Chapter Eleven

Collaboration and Automation on GCP

Turning one engineer running apply from a laptop into a team where every change flows through a reviewed pipeline — shared GCS state, keyless CI on Cloud Build and GitHub Actions, Google's managed Infrastructure Manager, drift detection, and a price tag on every plan.

6 topics

A solo project survives on one engineer, one state file, and a laptop running apply. A team does not. The moment a second person needs to change the same infrastructure, you need shared state that locks, a pipeline that reviews and applies changes, and an identity model that lets CI talk to GCP without a key file lying around. This chapter is the jump from solo to team.

The running example is Layer B — the Hatch org — whose state lives in the hatch-tfstate bucket and whose CI runs from hatch-io/infrastructure, authenticating through Workload Identity Federation with no keys, both established in Chapter 2. Here we make that bucket safe for many hands, run Terraform in Cloud Build and in GitHub Actions, weigh Google's managed Infrastructure Manager against self-hosting, catch out-of-band drift, and put a cost estimate on every pull request.

Topics in This Chapter

Topic 69
Team Backends on GCS
One hatch-tfstate bucket carved into prefix-separated stacks, native GCS locking, bucket IAM that keeps developers out of state, versioning as the undo button, and bootstrapping the bucket that cannot store its own state.
StateBackend
Topic 70
Terraform in Cloud Build
A cloudbuild.yaml with init/plan/apply steps, a least-privilege terraform-ci service account that defines the blast radius, keyless auth through the attached SA, and triggers that plan on PRs and apply on merges.
CI/CDCloud Build
Topic 71
Keyless CI with WIF
GitHub Actions authenticating to GCP with no JSON key: the OIDC-token-to-GCP-token exchange, id-token: write, separate SAs for plan and apply, and an attribute condition pinned to hatch-io/infrastructure.
WIFCI/CD
Topic 72
Infrastructure Manager
Google's managed Terraform: deployments that run on Cloud Build under the hood with Google-hosted state and IAM-native access. When to choose it over HCP Terraform and over self-hosted CI, and the control you give up.
ManagedComparison
Topic 73
Drift Detection and Reconciliation
Catching out-of-band Console and gcloud changes with a scheduled plan, reading drift with -refresh-only, deciding reconcile versus revert per change, and why auto-applying drift can undo an emergency fix.
OperationsDrift
Topic 74
Cost Estimation
Infracost putting a price tag on a plan as a PR comment: what it can price deterministically, what needs a usage file, why the diff is the trustworthy signal, and why list pricing overstates a discounted bill.
CostFinOps