attached-cluster-modules

Attached Cluster Modules

modules/AKS_GKE and modules/EKS_GKE share a nearly identical three-phase pattern: provision a Kubernetes cluster in another cloud, bootstrap the GKE Connect agent onto it, then register it as a GKE Attached Cluster so it shows up in the GKE Fleet and the Google Cloud Console.

Shared Shape

Both modules consist of:

modules/AKS_GKE/ (or EKS_GKE/)
├── main.tf               # Foreign-cloud cluster + helm bootstrap + google_container_attached_cluster
├── variables.tf          # Standard vars + foreign-cloud creds + k8s_version/platform_version
├── provider.tf           # Pattern A (direct providers, no impersonation)
├── vpc.tf / iam.tf       # (EKS_GKE only — AWS needs an explicit VPC + IAM roles; AKS bundles these)
├── modules/
│   ├── attached-install-manifest/   # Helm install of the GKE Connect bootstrap
│   └── attached-install-mesh/       # Optional: runs asmcli to install ASM (NOT invoked by main.tf)
├── outputs.tf            # deployment_id (local.random_id) + project_id (local.project_id)
├── tests/                # module test fixtures
└── README.md             # deep dive lives at docs/modules/<Module>.md, not in the module directory

The Three Phases

Phase 1 — Foreign-Cloud Cluster

AKS_GKE (azurerm):

resource "azurerm_resource_group" "aks"            { ... }
resource "azurerm_kubernetes_cluster" "aks" {
  oidc_issuer_enabled = true            # required for OIDC federation
  identity { type = "SystemAssigned" }  # managed identity
  default_node_pool { node_count, vm_size, ... }
}
resource "azurerm_role_assignment" "aks_network_contributor" { ... }

EKS_GKE (aws):

resource "aws_vpc"                   "eks" { ... }   # in vpc.tf
resource "aws_subnet"                "public" / "private" { ... }
resource "aws_iam_role"              "eks" / "node" { ... }  # in iam.tf
resource "aws_eks_cluster"           "eks" { version = var.k8s_version ... }
resource "aws_eks_node_group"        "node" { scaling_config { ... } }