Run atlantis container as atlantis user instead of root

[chrisob]

Signed-off-by: Chris O'Brien [email protected]
@jkodroff @callmeradical @jeff-knurek @lkysow

What this PR does / why we need it:

Since atlantis v0.4.12 (specifically this PR), any custom gitconfig options are ignored, as the container/pod is running as root instead of atlantis.

Which issue this PR fixes

Run the pod as UID 100, AKA the atlantis user.
Remove the atlantis command from the pod spec so as not to bypass docker-entrypoint.sh, which gosus to the atlantis user.

Special notes for your reviewer:

Tested and working, my custom gitconfig specified in values.yaml works again.

Checklist

• DCO signed
• Chart Version bumped
• Variables are documented in the README.md

[lkysow]

Hi Chris,
The Atlantis docker image has a provision to run as the atlantis user: https://github.com/runatlantis/atlantis/blob/master/docker-entrypoint.sh#L43

What's happening though is that the helm chart is setting

          command: ["atlantis"]

https://github.com/helm/charts/blob/master/stable/atlantis/templates/statefulset.yaml#L64

Which overrides the Docker Entrypoint (https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#notes).

Instead, I think we should change:

          command: ["atlantis"]
          args:
            - server

to

          args:
            - server

Which should allow the default entrypoint to work.

Would you mind seeing if that fixes things?

[lkysow]

See ☝️

[chrisob]

@lkysow Yep, good call, I can confirm removing the atlantis command stops bypassing docker-entrypoint.sh, and atlantis server runs as the atlantis user 😁

[k8s-ci-robot]

@chrisob: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

@lkysow Yep, good call, I can confirm removing the atlantis command stops bypassing docker-entrypoint.sh, and atlantis server runs as the atlantis user 😁

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[lkysow]

/ok-to-test

[lkysow]

Nice! Please squash your commits.

[chrisob]

@lkysow done

[lkysow]

👍 LGTM

[lkysow]

/lgtm

[lkysow]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chrisob, lkysow

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• stable/atlantis/OWNERS [lkysow]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[lkysow]

Thanks @chrisob! 🎉

[chrisob]

@lkysow thank you for such a great tool in the first place!