# Mission — Infrastructure as Code

## Why this course exists

**Course 7 of 7 — the finale** of the deployment/infra track. Every course so far ran *on top
of* something: containers on a host (C1), Pods on a cluster (C2), Helm/Istio into that cluster
(C3–4), CI/CD deploying to it (C5), observability watching it (C6). **This course is the bedrock
underneath all of it** — the GKE clusters, the VPC, the GCS buckets (the Terraform state, the CI
cache, the platform buckets), Cloud SQL, the KMS keys (SOPS + binauthz), and the **Workload
Identity** that has been quietly threaded through six courses. Almost all of it is provisioned
with **Terraform** (via **Terragrunt**), across the same env×org matrix — with a few honest
exceptions (e.g. Thanos's `manabie-thanos` bucket lives outside this tree).

If the whole track were a building: C1–6 were the floors; **IaC is the foundation and the
blueprints in version control**.

## Who the learner is

- Backend engineer on the **conversationmgmt / notification / spike** team — strong Go, gRPC,
  Kafka, Postgres, Airflow; now solid on containers, K8s, Helm, Istio, CI/CD, and observability
  (twelve courses in — this is the last).
- **Newer to IaC / cloud provisioning.** Terraform, state, modules, Terragrunt, GCP resources,
  Workload Identity as *infrastructure* are new. Assume strong backend maturity, NOT ops fluency.
- The payoff: the annotations and buckets and clusters they've seen named in every course finally
  get their "where does this actually come from?" answer.

## What "success" looks like

By the end, the learner can, from memory:

1. Explain IaC and Terraform's model — declarative desired state, providers/resources, the
   plan/apply cycle — vs clicking cloud consoles.
2. Explain Terraform **state** (the source of truth, remote state in GCS, locking, drift) and
   **modules** (reusable, parameterized building blocks).
3. Explain **Terragrunt** and why this repo uses it — DRY remote-state/provider config (the
   `root.hcl` root), the live/modules split, and how the env×org matrix is a directory tree.
4. Read the **module inventory** (GKE, Cloud SQL, VPC, IAM, KMS, GCS, binauthz, Cloudflare) and
   the **GKE** module (spot node pools, Workload Identity, binary authorization).
5. Explain **IAM & Workload Identity** as Terraform code — the GSA + WI binding that backs the
   `iam.gke.io/gcp-service-account` annotation, and the GitHub WIF pool + CI bots.
6. Explain **KMS** (the SOPS + binauthz keys), **networking/DNS** (VPC, Cloudflare), and
   **Cloud SQL**.
7. Explain the **apply path** (Atlantis PR automation) and how it differs from the push-based app
   deploys of Course 5.

## Grounding

Every concept lands on real config under `deployments/terraform/` (modules + live dirs) and the
`platforms/atlantis` setup — mapped in [reference/repo-iac-map.md](./reference/repo-iac-map.md).
External claims cite the official Terraform / Terragrunt / GCP docs
([RESOURCES.md](./RESOURCES.md)) — never my memory.

## The seven-course plan (this track)

1. Containers & Local Dev ✅
2. Kubernetes ✅
3. Helm ✅
4. Istio & Service Mesh ✅
5. CI/CD & Delivery ✅
6. Observability & Monitoring ✅
7. **Infrastructure as Code** ← *you are here — the foundation the whole track runs on*