From 7c318226916bf06144038725a9047ab98d840f35 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Mon, 3 Aug 2026 16:07:35 -0700 Subject: [PATCH 1/3] feat: replace terraform github actions with atlantis --- .github/workflows/terraform-apply.yml | 61 --------- .github/workflows/terraform-plan.yml | 129 ------------------ atlantis.yaml | 11 ++ infra/environments/prod/.terraform.lock.hcl | 84 ------------ kubernetes/gr-foundry/apps/atlantis.yaml | 23 ++++ .../manifests/atlantis/ingress.yaml | 20 +++ .../manifests/atlantis/kustomization.yaml | 13 ++ .../manifests/atlantis/namespace.yaml | 4 + .../manifests/atlantis/service.yaml | 12 ++ .../manifests/atlantis/statefulset.yaml | 75 ++++++++++ .../manifests/atlantis/vaultsecretsync.yaml | 22 +++ 11 files changed, 180 insertions(+), 274 deletions(-) delete mode 100644 .github/workflows/terraform-apply.yml delete mode 100644 .github/workflows/terraform-plan.yml create mode 100644 atlantis.yaml create mode 100644 kubernetes/gr-foundry/apps/atlantis.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/ingress.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/kustomization.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/namespace.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/service.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/statefulset.yaml create mode 100644 kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml deleted file mode 100644 index f94d10e..0000000 --- a/.github/workflows/terraform-apply.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: terraform apply - -on: - push: - branches: [main] - paths: - - "infra/**" - - ".github/workflows/terraform-*.yml" - workflow_dispatch: - inputs: - env: - description: "Environment to apply" - required: true - default: "prod" - type: choice - options: [prod] - -permissions: - contents: read - id-token: write # for AWS OIDC - -jobs: - apply: - name: apply (${{ matrix.env }}) - runs-on: ubuntu-latest - - # The `production` GitHub Environment is the gate: configure required - # reviewers in repo Settings → Environments → production. Apply jobs - # will park here until a reviewer approves. - environment: production - - env: - # Cloudflare provider picks this up automatically. - CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} - - strategy: - fail-fast: false - matrix: - env: [prod] - - defaults: - run: - working-directory: infra/environments/${{ matrix.env }} - - steps: - - uses: actions/checkout@v4 - - - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: 1.15.5 - - - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_TERRAFORM_ROLE_ARN }} - aws-region: us-west-2 - - - name: terraform init - run: terraform init -no-color -input=false - - - name: terraform apply - run: terraform apply -no-color -input=false -auto-approve diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml deleted file mode 100644 index e6cae39..0000000 --- a/.github/workflows/terraform-plan.yml +++ /dev/null @@ -1,129 +0,0 @@ -name: terraform plan - -on: - pull_request: - paths: - - "infra/**" - - ".github/workflows/terraform-*.yml" - -permissions: - contents: read - pull-requests: write # for posting plan as a PR comment - id-token: write # for AWS OIDC - -jobs: - plan: - name: plan (${{ matrix.env }}) - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - env: [prod] - - env: - # Cloudflare provider picks this up automatically. - CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} - - defaults: - run: - working-directory: infra/environments/${{ matrix.env }} - - steps: - - uses: actions/checkout@v4 - - - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: 1.15.5 - - - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_TERRAFORM_ROLE_ARN }} - aws-region: us-west-2 - - - name: terraform fmt - id: fmt - working-directory: infra - run: terraform fmt -check -recursive - continue-on-error: true - - - name: terraform init - id: init - run: terraform init -no-color - - - name: terraform validate - id: validate - run: terraform validate -no-color - - - name: terraform plan - id: plan - run: terraform plan -no-color -input=false - continue-on-error: true - - - name: post plan as PR comment - uses: actions/github-script@v7 - env: - PLAN: ${{ steps.plan.outputs.stdout }} - with: - script: | - const fmt = '${{ steps.fmt.outcome }}' - const init = '${{ steps.init.outcome }}' - const validate = '${{ steps.validate.outcome }}' - const plan = '${{ steps.plan.outcome }}' - const env = '${{ matrix.env }}' - - // Truncate plan output if it would blow past GitHub's 65k char - // comment limit. Last 60k chars is usually where the relevant - // resource diffs end up. - let planOut = process.env.PLAN || '' - const MAX = 60000 - if (planOut.length > MAX) { - planOut = '...(truncated)...\n' + planOut.slice(-MAX) - } - - const body = `### Terraform plan: \`${env}\` - - | step | result | - |---|---| - | fmt | \`${fmt}\` | - | init | \`${init}\` | - | validate | \`${validate}\` | - | plan | \`${plan}\` | - -
plan output - - \`\`\`hcl - ${planOut} - \`\`\` - -
- ` - - // Find and edit an existing comment from this workflow if it - // exists, otherwise post a new one. Keeps the PR tidy on - // re-runs. - const { data: comments } = await github.rest.issues.listComments({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - }) - const marker = `### Terraform plan: \`${env}\`` - const existing = comments.find((c) => c.body.startsWith(marker)) - if (existing) { - await github.rest.issues.updateComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: existing.id, - body, - }) - } else { - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body, - }) - } - - - name: fail if any step failed - if: steps.fmt.outcome == 'failure' || steps.plan.outcome == 'failure' - run: exit 1 diff --git a/atlantis.yaml b/atlantis.yaml new file mode 100644 index 0000000..0409d35 --- /dev/null +++ b/atlantis.yaml @@ -0,0 +1,11 @@ +version: 3 +automerge: false +projects: + - name: prod + dir: infra/environments/prod + terraform_version: v1.15.5 + autoplan: + when_modified: + - "**/*.tf" + - ".terraform.lock.hcl" + - "../../modules/**/*.tf" diff --git a/infra/environments/prod/.terraform.lock.hcl b/infra/environments/prod/.terraform.lock.hcl index 35966e3..0387b62 100644 --- a/infra/environments/prod/.terraform.lock.hcl +++ b/infra/environments/prod/.terraform.lock.hcl @@ -42,69 +42,6 @@ provider "registry.terraform.io/hashicorp/aws" { ] } -provider "registry.terraform.io/hashicorp/cloudinit" { - version = "2.4.0" - constraints = ">= 2.0.0" - hashes = [ - "h1:4fp7byXJGbOU8zqxFM4yYGHzf1kUH8ChT41KK4n9q98=", - "zh:1b0fe71b8e87a068f7cd9faaa733100ab72ab61ce812b8bd2b8e3e6ea3907b2d", - "zh:2aa9631ad64cfda1eb58f147619b631dadedfaf9453b422aa5ada2d3861183c1", - "zh:2c5f35463bdfb2f87d3576b81e62c30f8109e67bb6f21ffcbc46a855811455c0", - "zh:5970bcad151ea236bd262ada1a5a23bfbc1716f94a4e8b16ab2bcdda91d6a671", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:79a0676909732b6ec0441a733af6383513cde3bd2cef5c1ad0a74131e1286a04", - "zh:818f16141481a1202b3977becd19a12d4d46cd2e3f5753f5d0d0049adacf8f8c", - "zh:948d98716831087e69eca99f91ed7964cc537f3aca279f7494645ee56c9dc4ec", - "zh:a75e78889565a51df3e8e3af207e36e5ddb25e47ce1780a784c82dc3c3109b67", - "zh:a9c6e455d52b1bba5272bd87a35cfabcfd6d903dcbe42e2de926228dbb1e39b2", - "zh:b846805d8c2f5d1d6c2ffeeaf32109d9af7db7fa3c56929bfc1dcfaadf9c8bd8", - "zh:c3e5279756b46c4f49a6f4c81347fbe2fffebb2bf18a5c24664830304a1f6a8e", - "zh:c8be7b31893163d0046b0137a6100533f07e8efd192a1903b6bb4c42be12dceb", - ] -} - -provider "registry.terraform.io/hashicorp/helm" { - version = "3.2.0" - constraints = "~> 3.0" - hashes = [ - "h1:3WcDkgmMy9vTO6hSMzqI7o4nNeSa5AXDENxk6WphT6w=", - "zh:2f1d55bf4e6a9c2629dfd3b162a05632f2e251bf6083d8613f38af3d51cea553", - "zh:33b378f15d39c2050a9272f6d5e8437f162972c93244af6df6de54ba2b0a416c", - "zh:501d7e7b3d42f5b40a6e5e979d5a6a4d67eba0fb37d786e2c3d7186e742dd557", - "zh:52e430da694bad4a06d049aa574d4a7a2b4e11c47d7bab637131068cc1160593", - "zh:77fb8ecaa27f4218177917bb3865551b058b92193408fa20366c45a529f0ac94", - "zh:b114d6ea5ab4486dc26b83cd595f0af820b3d66d0d1cf81975dfe7baa84419e2", - "zh:b6729f6f32fab90945e3cb4ba0268b73262dad0d14c1d71514ac767bac644595", - "zh:b9ff1756e698e1d3bdb0c2605ee31794f15d8275e2f8817a2bf66f3272ed9362", - "zh:be4791496afea715783f0efb65d21c99d3dc84ddb94ba4868f3afee2d50e71ef", - "zh:c8f66bd76991d7521a805cce3000a5226b1b18baf1d6b63a03d38e09208a564b", - "zh:e2bdd80b8956307f7307f90ffab0e91169bb83babeb540c712239dbc5c09916f", - "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", - "zh:fcda8394edc50d2a2132534edf8655cb25dc76f55937e859b9ffb5f787430f37", - ] -} - -provider "registry.terraform.io/hashicorp/null" { - version = "3.3.0" - constraints = ">= 3.0.0" - hashes = [ - "h1:a14TKo7Xvg4W8+H1VA6p+oLZTLxVQnYUD8LOaOs14A8=", - "zh:021748b5ea3b5f6956f2e75c42c5cdc113b391fb98ac71364a4965d23b37000f", - "zh:3b27956f8541d46704fda234e0d535c2ae2a4b33411848b1ee262a1ec03568b0", - "zh:3de4ed47d6d0f4d8edba4a5092c7c9799950eda63989d8d0d2586e6afcb0aa20", - "zh:57ed8935c7d56dbc91cf2673534582cacfaab7a2f105f51d9f797e99df0c0c47", - "zh:58e176ba1d142827089e30e0711e007309a9f2726e8881986da5026e9778fdf4", - "zh:5949c4a3d4a93f841f155cdb7e991c087e637145c1630572e21948224f8f4923", - "zh:76d60f366b743003c1b085afa769b45b2198ee919927e45807d7d44fb42c067d", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:79cd1bab1261a07f84e917191d7ddc4340ac5f5524283767256f7ffd7f87caf0", - "zh:8ec9083038cf710b30e319eaa467c9df7fa52bbd9969b61053a35bc2cdd2e0a6", - "zh:a6e502cb579685ab7aeb886c2bb11ddd9cfed74b41008592d57cbc3351a9218b", - "zh:acb74d6b4f66ff6acfcda315df802a7432170ef3955c9b432cb4580767004006", - "zh:f0ce55d8d9ffdb33dab612b1246f9bab060a9d54fc32ce2b4a038646155660af", - ] -} - provider "registry.terraform.io/hashicorp/random" { version = "3.9.0" constraints = "~> 3.0" @@ -126,27 +63,6 @@ provider "registry.terraform.io/hashicorp/random" { ] } -provider "registry.terraform.io/hashicorp/time" { - version = "0.14.0" - constraints = ">= 0.9.0" - hashes = [ - "h1:/hlxsUpuN/lvPTNL9+NyVGsOyRsK5NsxwFMsj5CdOp4=", - "zh:12abfd6b800e4d7fa6db7310dec8ffd440b31993861ef188c7ed5260b3073937", - "zh:23005521e800bb19e1597bf755c5f70d675d30b685d4255001ed5fa47d9df3f1", - "zh:2fea249b582ae97cd1cc10385187ea50993bb47c28cc5df0305e57ceaabf0a10", - "zh:322018d3b987b7aad08697178029a2bb667bed699e88328f0c89c52a2fd41341", - "zh:32a08e98fce2d273cb9b2c89d6c54727cc9f0a32e15bfd896be4e02cc6b48f95", - "zh:3db89aabd0e619616bd4b0f8b373a7586dfe60feffcea12a84a0bdbc445714b3", - "zh:7488f56c81d742dc020f29063626c8f07ca188aa97be61e7307e8d62397020a2", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:7cb4067f2e7559b13f7562ef722f948950901eb37834873e98360ab28f66e9d7", - "zh:9d552c8345f61e1b7db8e725144981345f18ac1014d58d6f5ddf0928a195fffb", - "zh:a8e69fb6b97fc9d86fb19a9f4d42abe33c4a68e700b15387ce2e17d2b9934bed", - "zh:aeeb900eb8dd0f790c60ea5c0e0c8d42bd6e4a54f391681d4decca15b544394b", - "zh:c239c619101a8c95e1f14061eb973c57a8d15fa0e68878ced5bbd76858ee5b79", - ] -} - provider "registry.terraform.io/hashicorp/tls" { version = "4.3.0" constraints = ">= 4.0.0" diff --git a/kubernetes/gr-foundry/apps/atlantis.yaml b/kubernetes/gr-foundry/apps/atlantis.yaml new file mode 100644 index 0000000..fd3eadb --- /dev/null +++ b/kubernetes/gr-foundry/apps/atlantis.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: atlantis + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: https://github.com/Gaucho-Racing/infrastructure.git + targetRevision: main + path: kubernetes/gr-foundry/manifests/atlantis + destination: + server: https://kubernetes.default.svc + namespace: atlantis + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/kubernetes/gr-foundry/manifests/atlantis/ingress.yaml b/kubernetes/gr-foundry/manifests/atlantis/ingress.yaml new file mode 100644 index 0000000..b1a5ba3 --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/ingress.yaml @@ -0,0 +1,20 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: atlantis + namespace: atlantis + annotations: + external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" +spec: + ingressClassName: traefik + rules: + - host: atlantis.gauchoracing.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: atlantis + port: + number: 4141 diff --git a/kubernetes/gr-foundry/manifests/atlantis/kustomization.yaml b/kubernetes/gr-foundry/manifests/atlantis/kustomization.yaml new file mode 100644 index 0000000..4dfa203 --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - namespace.yaml + - vaultsecretsync.yaml + - statefulset.yaml + - service.yaml + - ingress.yaml + +images: + - name: ghcr.io/runatlantis/atlantis + newTag: v0.46.0 diff --git a/kubernetes/gr-foundry/manifests/atlantis/namespace.yaml b/kubernetes/gr-foundry/manifests/atlantis/namespace.yaml new file mode 100644 index 0000000..ca8dae7 --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: atlantis diff --git a/kubernetes/gr-foundry/manifests/atlantis/service.yaml b/kubernetes/gr-foundry/manifests/atlantis/service.yaml new file mode 100644 index 0000000..60c77fd --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: atlantis + namespace: atlantis +spec: + selector: + app: atlantis + ports: + - name: atlantis + port: 4141 + targetPort: 4141 diff --git a/kubernetes/gr-foundry/manifests/atlantis/statefulset.yaml b/kubernetes/gr-foundry/manifests/atlantis/statefulset.yaml new file mode 100644 index 0000000..98b5f21 --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/statefulset.yaml @@ -0,0 +1,75 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: atlantis + namespace: atlantis +spec: + serviceName: atlantis + replicas: 1 + selector: + matchLabels: + app: atlantis + template: + metadata: + labels: + app: atlantis + spec: + securityContext: + fsGroup: 1000 + containers: + - name: atlantis + image: ghcr.io/runatlantis/atlantis:latest + ports: + - name: atlantis + containerPort: 4141 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "1" + memory: 1Gi + readinessProbe: + httpGet: + path: /healthz + port: 4141 + periodSeconds: 60 + livenessProbe: + httpGet: + path: /healthz + port: 4141 + periodSeconds: 60 + envFrom: + - secretRef: + name: atlantis-secrets + env: + - name: ATLANTIS_DATA_DIR + value: /atlantis + # Kubernetes injects its own ATLANTIS_PORT from the Service; override it. + - name: ATLANTIS_PORT + value: "4141" + - name: ATLANTIS_ATLANTIS_URL + value: https://atlantis.gauchoracing.com + - name: ATLANTIS_REPO_ALLOWLIST + value: github.com/Gaucho-Racing/infrastructure + - name: ATLANTIS_GH_APP_SLUG + value: gaucho-racing-atlantis + - name: ATLANTIS_WRITE_GIT_CREDS + value: "true" + - name: ATLANTIS_WEB_BASIC_AUTH + value: "true" + - name: ATLANTIS_WEB_USERNAME + value: gaucho + - name: ATLANTIS_REPO_CONFIG_JSON + value: '{"repos":[{"id":"github.com/Gaucho-Racing/infrastructure","apply_requirements":["approved","mergeable"],"plan_requirements":[],"import_requirements":["approved"]}]}' + volumeMounts: + - name: atlantis-data + mountPath: /atlantis + volumeClaimTemplates: + - metadata: + name: atlantis-data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 5Gi diff --git a/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml b/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml new file mode 100644 index 0000000..77f6b5e --- /dev/null +++ b/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml @@ -0,0 +1,22 @@ +apiVersion: vault.gauchoracing.com/v1alpha1 +kind: VaultSecretSync +metadata: + name: atlantis-secrets + namespace: atlantis +spec: + serviceAccountName: default + target: + name: atlantis-secrets + type: Opaque + refreshInterval: 5m + rolloutTargets: + - kind: StatefulSet + name: atlantis + secrets: + ATLANTIS_GH_APP_ID: atlantis-prod.gh_app_id + ATLANTIS_GH_APP_KEY: atlantis-prod.gh_app_key + ATLANTIS_GH_WEBHOOK_SECRET: atlantis-prod.gh_webhook_secret + ATLANTIS_WEB_PASSWORD: atlantis-prod.web_password + AWS_ACCESS_KEY_ID: atlantis-prod.aws_access_key_id + AWS_SECRET_ACCESS_KEY: atlantis-prod.aws_secret_access_key + CLOUDFLARE_API_TOKEN: atlantis-prod.cloudflare_api_token From d3e92cf99a373e6e40c43cad48ee2e3fa3a28d4d Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Mon, 3 Aug 2026 16:12:23 -0700 Subject: [PATCH 2/3] feat: add dev environment root targeting gr-dev account --- atlantis.yaml | 4 +-- infra/environments/dev/.terraform.lock.hcl | 26 +++++++++++++++ infra/environments/dev/backend.tf | 37 ++++++++++++++++++++++ 3 files changed, 65 insertions(+), 2 deletions(-) create mode 100644 infra/environments/dev/.terraform.lock.hcl create mode 100644 infra/environments/dev/backend.tf diff --git a/atlantis.yaml b/atlantis.yaml index 0409d35..9692c79 100644 --- a/atlantis.yaml +++ b/atlantis.yaml @@ -1,8 +1,8 @@ version: 3 automerge: false projects: - - name: prod - dir: infra/environments/prod + - name: dev + dir: infra/environments/dev terraform_version: v1.15.5 autoplan: when_modified: diff --git a/infra/environments/dev/.terraform.lock.hcl b/infra/environments/dev/.terraform.lock.hcl new file mode 100644 index 0000000..1801b69 --- /dev/null +++ b/infra/environments/dev/.terraform.lock.hcl @@ -0,0 +1,26 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "6.57.1" + constraints = "~> 6.0" + hashes = [ + "h1:Mz2BVjntgeXCYLdhPCpgTBvGNPmxJBJxqq5M4r27Hc8=", + "zh:2d29e22480a81c21fb3f2fd52f9bd3ca4a82c37f3bb1b1036e881e42cddc75a1", + "zh:33aeb08e9973199b30f8a8e48a58dc67cfb6e32879f7a1c05c521899fe718f53", + "zh:37b7f977a7e7d45ad11d42958bc264873fb34573eee925915038ea05607abc9e", + "zh:41ebdcf4bcd073a01d58505a5f5118b85668de357d2d9f266926923e817a1842", + "zh:43093dfc3559c2c0467c92f48b29ae0221d52e912fce03dd77abd90806fdcc7d", + "zh:63b4252933e828d3590c0c64b827ec0f8955aa52df719fe67f45a846111fccc4", + "zh:7473b036e9f8167c7a09e4865de95d07922eae6a612b94e819d44c87ba5298de", + "zh:783c73e66bf50a74983803e1ec6d6237bae2891f9d4fd4824cfd5350121552ae", + "zh:83681e1d8d002048b76d7144cb96c8c8501dc973d1fee41b7579a46ad9eb04c2", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:b08b4168d4e2a81badbbe65d95f692ed3292c2b71cd00b9889a3bb7cf54c1188", + "zh:b4320ca25f4f67beebcbd6563ece2e490bd9dcb0a7e59b5d7a437ddaf53768ed", + "zh:d7f99254d6e05bac3dffae9b437c47cd807b4e66d941e56364be0a28ead418bd", + "zh:e433e91689758a341c91840cc7b5d3a3c5089004766d20659d57199b88ad8a5f", + "zh:e4c5a9b0f96a5fe2b5ed5592d4c2ac33240cf5308bcb14e52d6f2e0eb183a014", + "zh:fc4b554ae98e40e3ab6878ec9501ba2b05213d30668ee357d48b207993ffbe03", + ] +} diff --git a/infra/environments/dev/backend.tf b/infra/environments/dev/backend.tf new file mode 100644 index 0000000..b3883e8 --- /dev/null +++ b/infra/environments/dev/backend.tf @@ -0,0 +1,37 @@ +# Dev environment root — resources land in the Gaucho Racing Development +# member account (104050870528) via assume-role; state stays in the shared +# tfstate bucket in the management account under its own key. +terraform { + required_version = ">= 1.10" + + backend "s3" { + bucket = "gaucho-racing-tfstate" + key = "environments/dev/terraform.tfstate" + region = "us-west-2" + encrypt = true + use_lockfile = true + } + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 6.0" + } + } +} + +provider "aws" { + region = "us-west-2" + + assume_role { + role_arn = "arn:aws:iam::104050870528:role/OrganizationAccountAccessRole" + } + + default_tags { + tags = { + Environment = "dev" + ManagedBy = "terraform" + Repo = "gaucho-racing/infrastructure" + } + } +} From 62a8addce5c5f1eb6e403e2b591a3a762181f9c2 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Mon, 3 Aug 2026 16:46:29 -0700 Subject: [PATCH 3/3] fix: scope atlantis credentials to dev account only --- kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml b/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml index 77f6b5e..1edf06c 100644 --- a/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml +++ b/kubernetes/gr-foundry/manifests/atlantis/vaultsecretsync.yaml @@ -19,4 +19,3 @@ spec: ATLANTIS_WEB_PASSWORD: atlantis-prod.web_password AWS_ACCESS_KEY_ID: atlantis-prod.aws_access_key_id AWS_SECRET_ACCESS_KEY: atlantis-prod.aws_secret_access_key - CLOUDFLARE_API_TOKEN: atlantis-prod.cloudflare_api_token