From 7057806e01a9872d241c2a88ecdae3935cd5f265 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20J=C3=B6rg?= <moritz.jorg@oceanbox.io>
Date: Thu, 13 Nov 2025 16:47:56 +0100
Subject: [PATCH] feat(atlantis): Add beta and switch staging to maps.dev

---
 .../atlantis/kustomize/beta/appsettings.json  | 96 +++++++++++++++++++
 .../kustomize/beta/barentswatch-api.env       |  2 +
 values/atlantis/kustomize/beta/bindings.yaml  | 22 +++++
 .../kustomize/beta/configurations.yaml        | 20 ++++
 values/atlantis/kustomize/beta/default.env    |  1 +
 .../kustomize/beta/deployment_patch.yaml      | 10 ++
 values/atlantis/kustomize/beta/keyvault.yaml  | 22 +++++
 .../kustomize/beta/kustomization.yaml         | 24 +++++
 values/atlantis/kustomize/beta/pubsub.yaml    | 52 ++++++++++
 values/atlantis/kustomize/beta/rbac.yaml      | 40 ++++++++
 values/atlantis/kustomize/beta/secrets.yaml   |  9 ++
 .../atlantis/kustomize/beta/secretstore.yaml  | 10 ++
 .../atlantis/kustomize/beta/statestore.yaml   | 22 +++++
 .../kustomize/beta/subscriptions.yaml         | 27 ++++++
 values/atlantis/kustomize/beta/tracing.yaml   | 11 +++
 15 files changed, 368 insertions(+)
 create mode 100644 values/atlantis/kustomize/beta/appsettings.json
 create mode 100644 values/atlantis/kustomize/beta/barentswatch-api.env
 create mode 100644 values/atlantis/kustomize/beta/bindings.yaml
 create mode 100644 values/atlantis/kustomize/beta/configurations.yaml
 create mode 100644 values/atlantis/kustomize/beta/default.env
 create mode 100644 values/atlantis/kustomize/beta/deployment_patch.yaml
 create mode 100644 values/atlantis/kustomize/beta/keyvault.yaml
 create mode 100644 values/atlantis/kustomize/beta/kustomization.yaml
 create mode 100644 values/atlantis/kustomize/beta/pubsub.yaml
 create mode 100644 values/atlantis/kustomize/beta/rbac.yaml
 create mode 100644 values/atlantis/kustomize/beta/secrets.yaml
 create mode 100644 values/atlantis/kustomize/beta/secretstore.yaml
 create mode 100644 values/atlantis/kustomize/beta/statestore.yaml
 create mode 100644 values/atlantis/kustomize/beta/subscriptions.yaml
 create mode 100644 values/atlantis/kustomize/beta/tracing.yaml

diff --git a/values/atlantis/kustomize/beta/appsettings.json b/values/atlantis/kustomize/beta/appsettings.json
new file mode 100644
index 00000000..7309f8d2
--- /dev/null
+++ b/values/atlantis/kustomize/beta/appsettings.json
@@ -0,0 +1,96 @@
+{
+    "oidc": {
+        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
+        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
+        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
+        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
+        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
+        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
+        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
+        "clientId": "atlantis",
+        "clientSecret": "",
+        "scopes": [
+            "openid",
+            "email",
+            "offline_access",
+            "profile"
+        ],
+        "audiences": [
+            "atlantis",
+            "atlantis_dev",
+            "sorcerer",
+            "sorcerer_dev"
+        ]
+    },
+    "sso": {
+        "cookieDomain": ".oceanbox.io",
+        "cookieName": ".obx.beta",
+        "ttl": 12.0,
+        "signedOutRedirectUri": "https://maps.oceanbox.io",
+        "realm": "atlantis",
+        "environment": "prod",
+        "keyStore": {
+            "kind": "azure",
+            "uri": "https://atlantis.blob.core.windows.net",
+            "key": "dataprotection-keys"
+        },
+        "keyVault": {
+            "kind": "azure",
+            "uri": "https://atlantisvault.vault.azure.net",
+            "key": "dataencryption-keys"
+        }
+    },
+    "fga": {
+      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
+      "apiKey": "",
+      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
+      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
+    },
+    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "plainAuthUsers": [
+        {
+            "username": "admin",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "sorcerer",
+            "password": "fire tre to en",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "archivist",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        }
+    ],
+    "plume": "plume.data.oceanbox.io",
+    "redis": "prod-atlantis-redis-master:6379",
+    "objectStore": "https://atlantis.blob.core.windows.net",
+    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
+    "sorcerer" : "https://sorcerer.beta.oceanbox.io",
+    "allowedOrigins": [
+        "https://maps.beta.oceanbox.io",
+    ],
+    "appName": "atlantis",
+    "appEnv": "beta",
+    "appNamespace": "atlantis",
+    "appVersion": "2.95.1",
+    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
+    "pubsubName": "pubsub",
+    "pubsubTopic": "hipster-atlantis",
+    "slurm": {
+        "baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
+        "slurmApi": "slurm/v0.0.42/",
+        "dbdApi": "slurmdbd/v0.0.42/",
+        "accessToken": ""
+    },
+    "amqp": {
+        "auth": "user:hunny-bunny",
+        "host": "10.255.241.201:30673"
+    },
+    "fenceRadius": 1250.0
+}
diff --git a/values/atlantis/kustomize/beta/barentswatch-api.env b/values/atlantis/kustomize/beta/barentswatch-api.env
new file mode 100644
index 00000000..fc399a85
--- /dev/null
+++ b/values/atlantis/kustomize/beta/barentswatch-api.env
@@ -0,0 +1,2 @@
+client-id=simen.kirkvik@tromso.serit.no:simkir-tilt-atlantis
+secret=d9tInZ1XpeDAxD.DySv'*SB=P
\ No newline at end of file
diff --git a/values/atlantis/kustomize/beta/bindings.yaml b/values/atlantis/kustomize/beta/bindings.yaml
new file mode 100644
index 00000000..8a95c563
--- /dev/null
+++ b/values/atlantis/kustomize/beta/bindings.yaml
@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: slurm-events
+spec:
+  type: bindings.rabbitmq
+  version: v1
+  metadata:
+  - name: host
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  connString
+  - name: queueName
+    value: prod-slurm-job-events
+  - name: durable
+    value: true
+  - name: contentType
+    value: "application/json"
+  - name: route
+    value: /events/slurm
+scopes:
+  - prod-atlantis
diff --git a/values/atlantis/kustomize/beta/configurations.yaml b/values/atlantis/kustomize/beta/configurations.yaml
new file mode 100644
index 00000000..705e1b48
--- /dev/null
+++ b/values/atlantis/kustomize/beta/configurations.yaml
@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: configstore
+spec:
+  type: configuration.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: prod-atlantis-redis-master:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: prod-atlantis-redis
+      key:  redis-password
+  - name: redisDB
+    value: "1"
+scopes:
+  - prod-atlantis
diff --git a/values/atlantis/kustomize/beta/default.env b/values/atlantis/kustomize/beta/default.env
new file mode 100644
index 00000000..85c5abe3
--- /dev/null
+++ b/values/atlantis/kustomize/beta/default.env
@@ -0,0 +1 @@
+OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm
diff --git a/values/atlantis/kustomize/beta/deployment_patch.yaml b/values/atlantis/kustomize/beta/deployment_patch.yaml
new file mode 100644
index 00000000..dd4c92da
--- /dev/null
+++ b/values/atlantis/kustomize/beta/deployment_patch.yaml
@@ -0,0 +1,10 @@
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: azure-keyvault
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: prod-atlantis-env
\ No newline at end of file
diff --git a/values/atlantis/kustomize/beta/keyvault.yaml b/values/atlantis/kustomize/beta/keyvault.yaml
new file mode 100644
index 00000000..145adf98
--- /dev/null
+++ b/values/atlantis/kustomize/beta/keyvault.yaml
@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: azure-keyvault
+spec:
+  type: secretstores.azure.keyvault
+  version: v1
+  metadata:
+  - name: vaultName
+    value: atlantisvault
+  - name: azureTenantId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_TENANT_ID
+  - name: azureClientId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_ID
+  - name: azureClientSecret
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_SECRET
diff --git a/values/atlantis/kustomize/beta/kustomization.yaml b/values/atlantis/kustomize/beta/kustomization.yaml
new file mode 100644
index 00000000..f0e148c2
--- /dev/null
+++ b/values/atlantis/kustomize/beta/kustomization.yaml
@@ -0,0 +1,24 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: prod-atlantis-appsettings
+  files:
+    - appsettings.json
+patches:
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+    path: deployment_patch.yaml
+resources:
+  - ../base
+  - secrets.yaml
+  - rbac.yaml
+  - tracing.yaml
+  - bindings.yaml
+  - pubsub.yaml
+  - statestore.yaml
+  - subscriptions.yaml
+  - configurations.yaml
+  - secretstore.yaml
+  - keyvault.yaml
diff --git a/values/atlantis/kustomize/beta/pubsub.yaml b/values/atlantis/kustomize/beta/pubsub.yaml
new file mode 100644
index 00000000..b7aeda01
--- /dev/null
+++ b/values/atlantis/kustomize/beta/pubsub.yaml
@@ -0,0 +1,52 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: pubsub
+spec:
+  version: v1
+  type: pubsub.rabbitmq
+  metadata:
+  - name: hostname
+    value: prod-rabbitmq.rabbitmq
+  - name: username
+    value: user
+  - name: password
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  rabbitmq-password
+  - name: protocol
+    value: amqp
+  - name: durable
+    value: true
+  - name: deletedWhenUnused
+    value: false
+  - name: autoAck
+    value: false
+  - name: deliveryMode
+    value: 1
+  - name: requeueInFailure
+    value: false
+  - name: prefetchCount
+    value: 0
+  - name: reconnectWait
+    value: 0
+  - name: concurrencyMode
+    value: parallel
+  - name: publisherConfirm
+    value: false
+  - name: backOffPolicy
+    value: exponential
+  - name: backOffInitialInterval
+    value: 100
+  - name: backOffMaxRetries
+    value: 16
+  - name: enableDeadLetter # Optional enable dead Letter or not
+    value: true
+  - name: maxLen # Optional max message count in a queue
+    value: 3000
+  - name: maxLenBytes # Optional maximum length in bytes of a queue.
+    value: 10485760
+  - name: exchangeKind
+    value: fanout
+  - name: clientName
+    value: "{appID}"
diff --git a/values/atlantis/kustomize/beta/rbac.yaml b/values/atlantis/kustomize/beta/rbac.yaml
new file mode 100644
index 00000000..6d13b929
--- /dev/null
+++ b/values/atlantis/kustomize/beta/rbac.yaml
@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prod-atlantis
+  namespace: prod-atlantis
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - prod-atlantis-appsettings
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - azure-keyvault
+  - prod-atlantis-redis
+  - slurm-access-token
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prod-atlantis
+  namespace: prod-atlantis
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prod-atlantis
+subjects:
+- kind: ServiceAccount
+  name: prod-atlantis
+  namespace: prod-atlantis
diff --git a/values/atlantis/kustomize/beta/secrets.yaml b/values/atlantis/kustomize/beta/secrets.yaml
new file mode 100644
index 00000000..a956c207
--- /dev/null
+++ b/values/atlantis/kustomize/beta/secrets.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    kyverno/clone: "true"
+    kyverno/env: "prod"
+  name: prod-atlantis-rabbitmq
+type: Opaque
+data:
diff --git a/values/atlantis/kustomize/beta/secretstore.yaml b/values/atlantis/kustomize/beta/secretstore.yaml
new file mode 100644
index 00000000..afa9a4cd
--- /dev/null
+++ b/values/atlantis/kustomize/beta/secretstore.yaml
@@ -0,0 +1,10 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: secretstore
+spec:
+  type: secretstores.kubernetes
+  version: v1
+  metadata:
+   - name: defaultNamespace
+     value: prod-atlantis
\ No newline at end of file
diff --git a/values/atlantis/kustomize/beta/statestore.yaml b/values/atlantis/kustomize/beta/statestore.yaml
new file mode 100644
index 00000000..beb6ee64
--- /dev/null
+++ b/values/atlantis/kustomize/beta/statestore.yaml
@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: statestore
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: prod-atlantis-redis-master:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: prod-atlantis-redis
+      key:  redis-password
+  - name: actorStateStore
+    value: "true"
+  - name: redisDB
+    value: "0"
+scopes:
+  - prod-atlantis
diff --git a/values/atlantis/kustomize/beta/subscriptions.yaml b/values/atlantis/kustomize/beta/subscriptions.yaml
new file mode 100644
index 00000000..d0d0dcce
--- /dev/null
+++ b/values/atlantis/kustomize/beta/subscriptions.yaml
@@ -0,0 +1,27 @@
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: hipster-events
+spec:
+  topic: hipster
+  routes:
+    default: /events/hipster
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- prod-atlantis
+---
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: inbox-events
+spec:
+  topic: inbox
+  routes:
+    default: /events/inbox
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- prod-atlantis
diff --git a/values/atlantis/kustomize/beta/tracing.yaml b/values/atlantis/kustomize/beta/tracing.yaml
new file mode 100644
index 00000000..5d9bffd1
--- /dev/null
+++ b/values/atlantis/kustomize/beta/tracing.yaml
@@ -0,0 +1,11 @@
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: tracing
+spec:
+  tracing:
+    samplingRate: "1"
+    otel:
+      endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
+      protocol: grpc
+      isSecure: false