Implementation Studio Modules

This directory contains reusable infrastructure and Kubernetes building blocks used by the labs and intended to be adaptable for real implementation work.

Catalog

GCP Terraform Modules

Module	Purpose
artifact-registry	Google Artifact Registry repository for container images
firewall-rules	Common GCP firewall patterns for restricted environments
gke-cluster	GKE cluster module for standard and private deployments
vpc-private	Private GCP network baseline
vpc-standard	Standard GCP VPC with public/private subnet patterns

AWS Terraform Modules

Module	Purpose
ecr	Elastic Container Registry repository
eks-cluster	EKS cluster module for standard and private deployments
rds	Relational database module with production-oriented options
security-groups	Security group patterns for EKS and restricted egress
vpc	Standard AWS VPC with public/private subnet patterns
vpc-private	Private AWS network baseline with endpoint-oriented design

Kubernetes Pattern Bundles

Bundle	Purpose
argo-workflows	Standard Argo Workflows Helm values
argo-workflows-airgap	Offline-friendly Argo Workflows values, images list, and chart packaging
ingress-nginx	Public ingress-nginx values
network-policies	Deny-all, ingress, DNS egress, and namespace isolation policies
rbac-patterns	Namespace admin, read-only, and deployment-only RBAC templates
resource-quotas	Standard and limited quota profiles for tenant isolation

Provider Equivalents

Capability	GCP	AWS	Kubernetes
Kubernetes cluster	gke-cluster	eks-cluster	argo-workflows deploys onto either
Standard network	vpc-standard	vpc	Network policies refine in-cluster behavior
Private network	vpc-private	vpc-private	Internal access patterns live in labs
Container registry	artifact-registry	ecr	Air-gap packaging supports offline registry use
Egress/security controls	firewall-rules	security-groups	network-policies
Tenant controls	Provider IAM plus cluster config	Provider IAM plus cluster config	rbac-patterns, resource-quotas, network-policies

Usage

Use modules from a lab or copy them into your own Terraform project.

module "vpc" {
  source = "../../modules/gcp/vpc-standard"

  project_id = var.project_id
  region     = var.region
  name       = var.network_name
}

module "cluster" {
  source = "../../modules/gcp/gke-cluster"

  project_id  = var.project_id
  region      = var.region
  network     = module.vpc.network_name
  subnetwork  = module.vpc.private_subnet_name
  cluster_name = var.cluster_name
}

For AWS, use the matching AWS module family:

module "vpc" {
  source = "../../modules/aws/vpc"

  region = var.region
  name   = var.network_name
}

module "cluster" {
  source = "../../modules/aws/eks-cluster"

  cluster_name = var.cluster_name
  subnet_ids   = module.vpc.private_subnet_ids
}

Validation

Run these checks before changing modules:

terraform fmt -check -recursive
tools/validate-terraform.sh
tools/validate-modules.sh

The GitHub Actions workflow also runs Terraform format, init, validate, and tflint checks on Terraform changes.

Module Standards

Every Terraform module should include:

• main.tf, variables.tf, outputs.tf, and versions.tf.
• A README with purpose, usage, inputs, outputs, and provider notes.
• Typed variables with descriptions and sensible defaults when safe.
• Outputs that support composition by labs and downstream projects.
• No environment-specific hardcoding unless the README explains why.

Every Kubernetes pattern bundle should include:

• A README that explains when to use the pattern.
• Manifests or Helm values that can be copied into labs.
• Security and production notes where the pattern changes risk posture.

Related Documentation

• Provider Comparison
• Feature Parity Matrix
• Migration Guide
• Module Maintenance