Chapter Nine

Building Real GCP Infrastructure

The network and compute substrate the Hatch app actually runs on — a global VPC, Shared VPC across projects, tag-targeted firewalls, fully private connectivity, managed instance groups, a managed service wired end-to-end, secrets kept out of state, and why provisioners are the wrong tool.

8 topics

Everything before this chapter was the Terraform language and workflow. This chapter is where you build the substrate a real application runs on, and it is the first place the course is deeply GCP-shaped: a VPC that is global instead of regional, subnets that own secondary ranges, firewalls that target VMs by tag, and connectivity that keeps the whole stack off the public internet.

The running example is Layer B — the Hatch org. The Shared VPC host project hatch-net-host owns the network; the service projects hatch-app-prod and hatch-app-staging run the workloads, all in us-central1. Across these eight topics you wire the network, stamp compute from managed instance groups, deploy a managed service with its full IAM and private-connectivity surround, keep secrets out of state, and learn why provisioners almost never belong in any of it.

Topics in This Chapter

Topic 56
Global VPC and Regional Subnets
Why a GCP VPC is global and its subnets regional — the inverse of AWS. Auto vs custom mode, secondary IP ranges for GKE, and why per-zone subnets are an AWS habit that fragments address space.
NetworkingVPC
Topic 57
Shared VPC
One host project owns the network; many service projects consume its subnets with subnet-level IAM. Host vs service projects, why centralize, and which identities need networkUser.
NetworkingIAM
Topic 58
Firewall Rules and Network Tags
Stateful firewall rules that target VMs by network tag or service account. Implied default-deny ingress, default-allow egress, priority ordering, and hierarchical policies.
NetworkingSecurity
Topic 59
Private Connectivity
Keeping VMs and managed services off the public internet: Private Service Access for Cloud SQL, Private Service Connect for endpoints, and Cloud NAT for external-IP-less egress.
NetworkingSecurity
Topic 60
Compute Engine and Managed Instance Groups
Production VMs as a regional MIG stamping identical instances from an immutable template. Autoscaling, health checks and autohealing, and rolling updates by template change.
ComputeMIG
Topic 61
A Managed Service End-to-End
Cloud Run v2 wired the way it ships: a dedicated runtime SA, private VPC egress, a private Cloud SQL connection, deletion_protection, and the IAM that surrounds the resource.
Cloud RunWiring
Topic 62
Secret Manager and Sensitive Inputs
Keeping passwords and API keys out of HCL and out of state. Secret vs secret version, per-secret accessor grants, why sensitive doesn't protect state, and managing values out of band.
SecretsIAM
Topic 63
Provisioners and When to Avoid Them
Why local-exec and remote-exec are almost always wrong on GCP. Run-once and not-reconciled semantics, and why startup scripts and cloud-init are the declarative path.
Escape HatchBootstrap