https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/index.htmlIn this chapter you use Pulumi’s Kubernetes provider to deploy platform services onto the AKS cluster provisioned in Chapter 3. Instead of running kubectl apply or helm install by hand, every cluster resource is declared in Python and managed through the same pulumi up workflow you already know. Provider Package Package PyPI name What it manages pulumi-kubernetes pulumi_kubernetes Any Kubernetes resource — manifests, Helm releases The provider connects to the cluster through a kubeconfig. For the AKS cluster created in Chapter 3, Pulumi reads the kubeconfig directly from the KubernetesCluster output — no manual az aks get-credentials step is required:Hugoen-ushttps://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/1-kubernetes-provider/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/1-kubernetes-provider/index.htmlIn this lab you extend the Kubernetes component with a Pulumi Kubernetes provider and an install_helm_chart method, then verify connectivity to the cluster. Step 1 — Add the Kubernetes Provider Package Add pulumi-kubernetes to requirements.txt: pulumi==3.244.0 pulumi-azure-native==3.19.0 pulumi-kubernetes==4.31.1 pulumi-random==4.21.0 Install it: pip install -r requirements.txt Explanation pulumi-kubernetes is the Pulumi provider for Kubernetes. It can manage any Kubernetes resource (Deployments, Services, ConfigMaps, …) and includes a helm.v3.Release resource that wraps helm install / helm upgrade. Like all Pulumi providers it tracks deployed state and reconciles on every pulumi up.https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/2-traefik/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/2-traefik/index.htmlIn this lab you install Traefik on AKS using install_helm_chart, wiring the static public IP from Chapter 3 directly into the Helm values as a Pulumi output. Step 1 — Declare the Traefik Release Add the following call to __main__.py, after the DNS setup block: aks.install_helm_chart( "traefik", chart="traefik", repo="https://traefik.github.io/charts", namespace="traefik", timeout=600, values=public_ip.name.apply(lambda pip_name: { "service": { "enabled": True, "type": "LoadBalancer", "annotations": { "service.beta.kubernetes.io/azure-pip-name": pip_name } } }) ) Explanation The Traefik Helm chart creates a Kubernetes Service of type LoadBalancer. AKS reads the annotation on that service to attach the pre-provisioned static IP:https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/3-cert-manager/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://cloud-native.labs.netrics.dev/4-pulumi-kubernetes/3-cert-manager/index.htmlIn this lab you install Cert-Manager and configure a Let’s Encrypt ClusterIssuer so that any Ingress in the cluster can receive a signed TLS certificate automatically. Step 1 — Install Cert-Manager Add the following Helm chart call to __main__.py, after the Traefik block: cert_manager = aks.install_helm_chart( "cert-manager", chart="cert-manager", repo="https://charts.jetstack.io", namespace="cert-manager", values={ "crds": {"enabled": True} } ) Explanation crds.enabled: true tells the Helm chart to deploy the Cert-Manager CRD bundle alongside the controller. The CRDs define the ClusterIssuer, Certificate, and CertificateRequest kinds — without them the Kubernetes API server rejects those resources as unknown types.