apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: atlantis
spec:
  serviceName: atlantis
  replicas: 1
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      partition: 0
  selector:
    matchLabels:
      app: atlantis
  template:
    metadata:
      labels:
        app: atlantis
    spec:
      securityContext:
        fsGroup: 1000 # Atlantis group (1000) read/write access to volumes.
      containers:
      - name: atlantis
        image: runatlantis/atlantis:latest
        env:
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /mnt/terraform-admin-service-account/thesis-terraform-admin-service-account-creds.json
        - name: ATLANTIS_ALLOW_REPO_CONFIG
          value: "true"
        - name: ATLANTIS_ATLANTIS_URL
          value: https://atlantis.keep-dev.com
        - name: ATLANTIS_SSL_CERT_FILE
          value: /atlantis/tls/tls.crt
        - name: ATLANTIS_SSL_KEY_FILE
          value: /atlantis/tls/tls.key
        - name: ATLANTIS_REPO_WHITELIST
          value: github.com/keep-network/keep-core
        - name: ATLANTIS_GH_USER
          value: thesis-heimdall
        - name: ATLANTIS_GH_TOKEN
          valueFrom:
            secretKeyRef:
              name: atlantis-git
              key: gh-access-token
        - name: ATLANTIS_GH_WEBHOOK_SECRET
          valueFrom:
            secretKeyRef:
              name: atlantis-git
              key: gh-webhook-secret
        - name: ATLANTIS_DATA_DIR
          value: /atlantis
        - name: ATLANTIS_PORT
          value: "8443"
        - name: TF_VAR_gcp_thesis_org_id
          valueFrom:
            secretKeyRef:
              name: terraform-env-vars
              key: org-id
        - name: TF_VAR_gcp_thesis_billing_account
          valueFrom:
            secretKeyRef:
              name: terraform-env-vars
              key: billing-account
        volumeMounts:
        - name: atlantis-data
          mountPath: /atlantis
        - name: atlantis-tls-files
          mountPath: /atlantis/tls
        - name: atlantis-gitconfig
          mountPath: /home/atlantis/
        - name: terraform-admin-service-account
          mountPath: /mnt/terraform-admin-service-account
        ports:
        - name: atlantis
          containerPort: 8443
        resources:
          requests:
            memory: 256Mi
            cpu: 100m
          limits:
            memory: 256Mi
            cpu: 100m
        livenessProbe:
          periodSeconds: 60
          httpGet:
            path: /healthz
            port: 8443
            scheme: HTTPS
        readinessProbe:
          periodSeconds: 60
          httpGet:
            path: /healthz
            port: 8443
            scheme: HTTPS
      volumes:
      - name: atlantis-tls-files
        secret:
          secretName: atlantis-tls
      - name: atlantis-gitconfig
        secret:
          secretName: atlantis-gitconfig
      - name: terraform-admin-service-account
        secret:
          secretName: terraform-admin-service-account
  volumeClaimTemplates:
  - metadata:
      name: atlantis-data
    spec:
      accessModes: ["ReadWriteOnce"] # Volume should not be shared by multiple nodes.
      resources:
        requests:
          # The biggest thing Atlantis stores is the Git repo when it checks it out.
          # It deletes the repo after the pull request is merged.
          storage: 1Gi
