Deploy the aws-iam-role-service-account helm chart on Kubernetes

Question

Pulumi · Accepted Answer

To deploy a Helm chart that associates an AWS IAM role with a Kubernetes service account (often used in Amazon EKS for fine-grained IAM permissions), we'll use the Pulumi Kubernetes provider. Specifically, we'll utilize the Chart resource, which is the Pulumi representation of a Helm chart. This resource allows us to deploy the Helm chart from a repository or a local path.

In this example, I'll assume the chart aws-iam-role-service-account is available in a Helm repository. You'll need to ensure that your Kubernetes cluster is already configured and accessible to Pulumi through the kubeconfig file.

Before diving into the code, here's a breakdown of what we're going to do:

Import necessary Kubernetes packages.
Create an instance of the Chart resource, which refers to the aws-iam-role-service-account Helm chart.
Specify the Helm repository where the chart can be found.
Configure the chart's values according to your requirements, such as the AWS IAM policy, the service account name, etc.

Here's the Pulumi TypeScript program that will perform the deployment:

import * as k8s from '@pulumi/kubernetes';

// Replace these variables with the appropriate values for your setup
const chartName = 'aws-iam-role-service-account'; // The name of the Helm chart
const chartVersion = '1.0.0'; // The version of the Helm chart
const helmRepoName = 'my-repository'; // The name of the Helm repository
const helmRepoUrl = 'https://myhelmrepo.com/charts'; // The URL to the Helm repository
const namespace = 'default'; // The namespace to deploy the chart in

// Define the Helm chart resource from the repository
const iamRoleServiceAccountChart = new k8s.helm.v3.Chart(chartName, {
  // Specify the chart, version, and source repository
  chart: chartName,
  version: chartVersion,
  fetchOpts: {
    repo: helmRepoUrl,
  },
  // Namespace to deploy the Helm chart into
  namespace: namespace,
  // Chart values for custom configuration - replace with your IAM role policy and other configurations
  values: {
    // ...Your specific configuration values go here...
    // For example:
    // iamPolicy: "<Your IAM policy>",
    // iamRoleName: "<Your IAM role name>",
    // serviceAccountName: "<Your service account name>",
  },
});

// Export the status URL
export const statusUrl = iamRoleServiceAccountChart.getResourceProperty('v1/Service', 'example-service', 'status.loadBalancer.ingress[0].hostname');

In the above program:

We start by importing the @pulumi/kubernetes package, which contains the necessary classes and functions to interact with Kubernetes resources using Pulumi.
We define a series of variables relevant to the Helm chart we want to deploy – the chart name, version, repository name, and URL, as well as the desired namespace for deployment.
We next create the Chart resource, which represents our Helm deployment. When this Pulumi program is run, it will instruct Pulumi to deploy the aws-iam-role-service-account Helm chart with the specified version from the Helm repository URL provided.
The values field is critical; it allows you to pass in any custom configuration necessary for the chart. You'll replace the placeholders listed (commented out) with the specific configuration details for your AWS IAM role and Kubernetes service account.
Finally, there's an export statement that would normally be used to output useful information post-deployment. The current export assumes the chart creates a Service with a load balancer and exports its hostname. In your case, you might want to export different information relevant to the aws-iam-role-service-account chart.

Please remember to replace the placeholders in the values section with actual configuration details pertinent to your AWS environment and service account needs. You can consult the chart's documentation for all the configurable options.

Once you've prepared your Pulumi program, deploy it by running pulumi up within your project directory. Pulumi will print out a summary of the planned deployment, which you can confirm for it to proceed and apply the changes. If the deployment is successful, any exported variables like statusUrl will be displayed in the terminal.