Helm chart

.github/workflows/helm-lint-test.yml

@@ -0,0 +1,46 @@
+name: Helm Lint and Test Charts
+
+on: pull_request
+
+jobs:
+  lint-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 #v4.2.0
+        with:
+          version: v3.7.0
+
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa #v4.8.0
+        with:
+          python-version: '3.10'
+          check-latest: true
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 #v2.6.1
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run chart-testing (lint)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct lint --target-branch ${{ github.event.repository.default_branch }}
+    #TODO: update this to create a cluster and end to end test for the helm chart
+    #   - name: Create kind cluster
+    #     if: steps.list-changed.outputs.changed == 'true'
+    #     uses: helm/kind-action@99576bfa6ddf9a8e612d83b513da5a75875caced #v1.9.0
+
+    #   - name: Run chart-testing (install)
+    #     if: steps.list-changed.outputs.changed == 'true'
+    #     run: ct install --target-branch ${{ github.event.repository.default_branch }} 
+

.github/workflows/helm-release.yml

@@ -0,0 +1,34 @@
+name: Helm Release Charts
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
+    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses:  actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "[email protected]"
+
+      - name: Install Helm
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 #v4.2.0
+        with:
+          version: v3.7.0
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

charts/azure-managed-cluster/.helmignore

@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+*.code-workspace

charts/azure-managed-cluster/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: azure-managed-cluster
+description: A Helm chart to deploy an AKS cluster via the cluster-api-provider-azure ManagedCluster
+maintainers:
+  - name: nellyk
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/).
+version: 0.2.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 1.16.0

charts/azure-managed-cluster/README.md

@@ -0,0 +1,114 @@
+# Cluster API Provider Azure Helm Chart
+
+## Prerequisites
+
+- [Docker Desktop](https://www.docker.com/)
+- [Kind](https://kind.sigs.k8s.io/)
+- [ClusterCTL](https://cluster-api.sigs.k8s.io/clusterctl/overview.html) Version v1.6.1 or older
+- [Helm](https://helm.sh) version v3.14.0 or later
+
+## Prerequisites Installations
+
+- Docker Desktop
+ <https://www.docker.com/products/docker-desktop>
+
+- Install Kind
+  <https://kind.sigs.k8s.io/>
+
+- Install Clusterctl
+  <https://cluster-api.sigs.k8s.io/clusterctl/overview.html>
+
+- Install Helm3
+- <https://helm.sh/docs/intro/install/>
+
+## Usage
+
+To install the Helm chart, run the following command:
+
+```bash
+
+helm repo add capz https://kubernetes-sigs.github.io/azure-managed-cluster-capz-helm
+
+```
+
+### Create an Azure Service Principal or user-assigned Managed Identity
+
+- [How to create a service principal](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?view=azure-cli-latest)
+- [How to create a User-assigned Managed Identity](https://learn.microsoft.com/en-gb/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity)
+
+Set the following environment variables that are needed based on [The Cluster API Provider Azure documentation](https://capz.sigs.k8s.io/topics/managedcluster)
+
+### Create a KIND cluster (Kind clusters only work service principal)
+
+```bash
+kind create cluster --name capi-helm
+```
+
+### Initialize Cluster API and install Azure CAPZ provider
+
+```bash
+clusterctl init --infrastructure azure
+```
+
+### Deploy a cluster with Helm (please customize parameters as required)
+
+The `values.yaml` file contains the default values for the helm chart. You can override these values by creating a new values file and passing it to the helm install command.
+
+```bash
+
+**Using Service Principal:**
+
+```bash
+
+```bash
+helm install capz1 capz/azure-managed-cluster  \
+--namespace default \
+--set controlplane.sshPublicKey="$(cat ~/.ssh/id_rsa.pub)" \
+--set subscriptionID="${AZURE_SUBSCRIPTION_ID}" \
+--set identity.clientID="${AZURE_CLIENT_ID}" \
+--set identity.tenantID="${AZURE_TENANT_ID}" \
+--set identity.clientSecret="${AZURE_CLIENT_SECRET}" \
+--set identity.type=ServicePrincipal 
+```
+
+**Using Managed Identity**
+
+NB: Ensure the AZURE_USER_ASSIGNED_IDENTITY_RESOURCE_ID is set by getting the resource id of the managed identity created in Azure and it has the required permissions.
+
+```bash
+
+helm install capz1 capz/azure-managed-cluster  \
+--namespace default \
+--set subscriptionID="${AZURE_SUBSCRIPTION_ID}" \
+--set identity.clientID="${AZURE_CLIENT_ID}" \
+--set identity.tenantID="${AZURE_TENANT_ID}" \
+--set identity.type=UserAssignedMSI \
+--set identity.resourceID="${AZURE_USER_ASSIGNED_IDENTITY_RESOURCE_ID}" 
+```
+
+Check the status with:
+
+```bash
+kubectl get cluster-api
+kubectl  logs -n capz-system -l control-plane=capz-controller-manager -c manager -f
+```
+
+Get the credentials
+
+```bash
+kubectl get secret capi-helm-kubeconfig -o yaml -o jsonpath={.data.value} | base64 --decode > aks1.kubeconfig
+kubectl get secret aks-cluster-api-kubeconfig -o yaml -o jsonpath={.data.value} | base64 --decode > aks1.kubeconfig
+```
+
+Test the cluster!
+
+```bash
+kubectl --kubeconfig=aks1.kubeconfig cluster-info
+```
+
+Clean up:
+
+```bash
+helm delete capz1 -n default
+kubectl delete namespace default
+```

charts/azure-managed-cluster/templates/AzureClusterIdentity.yaml

@@ -0,0 +1,18 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
+kind: AzureClusterIdentity
+metadata:
+  labels:
+    clusterctl.cluster.x-k8s.io/move-hierarchy: "true"
+  name: {{ $.Values.identity.clusterIdentityName }} 
+spec:
+  allowedNamespaces: 
+    list: 
+    - {{ $.Values.identity.clusterIdentitySecretNamespace }}
+  clientSecret:
+    name: {{ $.Values.identity.clusterIdentitySecretName }} 
+    namespace: {{ $.Values.identity.clusterIdentitySecretNamespace }}
+  clientID: {{ $.Values.identity.clientID }} 
+  tenantID: {{ $.Values.identity.tenantID }}
+  type: {{ $.Values.identity.type }}
+  resourceID: {{ $.Values.identity.resourceID }}
+

charts/azure-managed-cluster/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "azure-managed-cluster.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully-qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "azure-managed-cluster.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "azure-managed-cluster.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "azure-managed-cluster.labels" -}}
+helm.sh/chart: {{ include "azure-managed-cluster.chart" . }}
+{{ include "azure-managed-cluster.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "azure-managed-cluster.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "azure-managed-cluster.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "azure-managed-cluster.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "azure-managed-cluster.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}