Lesson 8 · This repo's IaC: Terragrunt & the env×org matrix

GKE & the cluster

The Terraform that builds the Kubernetes cluster the entire track has been running on.

Your win: read the GKE module and connect its config to things you learned courses ago — the spot node pools (C2), Workload Identity (C3–6), and binary authorization (C5) all originate here.

The cluster is a module, wrapping a community module

The Kubernetes cluster from Course 2 — where every Pod, Service, and Istio sidecar runs — is provisioned by modules/platforms/gke.tf, which wraps the well-tested community module terraform-google-modules/kubernetes-engine//modules/beta-public-cluster (:4-5). You configure it; the upstream module handles the hundreds of API calls to build a production GKE cluster.

Three settings you'll recognize from earlier courses

Anchor — spot node pools (Course 2 L10) Remember "backend runs on GKE spot nodes by default"? Here's where the pools are declared. node_pools is generated from var.gke.node_pools (gke.tf:50-59), with spot = np.spot — a boolean per pool. The actual pool list lives in the cell's locals (live/stag-manabie/env.hcl:694-1109): on-demand n2d-highmem-4 (spot = false), spot n2d-highmem-4-spot, *-runners-spot, GPU *-gpu-spot. So the cost/reliability trade-off you saw scheduling Pods onto is set in Terraform.

Anchor — Workload Identity & binary authorization Two more cross-course payoffs, both cluster-level flags here:

Workload Identity — enabled by the upstream module; the module outputs gke_identity_namespace = PROJECT.svc.id.goog, which the apps module uses to build the SA bindings (Lesson 9). Without it enabled on the cluster, the iam.gke.io annotations (C3) would do nothing.
Binary Authorization — enable_binary_authorization = var.gke.enable_binary_authorization at gke.tf:111 (Course 5). This is the cluster-side switch that would enforce the attestation policy — the policy the binauthz module defines (currently DRYRUN, C5).

The rest of a production cluster The module also sets the release channel (gke.tf:14, REGULAR), per-pool autoscaling, VPA, network_policy, database_encryption via KMS, and remove_default_node_pool. It takes its network from the VPC module via a Terragrunt dependency (Lesson 5) —

private_network =
    dependency.vpc.outputs.network_self_link

. So "the cluster" is really: this module + the VPC it depends on + the node pools from env.hcl + WI/binauthz flags.

The loop this closes Courses 2–6 used the cluster; they never showed you where it came from. It came from ~40 lines of module config + a node-pool list in env.hcl, applied once via Atlantis (Lesson 12). Every spot node your service landed on, every Workload Identity token it used, was set up by this file. That's the whole point of the finale — the "magic infrastructure" was Terraform all along.

GKE + the terraform-google-modules kubernetes-engine module

GKE concepts, and the community module this repo wraps (node pools, Workload Identity).

→ cloud.google.com — GKE overview
→ registry — kubernetes-engine module

Check yourself (from memory)

Q1. The GKE module (platforms/gke.tf)…

It wraps terraform-google-modules/kubernetes-engine//…/beta-public-cluster — you configure, upstream builds.

Q2. Whether a node pool is pre-emptible is set by…

spot = np.spot per pool (env.hcl) — the Course-2 spot-node cost trade-off, set in Terraform.

Q3. enable_binary_authorization at gke.tf:111 is…

It turns on admission control on the cluster; the policy (currently DRYRUN) is defined by the binauthz module.

The GKE module — and the three cross-course settings it holds.

recall, then click to reveal

The Course-2 cluster is built by modules/platforms/gke.tf, WRAPPING the community terraform-google-modules/kubernetes-engine//…/beta-public-cluster (:4-5). THREE recognizable settings: (1) SPOT node pools — node_pools from var.gke.node_pools (:50-59), spot = np.spot; pool list in env.hcl:694-1109 (on-demand n2d-highmem-4 spot=false, spot pools, GPU spot) = the C2 L10 cost trade-off, in Terraform. (2) WORKLOAD IDENTITY — enabled by the module; output gke_identity_namespace = PROJECT.svc.id.goog feeds the apps SA bindings (L9); without it the C3 annotations do nothing. (3) BINARY AUTHORIZATION — enable_binary_authorization (:111), the cluster switch for the C5 policy (DRYRUN). Plus release channel, autoscaling, VPA, network_policy, KMS db encryption; network via the VPC dependency.

✅ Part 2 complete You've read this repo's IaC architecture: Terragrunt & DRY (L5), the env×org matrix as a directory tree (L6), the 34-module inventory (L7), and the GKE cluster the whole track runs on (L8). Part 3 is the cross-course payoff — IAM & Workload Identity, KMS & secrets, networking/Cloud SQL, and the Atlantis apply path — closing all seven courses.

Ready for Part 3 (IAM/Workload Identity, KMS, networking, Atlantis)? Or a mock interview on Parts 1–2 — state, modules, and Terragrunt are all Terraform-Associate staples. Ask me.

1. In-repo: deployments/terraform/modules/platforms/gke.tf:4,50,111; registry — kubernetes-engine.