Course 7 of 7 · The deployment/infra track — the finale
Infrastructure as Code, from newcomer to interview-ready
The bedrock every other course runs on — the clusters, networks, identities, and keys, all as version-controlled Terraform.
Every course so far ran on top of something. This one is the foundation underneath all of it: the GKE clusters (Course 2), the GCS buckets (the Terraform state, the CI cache, the platform buckets), Cloud SQL, the KMS keys (SOPS + binauthz, Courses 3/5), and the Workload Identity that's been quietly threaded through six courses — almost all provisioned with Terraform (via Terragrunt), across the same env×org matrix. Three parts, built one at a time. Lessons are short — one win each. Read them in order.
Part 1 — Terraform fundamentals available now
The declarative model, the language, state, and reusable modules.
1 · What IaC is & the plan/apply cycle
Declarative desired state for infrastructure — vs clicking cloud consoles.
ready2 · Providers & resources
HCL, the google provider, and the resource building block.
3 · State
The source of truth — remote state in GCS, locking, and drift.
ready4 · Modules
Reusable, parameterized building blocks — inputs & outputs.
readyPart 2 — This repo: Terragrunt & the env×org matrix available now
How ~34 modules × ~30 env×org cells stay DRY — and the cluster it all builds.
5 · Terragrunt & DRY
The live/modules split; root.hcl — remote-state + provider, once.
6 · The env×org matrix
The matrix as a directory tree — one cell+component, one isolated state.
ready7 · The module inventory
The 34 building blocks — "which module made X?"
ready8 · GKE & the cluster
Spot node pools, Workload Identity, binary authorization — the cluster the track runs on.
readyPart 3 — Identity, secrets & operations available now
The cross-course payoff — and how a Terraform change actually ships.
9 · IAM & Workload Identity
The GSA + binding behind every iam.gke.io annotation.
10 · KMS & secrets
The keys behind SOPS decryption and binauthz attestation.
ready11 · Networking, DNS & Cloud SQL
VPC, Cloudflare certs, and the Postgres instances.
ready12 · Terraform ops & Atlantis
The apply path (PR-driven), drift — and the whole-track recap.
readyPart 4 — Senior IaC judgment new
The senior stretch — Terraform truthfulness, state realism, trust-chain design, change safety, and interview-grade answers.
13 · IaC truthfulness
Tell the real Terraform story accurately: what this tree truly provisions, what it does not, and why that boundary matters.
new14 · State realism
Reason clearly about drift, locking, imports, partial failure, and why state quality changes plan trust.
new15 · Module/API design
Review modules and Terragrunt structure like APIs: inputs, outputs, hidden coupling, and scaling trade-offs.
new16 · Identity & secrets judgment
Connect Workload Identity, GitHub WIF, and KMS into one keyless trust-chain story.
new17 · Change safety & Atlantis
Explain why infra changes are governed differently and why rollback needs more honesty than “just redeploy.”
new18 · Senior interview questions
High-signal IaC questions with answer shapes that sound like real operational experience.
new19 · Mock senior interview pack
A retrieval-first mock round with scoring and strong answer points.
newReference shelf
Cheat sheet
Dense revision sheet + terraform/terragrunt + interview one-liners.
Glossary
The canonical vocabulary, opinionated.
Repo IaC map
Ground truth: modules/live, state, GKE, IAM, KMS, Atlantis.
Resources
Terraform/Terragrunt/GCP docs, Atlantis, the cert, plus senior-IaC judgment topics.
Senior backend playbook
The compressed version of the new senior part: truthfulness, state realism, trust chains, and infra-change judgment.