使用Pulumi对接Azure时如何不借助yaml创建SecretProviderClass

你不需要在pulumi.apply中拼接YAML来实现需求，核心是直接用Pulumi的原生Kubernetes资源类型创建SecretProviderClass，而非手动构造YAML。你之前尝试的CSIDriver是集群层面的驱动注册资源，安装Azure Key Vault CSI驱动时会自动生成，无需手动创建，也不能用来实现你的需求。

优化后完整代码逻辑 #

前提：AKS集群已预安装Azure Key Vault Provider for Secrets Store CSI Driver #

const provider = new k8s.Provider("provider", {
  kubeconfig: config.kubeconfig,
  namespace: "default",
});

// 创建Key Vault密钥
const secret = new keyvault.Secret("mysecret", {
  resourceGroupName: environmentResourceGroupName,
  vaultName: keyVaultName,
  secretName: "just-some-secret",
  properties: {
    value: administratorLogin,
  },
});

// 直接创建SecretProviderClass，无需嵌套在apply中拼接YAML
const secretProviderClass = new k8s.apiextensions.CustomResource("azure-kv-secret-provider", {
  apiVersion: "secrets-store.csi.x-k8s.io/v1",
  kind: "SecretProviderClass",
  metadata: {
    name: "azure-kvname-system-msi",
  },
  spec: {
    provider: "azure",
    parameters: {
      usePodIdentity: "false",
      useVMManagedIdentity: "true",
      userAssignedIdentityID: clusterManagedIdentityClientId,
      keyvaultName: keyVaultName,
      cloudName: "",
      objects: `array:
- |
  objectName: just-some-secret
  objectType: secret`,
      tenantId: environmentTenantId
    }
  }
}, {
  provider: provider,
  dependsOn: [secret],
});

// Nginx测试部署
const deployment = new k8s.apps.v1.Deployment(
  name,
  {
    metadata: {
      labels: appLabels,
    },
    spec: {
      replicas: 1,
      selector: { matchLabels: appLabels },
      template: {
        metadata: {
          labels: appLabels,
        },
        spec: {
          containers: [
            {
              name: name,
              image: "nginx:latest",
              ports: [{ name: "http", containerPort: 80 }],
              volumeMounts: [
                {
                  name: "secrets-store01-inline",
                  mountPath: "/mnt/secrets-store",
                  readOnly: true,
                },
              ],
            },
          ],
          volumes: [
            {
              name: "secrets-store01-inline",
              csi: {
                driver: "secrets-store.csi.k8s.io",
                readOnly: true,
                volumeAttributes: { secretProviderClass: "azure-kvname-system-msi" },
              },
            },
          ],
        },
      },
    },
  },
  {
    provider: provider,
    dependsOn: [secretProviderClass],
  }
);

方案优势 #

• 所有资源均为顶级声明，pulumi preview阶段可以正常识别资源变更，不会出现unknown状态，完全解决嵌套YAML带来的preview问题
• 无需手动拼接YAML字符串，避免格式错误，参数传递更安全
• 资源依赖关系清晰，Pulumi会自动处理Output类型参数的解析，无需手动调用apply处理异步值

补充说明：如果需要更强的类型检查和代码补全，可以提前导入SecretProviderClass的CRD定义到Pulumi项目中，生成对应的TS类型后直接用类型化资源替代CustomResource即可，用法完全一致。

内容的提问来源于stack exchange，提问作者TomHells