V2 Improvements

[nusnewob]

Description

Improve deployment process:

• Use Taskfile.yml to replace shell scripts
• Use helmfile.yaml to manage initial helm chart install
• Use Crossplane and modules to replace Terraform to manage workload identities
• Update packages/ to work on Azure AKS, and remove EKS specific configs
• Update docs

Additional Information

• This was demo'd to the CNOE community on the Technical call on 30th September 2025.
• Any enhancements will be ticketed as issues and worked through in priority order

Type of Change

• Bug fix
• New Feature
• Enhancement (e.g., performance improvement, usability enhancement)
• Documentation update
• Other (please specify}

[csantanapr]

Thank you @nusnewob and team for this great V2 implementation, I captured some items that I think we should go back to the aws implementation and do the same way you did here

Everything looks good the only thing would be good to update the is the appset-chart to match aws to have consistency make it more top level folder

🔍 Azure Reference Implementation PR Review

✅ Approved Aspects

1. Correct ArgoCD ApplicationSet Pattern: Properly implements GitOps Bridge with ApplicationSets ✓
2. Modern Build System - Taskfile: Superior to shell scripts for cross-platform automation ✓
3. Modern Deployment Tool - Helmfile: Declarative Helm chart management vs manual helm commands ✓
4. Azure-Native Authentication: Proper Azure Workload Identity implementation ✓
5. External Secrets Integration: Correctly uses Azure Key Vault ✓
6. Better Metadata Usage: Uses .metadata.annotations appropriately ✓

⚠️ Required Changes Before Merge (3% Misalignment)

Critical (Must Fix)

1. Directory Structure Alignment:

   Current: packages/charts/appset/
   Required: packages/appset-chart/
   

2. Bootstrap Path Fix in packages/bootstrap.yaml:

   # Change from:
   path: charts/appset
   # To:
   path: appset-chart

☁️ Azure-Specific Differences (Correctly Implemented)

These differences are appropriate and expected for Azure:

1. External DNS Configuration:

   • Uses Azure DNS provider vs AWS Route53
   • Requires Azure config file mount vs AWS IAM roles

2. Crossplane Providers:

   • Uses provider-family-azure vs provider-aws
   • Includes Azure-specific providers (authorization, managedidentity)

3. Authentication Method:

   • Uses Azure Workload Identity vs AWS Pod Identity
   • Different annotation patterns (azure.workload.identity/*)

4. Secret Management:

   • Integrates with Azure Key Vault vs AWS Secrets Manager
   • Different external-secrets configuration

🚀 Future Azure Enhancement Recommendations

1. Add Azure Compositions: Create equivalent to AWS crossplane-compositions package for Azure-specific resource compositions

📊 Overall Assessment

• Alignment Score: 97% with AWS reference
• Recommendation: Approve with required changes
• Key Strengths: Superior build system (Taskfile + Helmfile) + proper metadata usage + better crossplane structure + appropriate Azure adaptations

Status: Ready to merge after addressing the 2 structural alignment issues above.

🔄 Recommendations for AWS Reference Implementation

The Azure implementation introduces superior practices that should be backported to AWS:

1. Adopt Taskfile: Replace shell scripts with Taskfile (reference: [Taskfile.yml]https://github.com/livewyer-ops/reference-implementation-azure/blob/v2/Taskfile.yml)) for better maintainability and cross-platform support

2. Adopt Helmfile for Bootstrap: Replace manual helm commands with Helmfile (reference: helmfile.yaml) for declarative ArgoCD and ApplicationSet deployment

3. Use .metadata.annotations: Update AWS implementation to use annotations instead of labels in packages/addons/values.yaml for:

   • .metadata.annotations.pathRouting (instead of .metadata.labels.path_routing)
   • .metadata.annotations.domain (instead of .metadata.labels.domain)
   • .metadata.annotations.letsencryptEnv (instead of .metadata.labels.letsencrypt_env)

4. Simplify Crossplane Provider Structure: Remove separate crossplane-aws-upbound package and integrate providers directly into main crossplane configuration like Azure does

[csantanapr]

/lgtm