Deploy the aws-iam-role-service-account helm chart on Rancher

Question

Pulumi · Accepted Answer

Deploying a Helm chart on Rancher, specifically one that sets up an AWS IAM role for a service account, involves several components, which include:

Setting up Rancher itself, and therein, a Kubernetes cluster.
Installing the Helm chart on the appropriate cluster within Rancher.

However, based on the Pulumi Registry results provided, there aren't any specific resources that exactly represent deploying a Helm chart for an AWS IAM role service account on Rancher. But we can create a Pulumi script that sets up a Rancher-managed Kubernetes cluster and then deploys a Helm chart to it using general-purpose Kubernetes resources.

Before you proceed, ensure that you have the following prerequisites:

An active Rancher installation that you can interact with.
An existing Kubernetes cluster managed by Rancher.
The necessary permissions and roles created in AWS which will be associated with the service account within the Helm chart.
Pulumi CLI and Pulumi account setup.

Below is the TypeScript Pulumi program that demonstrates how you could deploy a generic Helm chart to a Kubernetes cluster managed by Rancher. This script uses the rancher2 Pulumi provider for managing resources in Rancher and the kubernetes provider to deploy the Helm chart.

Detailed Pulumi Program

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";
import * as rancher2 from "@pulumi/rancher2";

// Ensure the Rancher2 provider is configured with the necessary credentials.
// These include access keys and the Rancher API endpoint.
const config = new pulumi.Config();
const rancherApiUrl = config.require("rancherApiUrl");
const rancherAccessToken = config.requireSecret("rancherAccessToken");

// Initialize the Rancher2 provider.
const rancherProvider = new rancher2.Provider("rancherProvider", {
    apiUrl: rancherApiUrl,
    tokenKey: rancherAccessToken,
});

// Retrieve the specific Kubernetes cluster managed by Rancher where the Helm chart will be deployed.
// The cluster ID must correspond to an existing Rancher Kubernetes cluster.
const clusterId = config.require("clusterId");

const cluster = rancher2.getCluster({
    id: clusterId,
}, { provider: rancherProvider });

// To deploy a Helm chart, you must have the cluster's kubeconfig.
// One way to approach this is by extracting the kubeconfig from the output of the rancher2.getCluster call.
const kubeconfig = cluster.kubeConfig.rawConfig;

// Initialize the Kubernetes provider with the kubeconfig from the Rancher-managed cluster.
const k8sProvider = new k8s.Provider("k8sProvider", { kubeconfig });

// Create a namespace for the Helm chart if required.
const namespace = new k8s.core.v1.Namespace("iam-role-ns", {
    metadata: { name: "aws-iam-role-sa" },
}, { provider: k8sProvider });

// Deploy the aws-iam-role-service-account Helm chart.
const awsIamRoleServiceAccountChart = new k8s.helm.v3.Chart("aws-iam-role-sa", {
    chart: "aws-iam-role-service-account", // The name of the chart. Update accordingly if the name is different.
    namespace: namespace.metadata.name,
    values: {
        // Provide necessary values to configure the Helm chart.
        // This includes annotations that define the AWS IAM role to be associated with the service account.
        // Annotations: {
        //   'eks.amazonaws.com/role-arn': 'arn:aws:iam::<ACCOUNT_ID>:role/<IAM_ROLE_NAME>'
        // }
    },
    // In case you are pulling the chart from a private repository, you need to specify `fetchOpts` including repo credentials.
    fetchOpts: {
        // Uncomment and configure if the chart is in a private repository.
        // repo: "https://my-private-helm-repo",
        // username: "<REPO_USERNAME>",
        // password: "<REPO_PASSWORD>",
    },
}, { provider: k8sProvider, dependsOn: [namespace] });

// Export the name of the namespace where the chart is installed.
export const chartNamespace = namespace.metadata.name;

Explanation

Rancher Provider Setup: We define the credentials required to interact with the Rancher API.
Rancher Cluster Retrieval: We fetch details about the cluster managed by Rancher using its ID.
Kubernetes Provider Initialization: We initialize the Kubernetes provider with the kubeconfig retrieved in the previous step, which allows Pulumi to communicate with the Kubernetes API for deploying resources.
Namespace Creation: Namespaces are a Kubernetes feature to create isolated environments within a cluster. If the Helm chart requires a specific namespace, we create it before deploying.
Helm Chart Deployment: We use Pulumi's kubernetes.helm.v3.Chart resource to deploy the AWS IAM Role Service Account chart, passing the necessary values and configurations needed for deployment.

Note: In this program, you need to replace placeholders in the Helm chart's values with the actual AWS IAM role ARN and other necessary information. If the chart is in a private repository, you also need to provide the repository's credentials.

This program needs customization to target the specifics of the AWS IAM role and the Helm chart you're trying to deploy. Ensure you have the correct Helm chart name and values to configure the chart properly before running the Pulumi deployment command.