Course 7 of 7 · The deployment/infra track — the finale

Infrastructure as Code, from newcomer to interview-ready

The bedrock every other course runs on — the clusters, networks, identities, and keys, all as version-controlled Terraform.

Every course so far ran on top of something. This one is the foundation underneath all of it: the GKE clusters (Course 2), the GCS buckets (the Terraform state, the CI cache, the platform buckets), Cloud SQL, the KMS keys (SOPS + binauthz, Courses 3/5), and the Workload Identity that's been quietly threaded through six courses — almost all provisioned with Terraform (via Terragrunt), across the same env×org matrix. Three parts, built one at a time. Lessons are short — one win each. Read them in order.

How to use this Do one lesson, take its quiz from memory (no peeking), then skim the matching row of the cheat sheet. Come back a day later and re-take it — spacing beats cramming. Your twelfth (and final) course; you know the rhythm. Stuck? Ask me — I'm your teacher, not just the author.
Where IaC sits in the stack If the track were a building: Courses 1–6 were the floors. IaC is the foundation and the blueprints in version control — the code that creates the clusters, buckets, identities and keys everything else assumed already existed.

Part 1 — Terraform fundamentals available now

The declarative model, the language, state, and reusable modules.

1 · What IaC is & the plan/apply cycle

Declarative desired state for infrastructure — vs clicking cloud consoles.

ready

2 · Providers & resources

HCL, the google provider, and the resource building block.

ready

3 · State

The source of truth — remote state in GCS, locking, and drift.

ready

4 · Modules

Reusable, parameterized building blocks — inputs & outputs.

ready

Part 2 — This repo: Terragrunt & the env×org matrix available now

How ~34 modules × ~30 env×org cells stay DRY — and the cluster it all builds.

5 · Terragrunt & DRY

The live/modules split; root.hcl — remote-state + provider, once.

ready

6 · The env×org matrix

The matrix as a directory tree — one cell+component, one isolated state.

ready

7 · The module inventory

The 34 building blocks — "which module made X?"

ready

8 · GKE & the cluster

Spot node pools, Workload Identity, binary authorization — the cluster the track runs on.

ready

Part 3 — Identity, secrets & operations available now

The cross-course payoff — and how a Terraform change actually ships.

9 · IAM & Workload Identity

The GSA + binding behind every iam.gke.io annotation.

ready

10 · KMS & secrets

The keys behind SOPS decryption and binauthz attestation.

ready

11 · Networking, DNS & Cloud SQL

VPC, Cloudflare certs, and the Postgres instances.

ready

12 · Terraform ops & Atlantis

The apply path (PR-driven), drift — and the whole-track recap.

ready

Reference shelf

Cheat sheet

Dense revision sheet + terraform/terragrunt + interview one-liners.

Glossary

The canonical vocabulary, opinionated.

Repo IaC map

Ground truth: modules/live, state, GKE, IAM, KMS, Atlantis.

Resources

Terraform/Terragrunt/GCP docs, Atlantis, the cert.
All 12 lessons are built — the IaC course is complete, and with it the entire 7-course deployment track (Containers · Kubernetes · Helm · Istio · CI/CD · Observability · IaC). You can now trace any piece of this system from the code that defines it to the running production it becomes. The one thing left across all thirteen courses: a retention check. Ask me to run a capstone mock interview across the whole track and I'll finally record where you're solid.