Deploy the istio-sidecar helm chart on Azure Kubernetes Service (AKS)

Question

Pulumi · Accepted Answer

To deploy the Istio sidecar injector Helm chart on an Azure Kubernetes Service (AKS) cluster using Pulumi, we'll follow these steps:

1. Create an AKS cluster using the `azure-native.hybridcontainerservice.ProvisionedCluster` resource.
2. Use the `kubernetes.helm.sh/v3.Chart` resource to deploy Istio from the Helm chart to our AKS cluster.

Below is a TypeScript program that accomplishes this. The program is divided into two main parts: cluster provisioning and Helm chart deployment.

First, ensure that you have the Pulumi CLI installed and you are logged into the Azure CLI with sufficient permissions to create and manage AKS clusters.

Here's the detailed Pulumi program:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as azureNative from '@pulumi/azure-native';
import * as k8s from '@pulumi/kubernetes';

// Step 1: Provision an Azure Kubernetes Service (AKS) cluster
const resourceGroupName = new azureNative.resources.ResourceGroup("myResourceGroup", {
    location: "EastUS",
});

const managedCluster = new azureNative.containerservice.ManagedCluster("myAKSCluster", {
    resourceGroupName: resourceGroupName.name,
    location: resourceGroupName.location,
    kubernetesVersion: "1.23.5",
    agentPoolProfiles: [{
        count: 3,
        vmSize: "Standard_DS2_v2",
        mode: "System",
        name: "agentpool" // name of the node pool
    }],
    dnsPrefix: "myakscluster",
    enableRBAC: true,
});

// Step 2: Deploy the Istio Sidecar Injector using a Helm Chart
const k8sProvider = new k8s.Provider("k8sProvider", {
    kubeconfig: managedCluster.kubeConfigRaw,
});

const istioNamespace = new k8s.core.v1.Namespace("istio-system", {}, { provider: k8sProvider });

const istio = new k8s.helm.v3.Chart("istio-sidecar-injector", {
    namespace: istioNamespace.metadata.name,
    chart: "istio-sidecar-injector",
    fetchOpts: {
        repo: "https://istio-release.storage.googleapis.com/charts",
    },
    version: "1.10.0", // specify the version you want to install
    // Set Helm values that configure the sidecar injector.
    values: {
        global: {
            istioNamespace: istioNamespace.metadata.name,
        },
    },
}, { provider: k8sProvider });

// Export the kubeconfig
export const kubeconfig = managedCluster.kubeConfigRaw;
```

In this program:

- We import the required Pulumi packages that allow us to interact with Azure to create a resource group and AKS cluster, and the Kubernetes package to interact with our Kubernetes cluster.
- We create a new resource group with `azureNative.resources.ResourceGroup`.
- We then declare a managed AKS cluster using `azureNative.containerservice.ManagedCluster`.
- We specify the Kubernetes version and agent pool profile for our cluster, which includes the size and number of VMs.
- Once our AKS cluster is created, we obtain the kubeconfig which is needed to connect and manage the Kubernetes cluster.
- We create a `k8s.Provider` which is necessary for Pulumi to interact with our AKS cluster using the provided kubeconfig.
- We ensure that the 'istio-system' namespace is created within our Kubernetes cluster using `k8s.core.v1.Namespace`. Namespaces allow us to partition resources into different logical named groups.
- We deploy the Istio Sidecar Injector within the 'istio-system' namespace using the `k8s.helm.v3.Chart` resource. The chart is fetched from the specified Istio Helm charts repository.
- We specify the Istio sidecar injector chart and version, and pass in custom values to Helm for the installation. The `values` object is where you would specify any necessary configuration for Istio.
- Finally, we export the kubeconfig of the AKS cluster so it can be easily retrieved, e.g., using the Pulumi CLI after deployment to connect to the cluster with `kubectl`.

Make sure to include this `ts` file in a Pulumi project and then execute `pulumi up` to deploy the stack.

Remember to check the specific versions of Helm charts and their available configuration options in the official Istio documentation or on the Helm repositories, to ensure that you're using the correct and most up-to-date configurations.