Deploy the portefaix-kyverno helm chart on Oracle Kubernetes Engine (OKE)

Question

Pulumi · Accepted Answer

To deploy the portefaix-kyverno Helm chart on the Oracle Kubernetes Engine (OKE), you will need to perform the following steps:

1. **Set up an OCI Kubernetes Cluster (OKE)**: You will first need to create a Kubernetes cluster on Oracle Cloud Infrastructure using Pulumi's `oci.ContainerEngine.Cluster` resource. This will provide you with a managed Kubernetes environment where you can deploy applications.

2. **Install the Helm Chart**: Once the Kubernetes cluster is ready, you will install the Helm chart using Pulumi's `kubernetes.helm.v3.Chart` resource. Helm charts are packages of pre-configured Kubernetes resources, and portefaix-kyverno is one such chart that allows you to enforce policies in your Kubernetes clusters.

Let's start by setting up the OKE cluster. In the following TypeScript program, I'll first define the necessary imports, then create the OKE cluster, and finally deploy the Helm chart on the cluster. Here's a Pulumi program that you can use to accomplish this task:

```typescript
import * as oci from "@pulumi/oci";
import * as kubernetes from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";

// This is the compartment OCID where you want to create your resources.
const compartmentId = "ocid1.compartment.oc1..xxxxxxxxxxxxx";

// Create an Oracle Cloud Infrastructure virtual cloud network (VCN) for the OKE cluster
const vcn = new oci.core.Vcn("my-vnc", {
    compartmentId: compartmentId,
    cidrBlock: "10.0.0.0/16",
});

// Create a subnet for the OKE cluster
const subnet = new oci.core.Subnet("my-subnet", {
    compartmentId: compartmentId,
    vcnId: vcn.id,
    cidrBlock: "10.0.10.0/24",
    // Ensure this subnet is in the same region as your VCN and is AD-specific or regional as per your requirement.
});

// Create an OKE cluster
const cluster = new oci.containerengine.Cluster("my-oke-cluster", {
    compartmentId: compartmentId,
    vcnId: vcn.id,
    kubernetesVersion: "v1.21.5",
    options: {
        serviceLbSubnetIds: [subnet.id],
    },
});

// Get Kubernetes cluster kubeconfig.
const kubeconfig = pulumi.all([cluster.id]).apply(([clusterId]) =>
    oci.containerengine.getClusterKubeconfig({ clusterId })
);

// Create a Provider to interact with the OKE cluster
const provider = new kubernetes.Provider("provider", {
    kubeconfig: kubeconfig,
});

// Deploys the portefaix-kyverno Helm chart into the OKE cluster
const chart = new kubernetes.helm.v3.Chart("portefaix-kyverno", {
    chart: "kyverno",
    version: "1.5.0", // Specify the chart version that you want to deploy
    fetchOpts: { repo: "https://portefaix.github.io/charts" },
}, { provider: provider });

export const kubeconfigYAML = kubeconfig;
export const clusterName = cluster.name;
```

In this program:
- We first import the required Pulumi packages for OCI (`@pulumi/oci`), Kubernetes (`@pulumi/kubernetes`), and Pulumi itself (`@pulumi/pulumi`).
  
- We then create a new Virtual Cloud Network (VCN) and Subnet which are needed for the OKE cluster.

- The `oci.containerengine.Cluster` resource is used to configure and create the OKE cluster. Replace the `compartmentId` with your actual OCI compartment OCID.

- Once the cluster is created, we retrieve the Kubernetes configuration using `oci.containerengine.getClusterKubeconfig`.

- We define a `Provider` resource which specifies the credentials for Pulumi to interact with the Kubernetes cluster.

- The `kubernetes.helm.v3.Chart` resource is used to install the kyverno chart from the portefaix repository.

- Finally, we export the kubeconfig and cluster name as stack outputs. The kubeconfig is necessary for you to interact with your Kubernetes cluster using `kubectl`.

This example assumes that you have the Oracle Cloud Infrastructure (OCI) configured for Pulumi. You'd typically have the OCI setup configured through the `oci` CLI tools and have permissions to create VCNs, subnets, and Kubernetes clusters on OCI.