Deploy the cert-manager-webhook-netcup helm chart on Digital Ocean Kubernetes Service

Question

Pulumi · Accepted Answer

To deploy the `cert-manager-webhook-netcup` Helm chart on DigitalOcean's Kubernetes service using Pulumi, you will need to perform the following steps:

1. Create a new DigitalOcean Kubernetes (DOKS) cluster or use an existing one.
2. Install `cert-manager` on the cluster, since `cert-manager-webhook-netcup` relies on `cert-manager`.
3. Deploy the `cert-manager-webhook-netcup` Helm chart onto the cluster.

To accomplish this, we'll write a Pulumi program in TypeScript:

- We'll use the `digitalocean.KubernetesCluster` resource to provision the DOKS cluster.
- The `kubernetes.helm.v3.Chart` resource from the Pulumi Kubernetes provider will be used to deploy both the `cert-manager` and `cert-manager-webhook-netcup` Helm charts.

Let's start with the code. This is a complete program, and the comments will explain each bit:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as digitalocean from '@pulumi/digitalocean';
import * as k8s from '@pulumi/kubernetes';

// Define the version of cert-manager here for consistency across the installation.
const certManagerVersion = "v1.5.3"; // Make sure to use the version compatible with your Helm chart

// Step 1: Create a DigitalOcean Kubernetes cluster
const cluster = new digitalocean.KubernetesCluster('doks-cluster', {
    // Specify the DigitalOcean region where you want the cluster created
    region: digitalocean.Regions.NYC3,
    // Version of Kubernetes to run on the cluster.
    // This must be a version supported by DigitalOcean Kubernetes service,
    // and may need to be updated periodically.
    version: "1.21.5-do.0", // Use an appropriate DOKS-supported version
    // Define the size and number of nodes in the default node pool
    nodePool: {
        name: 'default-pool', // The name of the node pool in DOKS
        size: "s-2vcpu-2gb",  // The slug representing the type of Droplet to use as workers in the node pool
        nodeCount: 2,         // The number of Droplet instances in the node pool
    },
});

// Export the kubeconfig from the cluster
export const kubeconfig = cluster.kubeConfigs[0].rawConfig;

// Step 2: Define a provider instance using the kubeconfig from the created cluster
const k8sProvider = new k8s.Provider('k8s-provider', {
    kubeconfig: kubeconfig,
});

// Step 3: Install cert-manager Helm chart using the kubernetes.helm.v3.Chart class
const certManagerChart = new k8s.helm.v3.Chart('cert-manager', {
    chart: 'cert-manager',
    version: certManagerVersion, // Ensure this is the version you need
    namespace: 'cert-manager',   // Namespace into which to install the chart
    fetchOpts: {
        // Specify the repository where the cert-manager Helm chart can be found
        repo: "https://charts.jetstack.io",
    },
    values: {
        // Customize the values of the Helm chart if necessary
        installCRDs: true, // This is required for cert-manager
    },
}, { provider: k8sProvider });

// Step 4: Deploy the cert-manager-webhook-netcup Helm chart, relying on cert-manager
const webhookNetcupChart = new k8s.helm.v3.Chart('webhook-netcup', {
    chart: 'cert-manager-webhook-netcup',
    // Change to the appropriate version for the webhook-netcup Helm chart
    version: "1.0.0",      // Use an appropriate chart version
    namespace: 'cert-manager', // Deploy into the same namespace as cert-manager
    fetchOpts: {
        // Specify the repository that contains your chart if it's not in the default Helm repo.
        // Replace with the actual repository URL for cert-manager-webhook-netcup
        repo: "https://your-chart-repo", 
    },
    values: { 
        // Provide configuration values for the webhook-netcup chart here
    },
}, { provider: k8sProvider, dependsOn: [certManagerChart] }); // Ensure cert-manager is installed first

// Export the DigitalOcean cluster name
export const clusterName = cluster.name;
```

This program performs the following actions:

1. Creates a new DOKS cluster in the NYC3 region (or you can specify a different region) with a specified Kubernetes version and node pool configuration.
2. Exports the kubeconfig needed to interact with the cluster.
3. Configures a Pulumi Kubernetes provider to manage resources in this cluster using the exported kubeconfig.
4. Installs the `cert-manager` Helm chart, which is a prerequisite for `cert-manager-webhook-netcup`. CRD installation is enabled for `cert-manager`.
5. Deploys your `cert-manager-webhook-netcup` with the necessary Helm chart and version, within the same namespace as `cert-manager`, and only after `cert-manager` is successfully installed.

To run this program:

1. Set up Pulumi with DigitalOcean by following instructions [here](https://www.pulumi.com/registry/packages/digitalocean/installation-configuration/).
2. Install `@pulumi/digitalocean` and `@pulumi/kubernetes` using npm:

```
npm install @pulumi/digitalocean @pulumi/kubernetes
```

3. Create a new Pulumi TypeScript project and add the above code to the `index.ts` file.
4. Run `pulumi up` to preview and deploy the changes; this command will output the planned operations before prompting for confirmation to proceed with the deployment.

Please replace the chart version and repo URL in the webhook-netcup chart configuration with the correct values for your use case. Additionally, you may need to adjust the Kubernetes version to one that is currently supported by the DigitalOcean Kubernetes service.