Deploy the argo-workflow helm chart on Azure Kubernetes Service (AKS)

Question

Pulumi · Accepted Answer

To deploy the `argo-workflow` Helm chart on an Azure Kubernetes Service (AKS) cluster using Pulumi, you must perform the following steps:

1. **Set up an AKS cluster**: First, you create an AKS cluster where you will deploy `argo-workflow`. The cluster will provide the Kubernetes environment needed to run your workflows.
2. **Configure Pulumi to use the Azure Provider**: Make sure Pulumi is set up to manage Azure resources.
3. **Deploy the `argo-workflow` Helm chart using Pulumi's Kubernetes provider**: Helm charts are packages that contain all the necessary resources to deploy an application on Kubernetes. Pulumi can deploy Helm charts using the Kubernetes provider.

Below is the Pulumi TypeScript program that accomplishes these steps:

```typescript
import * as azure from "@pulumi/azure"; // Azure provider
import * as azuread from "@pulumi/azuread"; // Azure Active Directory provider
import * as k8s from "@pulumi/kubernetes"; // Kubernetes provider
import * as pulumi from "@pulumi/pulumi"; // Core Pulumi framework

// Step 1: Configuring Azure Active Directory for AKS authentication
const resourceGroup = new azure.core.ResourceGroup("aksResourceGroup", {
    location: "East US",
});

const adApp = new azuread.Application("aks");

const adSp = new azuread.ServicePrincipal("aksSp", {
    applicationId: adApp.applicationId,
});

const adSpPassword = new azuread.ServicePrincipalPassword("aksSpPassword", {
    servicePrincipalId: adSp.id,
    value: "secretpassword", // Replace 'secretpassword' with a strong password
    endDate: "2099-01-01T00:00:00Z",
});

// Step 2: Creating the AKS cluster
const k8sCluster = new azure.containerservice.KubernetesCluster("aksCluster", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    agentPoolProfiles: [{
        name: "aksagentpool",
        count: 1,
        vmSize: "Standard_DS2_v2",
    }],
    dnsPrefix: "aksk8s",
    linuxProfile: {
        adminUsername: "aksuser",
        sshKey: {
            keyData: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
        },
    },
    servicePrincipal: {
        clientId: adApp.applicationId,
        clientSecret: adSpPassword.value,
    },
    kubernetesVersion: "1.18.14",
});

// Step 3: Deploying the argo-workflow Helm chart on AKS
const k8sProvider = new k8s.Provider("k8sProvider", {
    kubeconfig: k8sCluster.kubeConfigRaw,
});

const argoWorkflowChart = new k8s.helm.v3.Chart("argo-workflow", {
    chart: "argo-workflows",
    version: "0.2.3", // Use the appropriate chart version
    namespace: "default", // Specify namespace if needed; otherwise, it uses the default
    fetchOpts: {repo: "https://argoproj.github.io/argo-helm"},
}, {provider: k8sProvider});

// Export the Kubeconfig
export const kubeConfig = k8sCluster.kubeConfigRaw;
```

### Explanation

1. **Set up an Azure Active Directory application and service principal**: This authentication will be used by AKS to interact with other Azure services on your behalf.
2. **Create an AKS cluster**: The `azure.containerservice.KubernetesCluster` resource is used to create an AKS cluster. Configure the properties according to your needs. Specifically, we set up an agent pool with one virtual machine and provide an SSH public key for authentication.
3. **Deploy the `argo-workflow` Helm chart using Pulumi's Kubernetes provider**: The `k8s.helm.v3.Chart` resource is used to deploy the Helm chart.

### Important Notes

- Replace the placeholder `"ssh-rsa AAAAB3..."` with your actual SSH public key.
- Use a secure password instead of `"secretpassword"` and best practice is to use Pulumi's secrets handling instead of hardcoding sensitive information.
- You need to tailor the `version` and other parameters of the Helm chart to match the version of `argo-workflow` you wish to deploy.
- The `kubeconfig` output variable provides the Kubernetes configuration needed to interact with your AKS cluster using kubectl or any Kubernetes client.

To execute this code, you will need to have Pulumi and the required providers installed along with proper authentication set up for Microsoft Azure. Once that's ready, you can run `pulumi up` to create the resources in Azure.