To operate as a GKE attached cluster, your cluster needs to have
the following characteristics.

### EKS (AWS) cluster requirements

- Ensure that you use a [supported platform version](https://docs.cloud.google.com/kubernetes-engine/multi-cloud/docs/attached/eks/reference/supported-versions). The
  cluster Kubernetes major.minor version should match the selected platform
  version. You can also list all supported versions using the following command:

      gcloud container attached get-server-config  \
          --location=GOOGLE_CLOUD_REGION

  Replace `GOOGLE_CLOUD_REGION` with the name of the
  Google Cloud location to administer your cluster from.
- Ensure that the `kubectl` command-line tool is installed on your local machine
  and configured to access your cluster. This includes setting up the correct
  user credentials in the `kubeconfig` file.

- Ensure that there is network connectivity to your cluster.

- The cluster must have a public IAM OIDC Identity Provider.
  To check if a provider exists, and to create a provider if necessary, follow the
  instructions in
  [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html).

- When you attach a cluster, Google Cloud installs several Pods that are
  managed by Google Cloud. These Pods must be scheduled on your nodes. Make
  sure that any taints on your cluster don't prevent scheduling. If you have
  such taints, your cluster registration fails and you might see an error
  similar to the following:

      1 node(s) had untolerated taint {CriticalAddOnsOnly: true}

## Networking requirements

Because attached clusters rely on supporting Google Cloud services, you need to
modify your cluster's outbound firewall rules to allow it
access to the following domains. This is the only change you need to make to
your cluster to install and run GKE attached clusters.

| Address | Purpose |
|---|---|
| `.gcr.io` | Pull images from the Artifact Registry. |
| `gkeconnect.googleapis.com` | Establish the channel used to receive requests from Google Cloud and issue responses. |
| `gkemulticloud.googleapis.com` | Exchange Google or third-party credentials for a short-lived access token to Google Cloud resources. If your cluster was registered to the fleet using a Google Cloud region, you need to allowlist `REGION-gkemulticloud.googleapis.com` (for example, `us-central1-gkemulticloud.googleapis.com`). |
| `oauth2.googleapis.com` | Authenticate through OAuth token exchange for account access. |
| `securetoken.googleapis.com` | Retrieve refresh tokens for workload identity authorization. |
| `storage.googleapis.com` | Manage object storage and buckets, such as Artifact Registry objects. |
| `sts.googleapis.com` | Exchange Google or third-party credentials for a short-lived access token to Google Cloud resources. |
| `www.googleapis.com` | Authenticate service tokens from incoming Google Cloud service requests. |

### Logging and monitoring

To use logging and monitoring features, your cluster also needs to
be able to access the following URLs:

    logging.googleapis.com
    monitoring.googleapis.com
    opsconfigmonitoring.googleapis.com
    kubernetesmetadata.googleapis.com

## Google Cloud requirements

Before attaching your cluster to the Google Cloud management service, you must
install the gcloud CLI, including the Google Cloud CLI command, and
grant access to your Google Cloud account to the Google Cloud management
service so it can manage your attached cluster resources.

1. Check your gcloud CLI installation with the following command:

       gcloud version

2. If the gcloud CLI isn't installed, or if its version is earlier than
   version 412.0.0, install version 412.0.0 or higher by following the
   [gcloud CLI installation instructions](https://docs.cloud.google.com/sdk/docs/install).

3. Install the `kubectl`
   [additional component](https://docs.cloud.google.com/sdk/docs/components#additional_components).

4. If you haven't already done so,
   [create your Google Cloud project](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project).
   This will generate a Google Cloud project ID and a project number.

5. Set your active Google Cloud project and authenticate your account with
   the following commands.

       export PROJECT_ID=<your project id>
       gcloud auth login
       gcloud config set project $PROJECT_ID
       gcloud auth application-default login

6. Enable the GKE attached clusters API and its required services with
   the following commands:

       gcloud services enable gkemulticloud.googleapis.com
       gcloud services enable gkeconnect.googleapis.com
       gcloud services enable connectgateway.googleapis.com
       gcloud services enable cloudresourcemanager.googleapis.com
       gcloud services enable anthos.googleapis.com
       gcloud services enable logging.googleapis.com
       gcloud services enable monitoring.googleapis.com
       gcloud services enable opsconfigmonitoring.googleapis.com
       gcloud services enable kubernetesmetadata.googleapis.com