Deploy the postgres-instance helm chart on Azure Kubernetes Service (AKS)

Question

Pulumi · Accepted Answer

To deploy a PostgreSQL instance using a Helm chart on an Azure Kubernetes Service (AKS) cluster with Pulumi, you'll generally go through the following steps:

1. **Create the AKS Cluster:** You would start by provisioning an AKS cluster where the PostgreSQL Helm chart will be deployed.
2. **Install Pulumi Kubernetes Provider:** Once the AKS cluster is provisioned, you need to set up the Kubernetes provider that the Pulumi program can use to interact with the cluster.
3. **Use the Helm Chart Resource:** The `kubernetes.helm.v3.Chart` resource provided by Pulumi’s Kubernetes provider allows you to specify Helm chart properties, which in this case would be the PostgreSQL Helm chart.

Before diving into the code, make sure you have the following prerequisites in place:

- Pulumi CLI installed.
- Azure CLI installed and configured with the appropriate permissions and login to manage Azure resources.
- Kubernetes CLI (`kubectl`) installed to interact with the AKS cluster.

Here's a TypeScript program which completes these steps:

```typescript
import * as azure from "@pulumi/azure";
import * as azuread from "@pulumi/azuread";
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

// Step 1: Provision the Azure Kubernetes Service (AKS) cluster
const name = "my-aks";
const resourceGroup = new azure.core.ResourceGroup(`${name}-rg`, {
    location: "WestUS",
    // Resource tags can be applied to all resources that support tags. Tags are key-value pairs.
});

// Create an Azure AD application for AKS
const app = new azuread.Application(`${name}-app`);

// Create service principal for the application so AKS can act on behalf of the application
const servicePrincipal = new azuread.ServicePrincipal(`${name}-sp`, {
    applicationId: app.applicationId,
});

// Generate random password for the Service Principal Account
const spPassword = new azuread.ServicePrincipalPassword(`${name}-sp-password`, {
    servicePrincipalId: servicePrincipal.id,
    // Beware that the end date is currently just over one year.
    endDate: "2099-01-01T00:00:00Z",
});

// Create an AKS cluster
const cluster = new azure.containerservice.KubernetesCluster(`${name}`, {
    resourceGroupName: resourceGroup.name,
    // Default node pool settings can be specified directly on the cluster for convenience
    defaultNodePool: {
        name: "aksnodepool",
        nodeCount: 3,
        vmSize: "Standard_B2s",
    },
    dnsPrefix: `${pulumi.getStack()}-kube`,
    linuxProfile: {
        adminUsername: "adminuser",
        sshKey: {
            keyData: "ssh-rsa AAAAB3N ...",
        },
    },
    servicePrincipal: {
        clientId: app.applicationId,
        clientSecret: spPassword.value,
    },
    // On enabling role-based access control (RBAC), it uses Kubernetes' built-in roles and role bindings for access control.
    enableRBAC: true,
    // The `kubeConfigRaw` property is the raw admin Kubernetes configuration which can safely be used outside of Pulumi.
    // Please be careful to treat it as sensitive data.
});

// Step 2: Set up the Kubernetes provider pointing to the AKS cluster.
// Get the kubeconfig from the created AKS cluster to interact with it.
const kubeconfig = pulumi.
    all([cluster.name, resourceGroup.name]).
    apply(([clusterName, rgName]) => {
        return azure.containerservice.getKubeConfig({
            name: clusterName,
            resourceGroupName: rgName,
        });
    });

// Create a Kubernetes provider using the kubeconfig.
const k8sProvider = new k8s.Provider(`${name}-k8s-provider`, {
    kubeconfig: kubeconfig.rawConfig,
    // If you need to specify a specific version of the Kubernetes client, you can pass it here.
    // version: "v1.17.2",
});

// Step 3: Deploy PostgreSQL using the Helm chart.
const postgresqlChart = new k8s.helm.v3.Chart("postgresql-instance", {
    // The repo where the PostgreSQL Helm chart is located
    repo: "bitnami",
    chart: "postgresql",
    version: "10.3.17", // specify the exact chart version to deploy
    // Override settings in the Helm chart
    values: {
        // Override the following value as an example. The Bitnami PostgreSQL chart provisions with a `random`
        // PostgreSQL password unless you provide your own explicitly using `postgresqlPassword`.
        postgresqlPassword: "some-password",
    },
}, { provider: k8sProvider });

// Export the IP address of the PostgreSQL service
export const postgresqlServiceIP = postgresqlChart
    .getResourceProperty("v1/Service", "postgresql-instance-postgresql", "status")
    .apply(status => status.loadBalancer.ingress[0].ip);

```

To explain, this program does the following:

- It first creates a resource group in Azure to contain our AKS cluster resources.
- It sets up Azure AD application and service principal which AKS uses for the Kubernetes API credentials.
- It creates the AKS cluster with the necessary configurations like default node pool, admin username, ssh key, and the service principal credentials.
- It retrieves the kubeconfig, which contains the necessary details to connect to the AKS cluster using `kubectl`.
- It then uses this kubeconfig to initialize the Pulumi Kubernetes provider, which is responsible for deploying Kubernetes resources.
- Finally, it deploys a PostgreSQL database using the PostgreSQL Helm chart from the Bitnami repository.

For more detailed information on the Kubernetes provider, you can refer to the [official documentation](https://www.pulumi.com/docs/reference/pkg/kubernetes/provider/), and for the AKS cluster in the Azure provider, the documentation is available [here](https://www.pulumi.com/docs/reference/pkg/azure/containerservice/kubernetescluster/). The Pulumi Kubernetes Helm Chart resource is also documented [here](https://www.pulumi.com/registry/packages/kubernetes/api-docs/helm/v3/chart/).

Remember to replace the `ssh-rsa AAAAB...` placeholder with your actual SSH public key data and the `some-password` placeholder with the password you want to use for PostgreSQL. After you have this program set up, you run it using the Pulumi CLI to provision these resources in Azure.