Using kubernetes karpenter.sh with trust.cert-manager.io

Question

Pulumi · Accepted Answer

Karpenter is a just-in-time autoscaler for Kubernetes that works with many different cloud providers. It observes the available pending pods and makes decisions to launch more nodes or terminate them based on the necessity. Karpenter can be a more efficient alternative to the Kubernetes Cluster Autoscaler, quickly reacting to changes in workload.

Trust is a certificate manager for Kubernetes, often used in conjunction with cert-manager, which can automatically issue and renew TLS certificates within a Kubernetes cluster. It can also manage issuing certificates using a variety of Issuers, such as Let's Encrypt, HashiCorp Vault, Venafi, a simple signing key pair, or self-signed.

Combining Karpenter with Trust's cert-manager allows you to automatically manage TLS certificates for the services running on the dynamically scaled infrastructure which Karpenter manages.

Below, I'll illustrate how to set up cert-manager with Trust for certificate management along with Karpenter for auto-scaling in a Kubernetes cluster using Pulumi.

First, you'll install cert-manager to handle certificate management followed by setting up Karpenter. Note that this setup assumes you have a Kubernetes cluster already running and kubectl is configured to communicate with the cluster.

Here's a TypeScript program that sets up both cert-manager and Karpenter on a Kubernetes cluster:

import * as k8s from "@pulumi/kubernetes";

// Create a namespace for cert-manager
const certManagerNamespace = new k8s.core.v1.Namespace("cert-manager", {
    metadata: {
        name: "cert-manager",
    },
}, { provider: k8sProvider }); // assumes an existing provider configuration

// Install cert-manager with Helm
const certManagerChart = new k8s.helm.v3.Chart("cert-manager", {
    chart: "cert-manager",
    version: "v1.5.3",
    namespace: certManagerNamespace.metadata.name,
    fetchOpts: {
        repo: "https://charts.jetstack.io",
    },
}, { provider: k8sProvider, dependsOn: [certManagerNamespace] });

// Create a namespace for Karpenter
const karpenterNamespace = new k8s.core.v1.Namespace("karpenter", {
    metadata: {
        name: "karpenter",
    },
}, { provider: k8sProvider });

// Install Karpenter with Helm
const karpenterChart = new k8s.helm.v3.Chart("karpenter", {
    chart: "karpenter",
    version: "0.4.3", // Use the latest version of Karpenter
    namespace: karpenterNamespace.metadata.name,
    fetchOpts: {
        repo: "https://charts.karpenter.sh",
    },
    // Set values for the Helm chart
    values: {
        clusterName: "<your-cluster-name>", // Replace with your cluster name
        // Add other configurations as needed
    },
}, { provider: k8sProvider, dependsOn: [karpenterNamespace] });

// Export the name of the namespace
export const certManagerNamespaceName = certManagerNamespace.metadata.name;
export const karpenterNamespaceName = karpenterNamespace.metadata.name;

Be sure to replace "<your-cluster-name>" with the name of your actual Kubernetes cluster.

To run this code:

Install the Pulumi CLI and set up your Pulumi project.
Configure Pulumi to use your desired cloud provider.
Save this TypeScript code to a file, for example, index.ts.
Run npm install or yarn install to fetch the package dependencies.
Run pulumi up to deploy the program to your cluster.

The above program does the following:

It sets up namespaces for both cert-manager and Karpenter to keep things organized.
Installs cert-manager using the Helm package manager, which will manage the lifecycle of certificates within your Kubernetes cluster.
Installs Karpenter in a similar fashion, also using Helm, configuring it with the necessary details for your cluster.
Exports the names of the namespaces that were created for your reference.

This code provides the foundational elements to manage certificates and autoscaling within your Kubernetes environment. It allows you to take advantage of Karpenter's efficiency in scaling and Trust's cert-manager for handling TLS certificates.