cloudposse / cloudposse/atmos

Atlantis lock contingency due to Atlantis lock unaware of workspace_key_prefix

Open
#268 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.4k
Forks
175
Avg merge
2d 3h
Merged PRs (30d)
134

Description

## Describe the Feature

expand `terraform_workspace_pattern` to be a global setting and not a per component setting.

## Expected Behavior

When using Atlantis integration the `{workspace}` key should contain a unique name per component for all components not just the ones that inherets other components

## Use Case

When using the `atlantis generate` command :

```
atmos atlantis generate repo-config --config-template config-1 --project-template project-1 --workflow-template workflow-1
```

Atmos will generate an `atlantis.yaml` file like so:

```
version: 3
automerge: true
delete_source_branch_on_merge: true
parallel_plan: true
parallel_apply: true
allowed_regexp_prefixes:
- automation/
- dev/
- staging/
- prod/
projects:
- name: pepe-auto-ue2-atlantis-acm-cert
workspace: pepe-auto-ue2-atlantis-acm-cert
workflow: workflow-1
dir: components/terraform/acm
terraform_version: v1.2.9
delete_source_branch_on_merge: true
autoplan:
enabled: false
when_modified:
- '**/*.tf'
- $PROJECT_NAME.tfvars.json
apply_requirements:
- approved
- name: pepe-auto-ue2-vpc
workspace: pepe-auto-ue2
workflow: workflow-1
dir: components/terraform/vpc
terraform_version: v1.2.9
delete_source_branch_on_merge: true
autoplan:
enabled: false
when_modified:
- '**/*.tf'
- $PROJECT_NAME.tfvars.json
apply_requirements:
- approved
```

this is dedicated from a stack file like so:

```
components:
terraform:
vpc:
vars:
name: vpc
tags:
bn-component: "vpc"
bn-expense-class: "network"
ipv4_primary_cidr_block: "10.10.10.0/18"
nat_gateway_enabled: true
availability_zones:
- us-east-2a
- us-east-2b
- us-east-2c

atlantis/acm/cert:
metadata:
component: acm
type: real
vars:
enabled: true
process_domain_validation_options: yes
validation_method: DNS
```

The problem with this is that atlantis uses the `{workspace}` to create the lock and if components without inheritance or metadata option do not receive a unique workspace name it will create lock contingency at the atlantis level.

same TF workspace (based on environment-stage) for more than one atlantis project (since where are no information about worspace_key_prefix in that context

## Describe Ideal Solution

All component should have a unique name for the workspace which can be used for the atlantis workspace.

## Alternatives Considered

change the template in atlantis to have something like:

```
project_templates:
project-1:
# generate a project entry for each component in every stack
name: "{namespace}-{environment}-{component}"
workspace: "{workspace}-{component}"
dir: "{component-path}"
terraform_version: v1.2.9
delete_source_branch_on_merge: true
apply_requirements:
- "approved"
autoplan:
enabled: false
when_modified:
- "**/*.tf"
- "$PROJECT_NAME.tfvars.json"
```

But this is bad since atmos CLI will use a different workspace and the world will end there.

## Additional Context

posted in the Atmos private channel too.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.