more automated & refined

Author: ChandanGhosh

README.md

@@ -3,13 +3,14 @@
 # Global variables
 
 ```
-export suffix=$(echo $RANDOM)
-export AKS_GRP=aks-grp-$suffix
-export AZ_KV_GRP=kv-grp-$suffix
+export SUFFIX=$(echo $RANDOM)
+export AKS_GRP=aks-grp-$SUFFIX
+export AZ_KV_GRP=kv-grp-$SUFFIX
 export LOC=westeurope
-export AKS_NAME=aks-$suffix
-export AZ_KV_NAME=kv-$suffix
-export SP_NAME=az-aks-kv-sp-$suffix
+export AKS_NAME=aks-$SUFFIX
+export AZ_KV_NAME=kv-$SUFFIX
+export SP_NAME=az-aks-kv-sp-$SUFFIX
+export CSI_STORAGE_CLASS_NAME=nginx-csi-storage-class
 export SP_AKS_SECRET=secrets-store-creds
 export CSI_NAMESPACE=azure-cs-driver
 export TENANTID=$(echo $(az account show) | jq -r '.tenantId')
@@ -30,13 +31,13 @@ export SP_CLIENT_SECRET=$(echo $SPObj | jq -r '.password')
 
 # Aks Group create 
 ``` 
-$ az group create -n $AKS_GRP -l $LOC
+az group create -n $AKS_GRP -l $LOC --tags label=$SUFFIX
 ``` 
 
 # Aks Cluster create 
 
 ``` 
-$ az aks create -n $AKS_NAME -g $AKS_GRP --node-count 2 --network-plugin azure --generate-ssh-keys 
+az aks create -n $AKS_NAME -g $AKS_GRP --node-count 2 --network-plugin azure --generate-ssh-keys 
 ``` 
 
 # Get AKS credentials to work with kubectl 
@@ -55,17 +56,11 @@ kubectl get nodes -o wide
 kubectl create ns $CSI_NAMESPACE
 ```
 
-# Helm repo add for csi-secrets-store-driver (optional)
-``` 
-$ helm repo add secrets-store-csi-driver https://raw.githubusercontent.com/kubernetes-sigs/secrets-store-csi-driver/master/charts 
-$ helm install -n $CSI_NAMESPACE csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver 
-``` 
-
 # Helm repo for cs-secret-store-driver-azure-provider. 
 ***This helm repo provide both the csi-secrets-store-driver as well as csi-secrets-store-driver-azure-provider as well***
 ``` 
-$ helm repo add csi-secrets-store-provider-azure https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/charts 
-$ helm install -n $CSI_NAMESPACE csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --generate-name 
+helm repo add csi-secrets-store-provider-azure https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/charts 
+helm install -n $CSI_NAMESPACE csi-secrets-store-provider-azure/csi-secrets-store-provider-azure --generate-name 
 ``` 
 
 # Make sure azure CSI driver pods are running. 
@@ -75,7 +70,7 @@ kubectl get all -n $CSI_NAMESPACE
 
 # Create keyvault group
 ```
-az group create -n $AZ_KV_GRP -l $LOC
+az group create -n $AZ_KV_GRP -l $LOC --tags label=$SUFFIX
 ```
 
 # Create azure key vault 
@@ -101,17 +96,23 @@ kubectl create secret generic $SP_AKS_SECRET --from-literal clientid=$SP_CLIENT_
 
 # Populate all the respective details in storageproviderclass yaml file && run 
 ```
-kubectl apply -f azure-kv-provider.yaml
+envsubst < azure-kv-provider.yaml | kubectl apply -f -
 ```
 
 # Lastly deploy a sample test nginx deployment to test
 ```
-kubectl apply -f nginx-deployment.yaml 
+envsubst < nginx-deployment.yaml | kubectl apply -f - 
 ```
 
 # wait for nginx pod to be up and running and then test the secrets are mounted or not
 ```
-kubectl exec nginx-app -- ls /mnt/secrets/DB_PASSWORD
+kubectl exec nginx-app -- ls /mnt/secrets/
 kubectl exec nginx-app -- cat /mnt/secrets/DB_PASSWORD
 ```
 
+# Clean up resources
+
+```
+az ad sp delete --id $SP_CLIENT_ID
+for rg in $(az group list --tag label=$SUFFIX --query '[].name' | jq -r '.[]'); do echo "Delete Resource Group: ${rg}"; az group delete -n ${rg}; done
+```

azure-kv-provider.yaml

@@ -1,7 +1,7 @@
 apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
 kind: SecretProviderClass
 metadata:
-  name: azurekv
+  name: $CSI_STORAGE_CLASS_NAME
 spec:
   provider: azure
   parameters:

nginx-deployment.yaml

@@ -31,6 +31,6 @@ spec:
             driver: secrets-store.csi.k8s.io
             readOnly: true
             volumeAttributes:
-              secretProviderClass: "azurekv"
+              secretProviderClass: $CSI_STORAGE_CLASS_NAME
             nodePublishSecretRef:
-              name: secrets-store-creds
+              name: $SP_AKS_SECRET