additionally firewall atlantis to restrict webhook access from your VCS only. ● You can also put a WAF in front of it just in case.
  • 24. Thanks for your attention! Slides will be here: http://www.slideshare.net/Tyrael If you have any questions: tyrael@tyrael.hu @Tyr43l