#atlantis - July 2023

Hello Team,

i am trying to understand if bitbucket user is authenticated to approve using user list

i am following this thread

any help will be appreciated

is there a way we can provide authentication on local machines for developer

to not to run terraform destroy

or add first terraform authenticatoin for users

for any terraform operation like plan apply

so that every user must authenticated

so they will follow only atlantis workflow

right now i can see only loophole

if anyone running via terraform locally

if they have code

if you are in github you can have a list of people/groups that can plan or apply

but there is no such thing as user authenticating against atlantis to then able to run plan or apply

you can disable command that people can run through atlantis

keep in mind that anyone that can run plan can do terraform plan --destroy

Yeah that main concern

That how we avoid or add gate on local terraform execution

there is no way to do that in atlantis

that is a terraform issue to be honest

ohh ok

thanks

anyone that runs terraform will have this issue, and on Gitops this is even more relevant since the GitOps solution ( in this case Atlantis) is able to destroy stuff so it is tricky to do

it could be possible to add some filtering capability in atlantis to parse EXTRA_ARGS as they are called in atlantis to not allow people to run -destroy but that does not do much either since users could have something like count = var.enabled and if they set that to false it will still destroy resources

OPA policies might give you that using post/pre_workflow_hooks in Atlantis

but you need to write the policies for conftest to run etc

v0.24.4
What's Changed
Other Changes
chore(deps): update node.js to v18.16.1 in .node-version by @renovate in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1768878755" data-permission-text="Title is private"...

v0.24.4
What's Changed
Other Changes
chore(deps): update node.js to v18.16.1 in .node-version by @renovate in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1768878755" data-permission-text="Title is private"...

Check out our interview https://www.theiacpodcast.com/episode/atlantis and if you want to help out the atlantis project let me know.

Hi team, I have some question able atlantis version v0.23.5 , I'm run atlantis in EKS & arm64 , atlantis init. trigger this error log as below

running "/atlantis/bin/terraform1.5.3 init -input=false -upgrade" in "/atlantis/repos/meican-cd/terraform-sandbox/891/default/planet/planet-api/sandbox": exit status 2
/atlantis/bin/terraform1.5.3: line 0: syntax error: unexpected end of file (expecting ")")

I believe this caused by env.tf required_version try to use the newest under /atlantis/bin/, but it looks like execution file under /atlantis/bin/ not in the correct arch.

env.tf

terraform
terraform {
required_version = ">= 1.1.7"

After I check the folder /atltantis/bin & using file to check the arch file terraform1.5.3 the arch amd64 is not correct

/atlantis/bin # ls -al
-rwxrwxr-x    1 atlantis atlantis  65110016 Jul 14 10:49 terraform1.5.3

/atlantis/bin # file terraform1.5.3
terraform1.5.3: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=T_LzuXquexv1WdDTxLVV/Besg9qQuP_ixANsswKze/43FLwgxOIbXKTbCNbH5T/2vpZqRaEGftpMi8UYtXu, stripped

Meanwhile the terraform under /user/local/bin has correct arch.

/usr/local/bin # file terraform
terraform: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, Go BuildID=EqDQYkFQGdQC_v7FXFOP/pcPT9BsMT2UN5gE3Eg6d/ZXC87xOc_wyv-rsq_OOr/wkHveeIL-hSKBgScMVuq, stripped
/usr/local/bin #