Deploy the web-dvwa helm chart on AWS EKS

Question

Pulumi · Accepted Answer

To deploy the `web-dvwa` Helm chart on an AWS Elastic Kubernetes Service (EKS) cluster, we will perform several steps using Pulumi with TypeScript:

1. **Create an EKS Cluster**: We'll set up an EKS cluster where our Kubernetes resources will reside.
2. **Define an IAM Role for the EKS**: This role will be used by the EKS service to create AWS resources like EC2 instances for Kubernetes worker nodes.
3. **Deploy the Helm Chart**: We'll use Pulumi's Kubernetes provider to deploy the `web-dvwa` Helm chart onto our EKS cluster.

Here's a breakdown of the Pulumi program, which accomplishes the deployment:

- We start by importing necessary Pulumi libraries and setting up AWS and Kubernetes providers.
- We then create an IAM role and EKS cluster.
- Once we have our EKS cluster set up, we configure the Kubernetes provider to target the EKS cluster.
- Finally, we deploy the `web-dvwa` Helm chart onto the EKS cluster.

Now, let's dive into the Pulumi program that accomplishes this:

```typescript
import * as eks from "@pulumi/eks";
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";
import * as aws from "@pulumi/aws";
import * as awsx from "@pulumi/awsx";

// Step 1: Create an EKS Cluster
// The EKS cluster is the foundation of our K8s-based application, where all the services and workloads will run.
const vpc = new awsx.ec2.Vpc("my-vpc", {});
const cluster = new eks.Cluster("my-cluster", {
    vpcId: vpc.id,
    subnetIds: vpc.privateSubnetIds,
    instanceType: "t2.medium",
    desiredCapacity: 2,
    minSize: 1,
    maxSize: 2,
});

// Step 2: Define an IAM Role for EKS
// This IAM role will be assumed by the AWS EKS service to manage the cluster and create additional resources like worker nodes.
const eksRole = new aws.iam.Role("eksRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
        Service: "eks.amazonaws.com",
    }),
});

// Role policy attachments for the EKS role
const servicePolicyAttachment = new aws.iam.RolePolicyAttachment("eksServicePolicyAttachment", {
    role: eksRole.name,
    policyArn: aws.iam.ManagedPolicies.AmazonEKSClusterPolicy,
});

const workerNodePolicyAttachment = new aws.iam.RolePolicyAttachment("eksWorkerNodePolicyAttachment", {
    role: eksRole.name,
    policyArn: aws.iam.ManagedPolicies.AmazonEKSWorkerNodePolicy,
});

// Step 3: Deploy the Helm Chart
// Here we deploy the web-dvwa Helm chart to the EKS cluster. Please replace the 'chart-version' with
// the version you wish to deploy, if not the latest. Make sure to configure the Helm chart values as per your requirements.
const chart = new k8s.helm.v3.Chart("dvwa-chart", {
    chart: "web-dvwa",
    version: "chart-version", // replace with your desired chart version
    fetchOpts: {
        // repo: "https://.../", // Specify the Helm repository URL here if it's not a publicly available Helm chart
    },
}, { provider: cluster.provider });

// Exporting the EKS cluster's kubeconfig and the web application endpoint
export const kubeconfig = cluster.kubeconfig;
export const webEndpoint = pulumi.interpolate`http://${chart.getResourceProperty("v1/Service", "web-dvwa", "status")["loadBalancer"]["ingress"][0]["hostname"]}`;
```

In the program above:

- We provision a new VPC and an EKS cluster using the `@pulumi/eks` package. This sets up the network infrastructure and the Kubernetes control plane.
- We create an IAM role for EKS with the necessary policies for cluster management and worker node operation.
- We use the `@pulumi/kubernetes` package to deploy the `web-dvwa` Helm chart to the EKS cluster. This step will require the Helm chart to be accessible from a Helm repository.
- Lastly, we export the kubeconfig of our EKS cluster and the endpoint at which the `web-dvwa` service will be accessible.

Keep in mind you will need to replace `"chart-version"` with the actual version of the Helm chart you want to deploy and possibly specify the Helm repository URL in `fetchOpts` if it's not a publicly available chart.

This Pulumi program should run as expected when provided with the correct Helm chart version, and if you have the Pulumi CLI and AWS CLI configured correctly with the right credentials.