Deploy the trivy-sbom helm chart on Azure Kubernetes Service (AKS)
TypeScriptDeploying the
trivy-sbom
Helm chart on Azure Kubernetes Service involves several steps. The process consists of setting up an AKS cluster, integrating it with a container registry if required, and then using Helm to deploy the chart to the cluster.Below is an outline of the Pulumi program we're going to write in TypeScript:
-
Creating the AKS Cluster: We'll define the desired AKS cluster configuration, such as node size, node count, and other relevant Kubernetes settings using the
azure.containerservice.KubernetesCluster
resource. -
Deploying
trivy-sbom
using Helm: Once we have our AKS cluster up and running, we'll deploy thetrivy-sbom
Helm chart using Pulumi'skubernetes.helm.v3.Chart
resource, which facilitates deploying Helm charts into a Kubernetes cluster.
Let's start by setting up our Pulumi program to create the AKS cluster.
import * as pulumi from '@pulumi/pulumi'; import * as azure from '@pulumi/azure'; import * as k8s from '@pulumi/kubernetes'; // Step 1: Create an AKS cluster const resourceGroup = new azure.core.ResourceGroup('aksResourceGroup'); const aksCluster = new azure.containerservice.KubernetesCluster('aksCluster', { resourceGroupName: resourceGroup.name, location: resourceGroup.location, defaultNodePool: { name: 'default', nodeCount: 2, vmSize: 'Standard_D2_v2', }, dnsPrefix: `${pulumi.getStack()}-k8s`, identity: { type: 'SystemAssigned', }, }); // Export the kubeconfig export const kubeconfig = aksCluster.kubeConfigRaw;
Now that we have defined an AKS cluster, we can use Pulumi's
kubernetes
provider to deploy thetrivy-sbom
Helm chart. We'll import this Helm chart using thekubernetes.helm.v3.Chart
resource, as shown in the code snippet below.// Step 2: Deploy the "trivy-sbom" Helm chart to the AKS cluster // Create a k8s provider using the AKS kubeconfig. const k8sProvider = new k8s.Provider('k8sProvider', { kubeconfig: aksCluster.kubeConfigRaw, }); // Deploy "trivy-sbom" Helm chart const trivySbomChart = new k8s.helm.v3.Chart('trivy-sbom', { chart: 'trivy-sbom', version: '0.1.0', // specify the version of the chart if necessary namespace: 'security', // specify the namespace where the chart will be installed fetchOpts: { repo: 'https://aquasecurity.github.io/helm-charts/', // specify the Helm chart repository }, }, { provider: k8sProvider }); // Export the chart name export const chartName = trivySbomChart.name;
In this Pulumi program:
- We create a new resource group for our AKS cluster using
azure.core.ResourceGroup
. - We set up an AKS cluster with
azure.containerservice.KubernetesCluster
, specifying the node count and size, as well as other configurations likednsPrefix
. The system-assigned identity is used for the AKS cluster. - The cluster's kubeconfig is exported to enable us to interact with it using
kubectl
or to integrate with CI/CD systems. - We create a
k8s.Provider
which dictates the Kubernetes cluster that our Helm chart should be deployed to. - We deploy the
trivy-sbom
Helm chart to our AKS cluster withk8s.helm.v3.Chart
, where itsfetchOpts
property points to the Helm chart's repository.
You will see that we exported the
kubeconfig
and thechartName
. Exporting these values can be beneficial. For example,kubeconfig
allows access to the cluster with tools likekubectl
, andchartName
provides a reference to the deployed Helm chart that can be useful for monitoring or further automation tasks.Remember to replace
trivy-sbom
and0.1.0
with the correct chart name and version you wish to deploy. Also, be sure to use the correct Helm chart repository URL (iftrivy-sbom
has a different source). In this program, we have assumed thattrivy-sbom
is available in the specified repository and provided a version and namespace to fit the context of the deployment.This program should provide a fully functional starting point for deploying the
trivy-sbom
Helm chart to AKS with Pulumi. Each line has comments to help you understand what's happening at each step. Run this program with Pulumi's usual workflow (pulumi up
), and it will provision the infrastructure and deploy the Helm chart as described.-