Deploy the certmanager helm chart on Azure Managed Openshift Service

Question

Pulumi · Accepted Answer

To deploy the CertManager helm chart on Azure Managed OpenShift Service using Pulumi, you will need to create an Azure Managed OpenShift cluster and then use the Helm chart support within Pulumi to deploy CertManager onto that cluster.

Below is a detailed explanation and Pulumi program that accomplishes this:

1. **Setting Up Azure Managed OpenShift Cluster**: We'll begin by creating an instance of the Managed OpenShift Cluster using `azure-native.containerservice.OpenShiftManagedCluster` resource. This step involves setting up the necessary properties for the OpenShift cluster, such as location, number of agents, their VM sizes, and network settings.

2. **Installing CertManager via Helm**: After setting up the cluster, we will use the `kubernetes.helm.v3.Chart` resource from the Pulumi Kubernetes provider to deploy the CertManager Helm chart. This step requires the Helm chart name, version, and any custom values we wish to configure.

Here is the TypeScript program:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azureNative from "@pulumi/azure-native";
import * as k8s from "@pulumi/kubernetes";

const resourceGroupName = "myResourceGroup";
const clusterName = "myOpenShiftCluster";

// Creating an Azure resource group
const resourceGroup = new azureNative.resources.ResourceGroup(resourceGroupName, {
    resourceGroupName: resourceGroupName,
});

// Deploying the Azure Managed OpenShift cluster
const managedCluster = new azureNative.containerservice.OpenShiftManagedCluster(clusterName, {
    resourceName: clusterName,
    resourceGroupName: resourceGroup.name,
    // Additional required properties like location, network profile, agent count etc.
    // need to be provided here as per your requirements.
});

// Ensure the cluster is created before attempting to install the Helm chart
const clusterReady = pulumi.all([resourceGroup.name, managedCluster.name]).apply(([_, __]) => true);

// Installing CertManager via Helm
const certManager = new k8s.helm.v3.Chart("certManager", {
    chart: "cert-manager",
    version: "v1.x.x", // replace with the desired version
    fetchOpts: {
        repo: "https://charts.jetstack.io",
    },
    // Set helm chart values as needed here
    values: {
        installCRDs: true,
    },
}, {
    provider: clusterReady.apply(() => {
        // Fetch the Kubernetes configuration from the newly created OpenShift cluster
        // This configuration allows Pulumi to connect to the Kubernetes cluster
        const kubeconfig = pulumi.output(azureNative.containerservice.listOpenShiftManagedClusterUserCredentials({
            resourceName: clusterName,
            resourceGroupName: resourceGroupName,
        })).kubeconfig[0].value;

// Create a Kubernetes provider instance using the kubeconfig
        return new k8s.Provider("k8sprovider", {
            kubeconfig: kubeconfig,
        });
    }),
    dependsOn: [managedCluster],
});

// Export the OpenShift cluster's kubeconfig
export const kubeConfig = pulumi.interpolate`${managedCluster.kubeConfigRaw}`;
```

To run this program, you'll need to:

1. Install Pulumi and configure Azure credentials.
2. Set up the TypeScript environment for Pulumi.
3. Save this code to a file named `index.ts`.
4. Run `pulumi up` to create the resources.

This Pulumi program will:

- Create an Azure resource group to house our Managed OpenShift cluster.
- Provision an OpenShift cluster within Azure using your defined specifications.
- Fetch the Kubernetes configuration for the newly created OpenShift cluster.
- Initialize a Pulumi Kubernetes provider with the obtained kubeconfig to manage Kubernetes resources.
- Deploy CertManager to the OpenShift cluster using the specified Helm chart and custom values.

The `kubeConfig` export provides you with the Kubernetes configuration to interact with your cluster using `kubectl` or any Kubernetes-compatible tool.

Make sure you have the rights and permissions to create resources in your Azure subscription, and Helm chart version compatibility with your cluster's Kubernetes version.