3. Pulumi for Azure
In this chapter you connect Pulumi to Azure and provision real cloud infrastructure: a Resource Group, virtual network, AKS cluster, container registry, and a static public IP for the ingress controller.
Azure Resource Model
Azure organises resources into a three-level hierarchy:
| Level | Description | Example |
|---|---|---|
| Subscription | Billing and access boundary — one per team or project | sub-garaio-lab |
| Resource Group | Lifecycle container — deploy and delete resources as a group | rg-lab-dev |
| Resource | Individual Azure service (VM, VNet, cluster, …) | aks-lab-dev |
Naming Convention
This workshop follows the
Azure Cloud Adoption Framework
naming pattern:[abbreviation]-[purpose]-[environment].
| Resource type | Abbreviation | Lab name |
|---|---|---|
| Resource Group | rg- | rg-lab-dev |
| Virtual Network | vnet- | vnet-lab-dev |
| Subnet | (no prefix) | nodes |
| AKS Cluster | aks- | aks-lab-dev |
| Container Registry (ACR) | cr | crlabdev<suffix> |
| Public IP Address | pip- | pip-lab-dev-ingress |
Some resource types — storage accounts, ACR, Key Vault — require globally unique names. The lab appends a
random suffix generated by pulumi_random.RandomString.
Provider Packages
| Package | PyPI name | What it manages |
|---|---|---|
pulumi-azure-native | pulumi-azure-native | All Azure Resource Manager APIs |
pulumi-random | pulumi_random | Random strings and passwords |
Authentication
Pulumi reads Azure credentials from the active az CLI session — no extra configuration is needed for local
development:
For automation (CI/CD), Pulumi reads credentials from environment variables:
ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID.