Skip to content

refactor!: gce-container-declaration deprecation #188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
d-costa merged 1 commit into from
Nov 19, 2025
Merged

refactor!: gce-container-declaration deprecation #188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,9 +204,7 @@ You can check the status of the certificate in the Google Cloud Console.

## Modules

| Name | Source | Version |
|------|--------|---------|
| <a name="module_container"></a> [container](#module\_container) | terraform-google-modules/container-vm/google | ~> 3.2 |
No modules.

## Resources

Expand Down Expand Up @@ -234,9 +232,9 @@ You can check the status of the certificate in the Google Cloud Console.

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_args"></a> [args](#input\_args) | Arguments to override the container image default command (CMD). | `list(string)` | `null` | no |
| <a name="input_args"></a> [args](#input\_args) | Arguments to override the container image default command (CMD). | `list(string)` | `[]` | no |
| <a name="input_block_project_ssh_keys_enabled"></a> [block\_project\_ssh\_keys\_enabled](#input\_block\_project\_ssh\_keys\_enabled) | Blocks the use of project-wide publich SSH keys | `bool` | `false` | no |
| <a name="input_command"></a> [command](#input\_command) | Command to override the container image ENTRYPOINT | `list(string)` | `null` | no |
| <a name="input_command"></a> [command](#input\_command) | Command to override the container image ENTRYPOINT | `list(string)` | `[]` | no |
| <a name="input_default_backend_security_policy"></a> [default\_backend\_security\_policy](#input\_default\_backend\_security\_policy) | Name of the security policy to apply to the default backend service | `string` | `null` | no |
| <a name="input_disk_kms_key_self_link"></a> [disk\_kms\_key\_self\_link](#input\_disk\_kms\_key\_self\_link) | The self link of the encryption key that is stored in Google Cloud KMS | `string` | `null` | no |
| <a name="input_domain"></a> [domain](#input\_domain) | Domain to associate Atlantis with and to request a managed SSL certificate for. Without `https://` | `string` | n/a | yes |
Expand Down
107 changes: 43 additions & 64 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,11 @@ locals {
atlantis_network_traffic_tags = ["atlantis-${random_string.random.result}"]
atlantis_labels = merge(
var.labels,
module.container.container_vm.labels,
{ "vm" = module.container.container_vm.name },
{ "app" = "atlantis" }
)
atlantis_persistent_disk_name = "atlantis-disk-0"
atlantis_disk_mount_path = "/mnt/disks/gce-containers-mounts/gce-persistent-disks/${local.atlantis_persistent_disk_name}"
atlantis_uid = 100
}

resource "random_string" "random" {
Expand All @@ -38,7 +39,20 @@ data "cloudinit_config" "config" {
base64_encode = false

part {
filename = "atlantis-chown-disk.service"
filename = "runcmda"
content_type = "text/cloud-config"
merge_type = "list(append)+dict(no_replace, recurse_list)+str()"
content = yamlencode({
runcmd = [
"systemctl daemon-reload",
"systemctl start --no-block atlantis-chown-disk.service",
"systemctl start --no-block atlantis.service"
]
})
}

part {
filename = "services"
content_type = "text/cloud-config"
content = yamlencode({
write_files = [
Expand All @@ -49,10 +63,32 @@ data "cloudinit_config" "config" {
content = <<EOF
[Unit]
Description=Change ownership of the mount path to the Atlantis uid
Wants=konlet-startup.service
After=konlet-startup.service
Wants=docker.service
After=docker.service
[Service]
ExecStart=/bin/chown ${local.atlantis_uid} ${local.atlantis_disk_mount_path}
Restart=on-failure
RestartSec=30
StandardOutput=journal+console
[Install]
WantedBy=multi-user.target
EOF
},
# https://cloud.google.com/container-optimized-os/docs/how-to/create-configure-instance#use-cloud-init
# we are specifying `--publish 0.0.0.0` since `--network host` was binding to an ipv6 port.
{
path = "/etc/systemd/system/atlantis.service"
permissions = "0644"
owner = "root"
content = <<EOF
[Unit]
Description=Start atlantis container
Wants=atlantis-chown-disk.service
After=atlantis-chown-disk.service
[Service]
ExecStart=/bin/chown 100 /mnt/disks/gce-containers-mounts/gce-persistent-disks/atlantis-disk-0
ExecStart=/usr/bin/docker run -u ${local.atlantis_uid} --rm --publish '0.0.0.0:${local.atlantis_port}:${local.atlantis_port}' -v ${local.atlantis_disk_mount_path}:${local.atlantis_data_dir} %{for key, value in var.env_vars} -e '${key}=${value}'%{endfor} --name=atlantis ${var.image} ${join(" ", var.command)} ${join(" ", var.args)}
ExecStop=/usr/bin/docker stop atlantis
ExecStopPost=/usr/bin/docker rm atlantis
Restart=on-failure
RestartSec=30
StandardOutput=journal+console
Expand All @@ -63,62 +99,6 @@ data "cloudinit_config" "config" {
]
})
}

part {
filename = "runcmda"
content_type = "text/cloud-config"
merge_type = "list(append)+dict(no_replace, recurse_list)+str()"
content = yamlencode({
runcmd = [
"systemctl daemon-reload",
"systemctl start --no-block atlantis-chown-disk.service"
]
})
}
}

module "container" {
source = "terraform-google-modules/container-vm/google"
version = "~> 3.2"

cos_image_name = var.machine_image != null ? element(split("/", var.machine_image), length(split("/", var.machine_image)) - 1) : null

container = {
image = var.image
securityContext = {
privileged = false
}
tty = true
env = [for key, value in var.env_vars : {
name = key
value = value
}]
command = var.command
args = var.args

# Declare volumes to be mounted.
# This is similar to how docker volumes are declared.
volumeMounts = [
{
mountPath = local.atlantis_data_dir
name = "atlantis-disk-0"
readOnly = false
},
]
}

volumes = [
{
name = "atlantis-disk-0"

gcePersistentDisk = {
pdName = "atlantis-disk-0"
fsType = "ext4"
}
},
]

restart_policy = "Always"
}

resource "google_compute_instance_template" "default" {
Expand All @@ -131,7 +111,6 @@ resource "google_compute_instance_template" "default" {
metadata_startup_script = var.startup_script

metadata = {
gce-container-declaration = module.container.metadata_value
user-data = data.cloudinit_config.config.rendered
google-logging-enabled = var.google_logging_enabled
google-monitoring-enabled = var.google_monitoring_enabled
Expand Down Expand Up @@ -174,7 +153,7 @@ resource "google_compute_instance_template" "default" {

# Persistent disk for Atlantis
disk {
device_name = "atlantis-disk-0"
device_name = local.atlantis_persistent_disk_name
disk_type = var.persistent_disk_type
mode = "READ_WRITE"
disk_size_gb = var.persistent_disk_size_gb
Expand Down
4 changes: 2 additions & 2 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,13 @@ variable "image" {
variable "command" {
type = list(string)
description = "Command to override the container image ENTRYPOINT"
default = null
default = []
}

variable "args" {
type = list(string)
description = "Arguments to override the container image default command (CMD)."
default = null
default = []
}

variable "env_vars" {
Expand Down