Skip to content

Helm with a public API or jump VM

Public AKS API

When the API server is public (ideally locked down with authorized IP ranges):

az login
az aks get-credentials --resource-group <rg> --name <aks-name>
kubectl get nodes

helm upgrade --install ams-keycloak ./ams-helm-keycloak-application \
  --namespace keycloak \
  --create-namespace \
  -f providers/azure/release/values.yaml

You can run these commands from a secured operator laptop or from CI.

Harden the API

Prefer authorized IP ranges, Azure AD RBAC, and disable local accounts when policy allows. Public API does not mean open to the world.

Even with a public API — and especially with a private API — a VM inside the VNet is a stable place to:

  • Store kubeconfig
  • Reach private DNS for ACR, Key Vault, and SQL
  • Run Helm with consistent tooling versions

Suggested flow

  1. SSH or RDP to the jump VM (Azure Bastion, IAP-style access, or corporate VPN).
  2. Install Azure CLI, kubectl, and Helm if not pre-baked in the image.
  3. az login (or use the VM’s managed identity).
  4. az aks get-credentials …
  5. Clone or sync chart packages onto the VM.
  6. Run helm upgrade --install for each dependency and module in order.

Syncing charts to the VM

Pick one approach your security team accepts:

  • git clone over HTTPS with a deploy token
  • Copy a release bundle (tar of charts + values) via approved file transfer
  • Pull from an internal Helm registry

Never embed production secrets in the bundle; reference Key Vault or create Secrets on the cluster.

Example sequence (public or jump)

helm upgrade --install ams-observability ./ams-helm-observability-stack -n observability --create-namespace -f providers/azure/release/values.yaml
helm upgrade --install ams-keycloak ./ams-helm-keycloak-application -n keycloak --create-namespace -f providers/azure/release/values.yaml
helm upgrade --install ams-command-center ./ams-helm-command-center-application -n ams --create-namespace -f providers/azure/release/values.yaml
# optional: are, eobs, fortifyops
helm upgrade --install ams-ingress ./ams-helm-infrastructure-ingress -n ams -f providers/azure/release/values.yaml
# optional adapters / platforms

Adjust namespaces and value files to match the package you received.

Troubleshooting reachability

Symptom Likely cause
kubectl timeouts Wrong network path; API private without VPN/jump
ImagePullBackOff ACR auth / private DNS
Helm pending-install Webhooks or CNI issues; check kubectl get pods -A
502 at Application Gateway Ingress backend Service missing or probes failing