feature(aks): Harden and extend AKS for production readiness

aqua.yaml

@@ -32,3 +32,4 @@ packages:
   - name: evilmartians/lefthook@v2.0.8
   - name: bridgecrewio/checkov@3.2.495
   - name: kubernetes-sigs/krew@v0.4.5
+  - name: Azure/kubelogin@v0.2.13

contexts/_template/blueprint.yaml

@@ -3,11 +3,6 @@ apiVersion: blueprints.windsorcli.dev/v1alpha1
 metadata:
   name: template
   description: Base blueprint template for core services
-repository:
-  url: ""
-  ref:
-    branch: main
-  secretName: flux-system
 sources: []
 terraform: []
 kustomize: []

contexts/_template/features/provider-azure.yaml

@@ -35,5 +35,23 @@ kustomize:
   path: csi
   dependsOn:
   - policy-resources
+  components:
+  - azure-disk
   cleanup:
   - pvcs
+
+# Telemetry - exclude metrics-server as AKS provides it natively
+- name: telemetry-resources
+  path: telemetry/resources
+  strategy: replace
+  dependsOn:
+  - telemetry-base
+  - csi
+  components:
+  - prometheus
+  - prometheus/flux
+  - fluentbit
+  - fluentbit/containerd
+  - fluentbit/fluentd
+  - fluentbit/kubernetes
+  - fluentbit/systemd

kustomize/csi/azure-disk/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - storageclass.yaml

kustomize/csi/azure-disk/storageclass.yaml

@@ -0,0 +1,14 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: single
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: disk.csi.azure.com
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: true
+parameters:
+  skuName: Premium_LRS
+  cachingMode: ReadWrite
+  fsType: ext4
+reclaimPolicy: Delete