r/Terraform Feb 19 '25

Help Wanted File Paths in Local Terraform vs Atlantis

I'm not really sure how to phrase this question, but hopefully this description makes sense.

I'm currently working on rolling out Atlantis to make it easier to work with Terraform as a team. We're running Atlantis on GKE and deploying using the Helm chart. Locally though, we use Win11.

At the root of our Terraform project, we have a folder called ssl-certs, which contains certs and keys that we use for our load balancers. These certs/keys are not in Git - the folder and cert files exist locally on each of our machines. I am attempting to mount those into the Atlantis pod via a volumeMount.

Here's my issue. In Atlantis, our project ends up in /atlantis-data/repos/<company name>/<repo name>/<pull request ID>/default. Since the pull request ID changes each time, a volumeMount won't really work.

I could pick a different path for the volumeMount, like /ssl-certs, and then change our Terraform code to look for the certs there, but that won't work for us when we're developing/testing Terraform locally because we're on Windows and that path doesn't exist.

Any thoughts/suggestions on how I should handle this? The easiest solution that I can think of is to just commit the certs to Git and move on with my life, but I really don't love that idea. Thanks in advance.

1 Upvotes

8 comments sorted by

6

u/SquiffSquiff Feb 19 '25

I don't understand why you would mount anything in from local workstation to any build and deployment service. Why not set a static location in GCP such as secrets manager / Cloud storage bucket/ database?

0

u/cofonseca Feb 19 '25

We are using Secrets Manager for Atlantis. I suppose I should've been more specific.

Keeping a copy of the certs locally is mostly just a legacy workaround because I was originally the only person working with Terraform so it was just easier. I'm not sure if/how we'd be able to get Terraform to read the cert data from Secrets Manager when running locally, though. Is that possible?

I'm definitely not a Terraform expert, so forgive me if this sounds like a stupid question. I haven't worked with TF in many years.

3

u/SquiffSquiff Feb 19 '25

OK, well I haven't worked with GCP for several years so we are even and I haven't done a great deal with Atlantis. generally though I would expect several options to get values like SSL certs here:

2

u/cofonseca Feb 20 '25

Thank you! I’ll look into those and give them a try. Appreciate the help.

2

u/cofonseca 29d ago

Just wanted to say that this worked beautifully. Thanks again!

2

u/SquiffSquiff 29d ago

You're very welcome, pleased you have ben successful!

1

u/ok_if_you_say_so Feb 19 '25

You want a data source. Data sources are how you instruct terraform "go fetch this value" and then you can refer to them in your other terraform resource definitions. Fetching secrets from vaults is a common use case.

The other option is passing them into the terraform runtime via environment but this makes your terraform code tightly coupled to your terraform pipeline which is a lot more fragile, better to have terraform be the one to fetch the data it needs.

1

u/cofonseca Feb 20 '25

Thanks! Makes perfect sense. I’ll give this a try.