Deploy the istio-cni helm chart on Oracle Kubernetes Engine (OKE)

Question

Pulumi · Accepted Answer

To deploy the Istio CNI Helm chart on Oracle Kubernetes Engine (OKE), you will need to create a Kubernetes cluster on OKE, configure your Pulumi environment for deploying resources on OCI (Oracle Cloud Infrastructure), and use the Helm chart resource from the Pulumi Kubernetes provider to manage the deployment of Istio.

Below is a Pulumi TypeScript program that performs the following actions:

Creates a new OKE cluster: It sets up a VCN, subnets, and a Kubernetes cluster within your compartment in OCI.
Deploys the Istio CNI Helm chart onto the cluster.

The program assumes that you've already set up the OCI provider configuration with your credentials. Pulumi will use the OCI environment variables such as OCI_USER_OCID, OCI_TENANCY_OCID, OCI_PRIVATE_KEY_PATH, and OCI_REGION by default, but these can also be set using Pulumi's configuration system if preferred.

Let's go through the Pulumi program step by step.

Step 1: Setup Pulumi program and import dependencies

We will start by setting up the program skeleton and importing necessary Pulumi libraries, OCI types for Container Engine for Kubernetes (OKE), and Kubernetes types for managing Helm charts:

import * as oci from "@pulumi/oci";
import * as k8s from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";

// Additional imports for managing network resources such as VCN, subnets will be here, if needed

Step 2: Create OKE Cluster

Next, we create an OKE Cluster and its dependencies, including networking resources like a VCN and subnet:

// Create a Virtual Cloud Network (VCN) for the OKE cluster
const vcn = new oci.core.VirtualNetwork(/* ... */);

// Create a subnet for the OKE cluster
const subnet = new oci.core.Subnet(/* ... */);

// Define the OKE cluster
const cluster = new oci.containerengine.Cluster("myOkeCluster", {
    // Configure properties for the cluster
    // ...
});

Step 3: Configure Kubernetes Provider

To interact with the Kubernetes cluster, we've just provisioned; we need to configure the Kubernetes provider with the correct kubeconfig:

// Assuming we have already had the kubeconfig, set up the Kubernetes provider
// Using kubeconfig to configure Kubernetes provider
const k8sProvider = new k8s.Provider("k8sProvider", {
    kubeconfig: cluster.kubeconfig.apply(JSON.stringify),
});

Step 4: Deploy Istio CNI using Helm Chart

Lastly, we deploy Istio using a Helm chart. We will refer to the appropriate Helm chart for the Istio CNI.

// Deploy Istio CNI using the Helm Chart
const istioCniChart = new k8s.helm.v3.Chart("istio-cni", {
    chart: "istio-cni",
    // Specify the version of Istio CNI you wish to deploy
    version: "<istio-cni-version>",
    namespace: "kube-system",
    fetchOpts: {
        repo: "https://<helm-repo-url>",
    },
}, { provider: k8sProvider });

Complete Program

Here is the entire Pulumi program that combines all the above steps:

import * as oci from "@pulumi/oci";
import * as k8s from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";

// Create networking resources if needed
// ...

// Create an OKE cluster
const cluster = new oci.containerengine.Cluster("myOkeCluster", {
    // Configure cluster properties
    // ...
});

// Use the generated kubeconfig to interact with the cluster
const kubeconfig = pulumi.
    all([cluster.id, cluster.endpoints, cluster.metadata]).
    apply(([cid, endpoints, metadata]) => {
        // Generate kubeconfig
        return /* logic to generate kubeconfig */;
    });

// Create Kubernetes provider instance with kubeconfig
const k8sProvider = new k8s.Provider("k8sProvider", {
    kubeconfig: kubeconfig,
});

// Deploy Istio CNI Helm chart to the cluster
const istioCniChart = new k8s.helm.v3.Chart("istio-cni", {
    chart: "istio-cni",
    version: "<istio-cni-version>",
    namespace: "kube-system",
    fetchOpts: {
        repo: "https://<helm-repo-url>",
    },
}, { provider: k8sProvider });

To execute this program, you would first save it as index.ts in your Pulumi project directory. Next, ensure you have all your OCI credentials configured as environment variables or through Pulumi config. Then, run pulumi up to create the resources, including the OKE cluster and deploy the Istio CNI helm chart to it.

Remember to replace <istio-cni-version> and <helm-repo-url> with the actual version number of Istio CNI and the URL to the Helm repository that contains the Istio CNI chart respectively. Also, you would need to provide the actual logic and properties for VCN, subnets, and cluster configuration as per your environment needs.

You can learn more about OCI's Pulumi provider and how to use it in the OCI Pulumi Provider documentation. Additionally, to understand Helm chart deployments with Pulumi, consult the Helm Chart Pulumi documentation.