Deploy the oidc-proxy helm chart on Oracle Kubernetes Engine (OKE)

Question

Pulumi · Accepted Answer

Deploying a Helm chart on a Kubernetes cluster typically involves several steps. First, you need to have a Kubernetes cluster running and accessible. Since we're focusing on Oracle Kubernetes Engine (OKE), you would need to create an OKE cluster, or have access to one where you have appropriate permissions to deploy applications.

In this program, we'll set up the oci.ContainerEngine.Cluster to create an OKE cluster. Once our cluster is running, we'll use the kubernetes.helm.v3.Chart resource to deploy the oidc-proxy Helm chart.

Before you run the Pulumi program, ensure that you have the following prerequisites configured:

Oracle Cloud Infrastructure (OCI) Account: Have an account set up with appropriate permissions and have created an OCI "Compartment" where you'll place your resources.
Pulumi Account: Sign up for a Pulumi account and install the Pulumi CLI on your machine.
OCI Provider Configuration: Have the Pulumi OCI provider configured with the necessary credentials. Typically this requires setting environment variables such as OCI_USER_OCID, OCI_TENANCY_OCID, OCI_REGION, OCI_FINGERPRINT, OCI_PRIVATE_KEY_PATH, etc.
Kubernetes and Helm Configuration: Your local environment should be configured with kubectl and helm commands, along with the necessary credentials to interact with the OKE cluster created by Pulumi.

Now, let's walk through the Pulumi program written in TypeScript:

import * as pulumi from "@pulumi/pulumi";
import * as oci from "@pulumi/oci";
import * as k8s from "@pulumi/kubernetes";

// Make sure to set the following OCI configuration using `pulumi config set <key> <value>` or using environment variables
const compartmentId = pulumi.output(oci.core.getBounds().then(bounds => bounds.compartmentId));
const sshPublicKey = "your-ssh-public-key";  // Replace with your SSH Public Key content for nodes' access
const vcnId = "your-vcn-id";                // The VCN ID where the cluster should be attached to

// Create an OKE cluster
const cluster = new oci.core.ContainerEngine.Cluster("okeCluster", {
    compartmentId: compartmentId,
    vcnId: vcnId,
    options: {
        serviceLbSubnetIds: [],   // Subnet IDs for Load Balancers, specify if needed
    },
    kubernetesVersion: "v1.21.5",  // Choose the version of Kubernetes you wish to use
});

// Reference to your OKE cluster kubeconfig
const kubeconfig = oci.core.getContainerEngineClusterKubeconfig({
    clusterId: cluster.id,
});

// Create the Helm Release for oidc-proxy
const oidcProxyRelease = new k8s.helm.v3.Chart("oidcProxy", {
    chart: "oidc-proxy",
    // Depending on the Helm chart, you can specify the Helm repository like this:
    // repo: "my-helm-repo",
    // You can also specify a values file or configure settings directly in `values`:
    // values: {
    //     key: "value"
    // },
}, {provider: new k8s.Provider("k8sProvider", {kubeconfig: kubeconfig})});

// Export the OKE cluster's endpoint and kubeconfig
export const okeClusterEndpoint = cluster.endpoints.apply(e => e.publicEndpoint || "");
export const okeClusterKubeconfig = kubeconfig;

In this code:

We import the necessary Pulumi packages to work with OCI and Kubernetes.
We obtain the default compartment ID for our resources. In Oracle Cloud Infrastructure, every resource belongs to a compartment, which is a way to organize resources.
We provide a variable for the SSH public key content to enable secure access to the node instances within the OKE cluster.
We define and create a new OKE cluster using oci.core.ContainerEngine.Cluster. We specify the compartment and VCN, and also set the desired Kubernetes version.
We retrieve the kubeconfig using oci.core.getContainerEngineClusterKubeconfig, which will allow us to interact with the Kubernetes cluster once it's created.
We instantiate a Pulumi Kubernetes provider using the kubeconfig of the OKE cluster. This provider will be used to deploy our Helm chart.
We deploy our oidc-proxy Helm chart to the OKE cluster with k8s.helm.v3.Chart. This assumes that the chart is available in the configured or default Helm repository. You may need to specify additional configuration details such as repo, or the values that configure the deployment of the chart.
We export the public endpoint of the OKE cluster and the cluster's kubeconfig so they can be used outside of Pulumi.

To run this Pulumi program, navigate to your Pulumi project directory in your terminal and execute pulumi up. This command starts the deployment process, which will prompt you for a confirmation before applying the changes.

Remember to replace placeholder values like your-ssh-public-key and your-vcn-id with actual values from your OCI setup. Additionally, for the Helm chart deployment, ensure to set the correct chart name, possibly the repository (repo) and any values (values) that configure the Helm chart to suit the deployment needs of oidd-proxy.