The network and compute substrate the Hatch app actually runs on — a global VPC, Shared VPC across projects, tag-targeted firewalls, fully private connectivity, managed instance groups, a managed service wired end-to-end, secrets kept out of state, and why provisioners are the wrong tool.
8 topics
Everything before this chapter was the Terraform language and workflow. This chapter is where you build the substrate a real application runs on, and it is the first place the course is deeply GCP-shaped: a VPC that is global instead of regional, subnets that own secondary ranges, firewalls that target VMs by tag, and connectivity that keeps the whole stack off the public internet.
The running example is Layer B — the Hatch org. The Shared VPC host project hatch-net-host owns the network; the service projects hatch-app-prod and hatch-app-staging run the workloads, all in us-central1. Across these eight topics you wire the network, stamp compute from managed instance groups, deploy a managed service with its full IAM and private-connectivity surround, keep secrets out of state, and learn why provisioners almost never belong in any of it.