Deploy the webhook helm chart on Google Kubernetes Engine (GKE)

Question

Pulumi · Accepted Answer

To deploy a Helm chart to a Google Kubernetes Engine (GKE) cluster using Pulumi, you would follow these general steps:

1. Set up a new Pulumi project and configure it for the GCP provider.
2. Create a GKE cluster or use an existing one.
3. Use the Pulumi Kubernetes provider to deploy the Helm chart to the GKE cluster.

Here's how you'd write a Pulumi program in TypeScript to accomplish this. This program assumes that you've already set up Pulumi with GCP credentials and have `gcloud` CLI configured for your account.

First, we'll import the necessary Pulumi packages:

```typescript
import * as gcp from "@pulumi/gcp";
import * as k8s from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";
```

Next, we create a GKE cluster. We'll configure the GKE cluster with a small node size and the default node count. Be sure to adjust these settings based on your workload needs and budget.

```typescript
const cluster = new gcp.container.Cluster("webhook-cluster", {
    initialNodeCount: 2,
    nodeVersion: "latest",
    minMasterVersion: "latest",
    nodeConfig: {
        machineType: "n1-standard-1",  // Adjust the machine type depending on your needs
        oauthScopes: [
            "https://www.googleapis.com/auth/compute",
            "https://www.googleapis.com/auth/devstorage.read_only",
            "https://www.googleapis.com/auth/logging.write",
            "https://www.googleapis.com/auth/monitoring"
        ],
    },
});
```

After the cluster is created, we need to configure `kubectl` so the Pulumi Kubernetes provider can interact with the new cluster:

```typescript
const kubeconfig = pulumi.all([cluster.name, cluster.endpoint, cluster.masterAuth]).apply(([name, endpoint, masterAuth]) => {
    const context = `${gcp.config.project}_${gcp.config.zone}_${name}`;
    return `apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ${masterAuth.clusterCaCertificate}
    server: https://${endpoint}
  name: ${context}
contexts:
- context:
    cluster: ${context}
    user: ${context}
  name: ${context}
current-context: ${context}
kind: Config
preferences: {}
users:
- name: ${context}
  user:
    auth-provider:
      config:
        cmd-args: config config-helper --format=json
        cmd-path: gcloud
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp
`;
});
```

With `kubectl` configured, we'll create a `Provider` resource that encapsulates this configuration:

```typescript
const k8sProvider = new k8s.Provider("gkeK8s", {
    kubeconfig: kubeconfig,
});
```

Now we'll deploy the webhook Helm chart using the `helm.sh/v3.Chart` resource from the Pulumi Kubernetes provider. You'll need to replace `"webhook"` with the actual name of your Helm chart and specify the chart version if necessary:

```typescript
const webhookChart = new k8s.helm.v3.Chart("webhook-chart", {
    chart: "webhook",
    version: "1.0.0",  // Replace with the version of your Helm chart
    namespace: "default", // Specify the namespace if different from default
}, { provider: k8sProvider });
```

If your Helm chart requires custom values, you can pass them to the `values` property of the Helm chart resource. For example, this could include the webhook URL and any necessary authentication details.

Putting it all together, here's your complete Pulumi program:

```typescript
import * as gcp from "@pulumi/gcp";
import * as k8s from "@pulumi/kubernetes";
import * as pulumi from "@pulumi/pulumi";

// Create a GKE cluster
const cluster = new gcp.container.Cluster("webhook-cluster", {
    initialNodeCount: 2,
    nodeVersion: "latest",
    minMasterVersion: "latest",
    nodeConfig: {
        machineType: "n1-standard-1",
        oauthScopes: [
            "https://www.googleapis.com/auth/compute",
            "https://www.googleapis.com/auth/devstorage.read_only",
            "https://www.googleapis.com/auth/logging.write",
            "https://www.googleapis.com/auth/monitoring"
        ],
    },
});

// Create a kubeconfig file
const kubeconfig = pulumi.all([cluster.name, cluster.endpoint, cluster.masterAuth]).apply(([name, endpoint, masterAuth]) => {
    const context = `${gcp.config.project}_${gcp.config.zone}_${name}`;
    return `apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: ${masterAuth.clusterCaCertificate}
    server: https://${endpoint}
  name: ${context}
contexts:
- context:
    cluster: ${context}
    user: ${context}
  name: ${context}
current-context: ${context}
kind: Config
preferences: {}
users:
- name: ${context}
  user:
    auth-provider:
      config:
        cmd-args: config config-helper --format=json
        cmd-path: gcloud
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp
`;
});

// Create a provider for the above kubeconfig
const k8sProvider = new k8s.Provider("gkeK8s", {
    kubeconfig: kubeconfig,
});

// Deploy webhook Helm chart
const webhookChart = new k8s.helm.v3.Chart("webhook-chart", {
    chart: "webhook",
    version: "1.0.0",
    namespace: "default",
}, { provider: k8sProvider });

// Export the Kubeconfig and cluster name
export const kubeconfigOutput = kubeconfig;
export const clusterName = cluster.name;
```

This program performs the following actions:

1. Creates a GKE cluster with a specified number of nodes and machine type.
2. Generates kubeconfig to access the cluster with `kubectl`.
3. Sets up a Pulumi Kubernetes provider configured to use the generated kubeconfig.
4. Deploys the specified Helm chart to the GKE cluster.

To run your Pulumi program, first, ensure you are logged into the GCP CLI and have selected the correct project. Then, run `pulumi up` in the terminal where you have saved the above TypeScript code in a file (for example, `index.ts`).

This will prompt Pulumi to create the resources as described in your program. Once the process is complete, your Helm chart will be deployed on the GKE cluster. Check the output of `pulumi up` to confirm that everything has been deployed successfully.