I didn't see it in examples anywhere, but there is a preferred way of creating an EKS cluster with a managed nodegroup and then associating the autoscaling group that creates with an autoscaling.Attachment for a targetgroup?

I guess you're trying to expose services running on your cluster via a Load Balancer? In that case I'd recommend using the AWS Load Balancer Controller. The benefit here is that you do not need to add your nodes into the target group, instead the controller will add the pods directly. Additionally it will insert pod readiness gates to ensure downtimeless deployments

I am unable to use ALB load balancer controller in our environment. The ALB has to be created outside and attached to the cluster ASG.

You can do that with the load balancer controller. You can create the ALB in pulumi for example and instruct the load balancer controller to use it

Is there a way to reference the Name of the cluster and Nodegroup as strings without having to wrap the lookup and attachment inside an ApplyT?

You're using Go I guess? The output form accepts Input-wrapped arguments. I.e.

LookupNodeGroupOutput

Thanks for the help.

Could it be an eventual consistency issue? IIRC, the AWS EKS service creates the ASG asynchronously. Are the other properties in the

LookupNodeGroupOutput

response populated?

The managed node group NodeGroup.Resources().Index(pulumi.Int(0)).AutoscalingGroups().Index(pulumi.Int(0)).Name().Elem() was empty, but it actually started working correctly for no reason I could tell. Using this I was able to do an attachment. I had another issue that I didn't find a "good" solution for - the autoscaling group is directly targeted on node port by a loadbalancer so I had to join them both to a security group but the EKS created security group for the managed node group was not retrievable with pulumi and I instead had to resort to lookup by tags.

The security group you're referring to is the Cluster Security Group the EKS service creates themselves. This is included in the cluster's output:

cluster.eksCluster.vpcConfig.clusterSecurityGroupId

Didn't catch that cluster.clusterSecurityGroupId was different from that, it was the wrong group which threw me off.