通过Terraform Helm提供程序和Azure DevOps部署Helm图表，同时从ACR中获取Helm图表

Question

我正在尝试使用Terraform掌舵提供程序和Azure DevOps容器作业将ACR掌舵图表部署到AKS群集，但是从ACR提取掌舵表时失败。请让我知道出了什么问题。

helm provider tf模块：

data "helm_repository" "cluster_rbac_helm_chart_repo" {
  name = "mcp-rbac-cluster"
  url  = "https://mcpshareddcr.azurecr.io"
}
# Deploy Cluster RBAC helm chart onto the cluster
resource "helm_release" "cluster_rbac_helm_chart_release" {
  name  = "mcp-rbac-cluster"
  repository = data.helm_repository.cluster_rbac_helm_chart_repo.metadata[0].name
  chart = "mcp-rbac-cluster"
}

提供者：

  version                    = "=1.36.0"
  tenant_id                  = var.ARM_TENANT_ID
  subscription_id            = var.ARM_SUBSCRIPTION_ID
  client_id                  = var.ARM_CLIENT_ID
  client_secret              = var.ARM_CLIENT_SECRET
  skip_provider_registration = true
}

data "azurerm_kubernetes_cluster" "aks_cluster" {
  name                = var.aks_cluster
  resource_group_name = var.resource_group_aks
}

locals {
  kubeconfig_path = "/tmp/kubeconfig"
}

resource "local_file" "kubeconfig" {
  filename = local.kubeconfig_path
  content  = data.azurerm_kubernetes_cluster.aks_cluster.kube_admin_config_raw
}

provider "helm" {
  home = "resources/.helm"
  kubernetes {
    load_config_file = true
    config_path = local.kubeconfig_path
  }
}

module "aks_resources" {
  source = "./modules/helm/aks-resources"
}

错误： 错误：貌似“ ”不是有效的图表存储库或无法访问：无法获取 /index.yaml：找不到404

Answer 1

问题是您在Terraform helm_repository中使用了错误的url。适用于ACR的右侧url如下所示：

https://acrName.azurecr.io/helm/v1/repo

而且ACR是一个私有注册表，因此这意味着您需要为其添加用户名和密码。最后，您的Terraform代码应如下所示：

data "helm_repository" "cluster_rbac_helm_chart_repo" {
  name = "mcp-rbac-cluster"
  url  = "https://mcpshareddcr.azurecr.io/helm/v1/repo"

  username = "xxxxx"
  password = "xxxxx"
}

# Deploy Cluster RBAC helm chart onto the cluster
resource "helm_release" "cluster_rbac_helm_chart_release" {
  name  = "mcp-rbac-cluster"
  repository = data.helm_repository.cluster_rbac_helm_chart_repo.metadata[0].name
  chart = "mcp-rbac-cluster"
}

更新

以下是屏幕截图，它可以很好地运行并将图表部署在AKS中：

Answer 2

直到现在，Helm仍然不支持从OCI注册表直接安装图表。

建议的步骤是：

1. helm chart remove mycontainerregistry.azurecr.io/helm/hello-world:v1
2. helm chart pull mycontainerregistry.azurecr.io/helm/hello-world:v1
3. helm chart export mycontainerregistry.azurecr.io/helm/hello-world:v1 --destination ./install
4. cd install & helm install myhelmtest ./hello-world

所以我的解决方法是：

resource "null_resource" "download_chart" {
  provisioner "local-exec" {
    command = <<-EOT
      export HELM_EXPERIMENTAL_OCI=1
      helm registry login mycontainerregistry.azurecr.io --username someuser --password somepass
      helm chart remove mycontainerregistry.azurecr.io/helm/hello-world:v1
      helm chart pull mycontainerregistry.azurecr.io/helm/hello-world:v1
      helm chart export mycontainerregistry.azurecr.io/helm/hello-world:v1 --destination ./install
    EOT
  }
}

resource "helm_release" "chart" {
  name             = "hello_world"
  repository       = "./install"
  chart            = "hello-world"
  version          = "v1"

  depends_on = [null_resource.download_chart]
}

不完美，但是可以。

Answer 3

上述解决方案的小改进。包括一个触发器来强制每次下载图表。否则，它希望您在第一次部署后始终维护图表的本地副本

resource "null_resource" "download_chart" {
  triggers = {
    always_run = timestamp()
  }

  provisioner "local-exec" {
    command = <<-EOT
      export HELM_EXPERIMENTAL_OCI=1
      helm registry login ${var.registry_fqdn} --username ${var.acr_client_id} --password ${var.acr_client_secret}
      helm chart remove ${var.registry_fqdn}/helm/${var.chart_name}:${var.chart_tag}
      helm chart pull ${var.registry_fqdn}/helm/${var.chart_name}:${var.chart_tag}
      helm chart export ${var.registry_fqdn}/helm/${var.chart_name}:${var.chart_tag} --destination ./install
    EOT
  }
}