Kubernetes Cloud Platform

A production-inspired cloud infrastructure project demonstrating the deployment, automation, scaling, security, monitoring, and lifecycle management of a containerized application on Google Kubernetes Engine (GKE).

The project uses Infrastructure as Code and CI/CD to provision Google Cloud infrastructure, build container images, deploy workloads to Kubernetes, and manage the environment through a reproducible workflow.

Architecture

For a detailed architecture diagram, see GKE Platform Architecture.

The platform follows this deployment workflow:

Developer
    |
    v
GitHub Repository
    |
    v
GitHub Actions CI/CD
    |
    +---- Workload Identity Federation ----> Google Cloud IAM
    |
    v
Google Artifact Registry
    |
    v
Google Kubernetes Engine (GKE)
    |
    v
Kubernetes Deployment
    |
    +---- Horizontal Pod Autoscaler
    +---- PodDisruptionBudget
    +---- NetworkPolicy
    +---- Health / Readiness Probes
    |
    v
Google Cloud Load Balancer
    |
    v
Application

Terraform manages the underlying Google Cloud infrastructure, including the VPC, subnet, GKE cluster, and node pool.

Technologies

• Google Cloud Platform (GCP)
• Google Kubernetes Engine (GKE)
• Kubernetes
• Terraform
• Docker
• Google Artifact Registry
• GitHub Actions
• Workload Identity Federation
• Google Cloud IAM
• Horizontal Pod Autoscaler (HPA)
• Kubernetes NetworkPolicy
• PodDisruptionBudget (PDB)
• Google Cloud Monitoring

Infrastructure as Code

Terraform is used to provision and manage the cloud infrastructure.

The Terraform configuration includes:

• Custom VPC network
• Dedicated subnet
• GKE cluster
• Managed GKE node pool
• Configurable project and region variables
• Terraform outputs for infrastructure information
• Reproducible infrastructure creation and destruction

Infrastructure can be reviewed before deployment with:

terraform plan

and provisioned with:

terraform apply

Containerization

The application is packaged as a Docker container using a lightweight Node.js base image.

Container images are stored in Google Artifact Registry and deployed to GKE.

The application exposes:

/health
/ready

These endpoints are used to verify application health and readiness.

Kubernetes

The Kubernetes configuration includes:

• Deployment with multiple replicas
• ClusterIP and LoadBalancer service configuration
• CPU and memory requests
• CPU and memory limits
• Liveness and readiness checks
• Horizontal Pod Autoscaling
• ConfigMap configuration
• Secret injection
• NetworkPolicy
• PodDisruptionBudget
• Ingress configuration

The application was validated through a public Google Cloud Load Balancer and successfully responded to both /health and /ready.

Autoscaling

A Horizontal Pod Autoscaler manages application replicas based on CPU utilization.

Configured scaling range:

Minimum replicas: 2
Maximum replicas: 5
CPU target:       50%

Live resource metrics were verified through Kubernetes Metrics Server.

Reliability and Self-Healing

Kubernetes self-healing was tested by manually deleting a running application pod.

The Deployment controller automatically created a replacement pod and restored the desired replica count without manual intervention.

A PodDisruptionBudget further protects application availability during voluntary disruptions.

Security

The platform implements several cloud-native security controls:

• Google Cloud IAM
• Workload Identity Federation
• Keyless GitHub Actions authentication
• Kubernetes NetworkPolicy
• Kubernetes Secrets
• Resource isolation through namespaces and selectors
• Container resource limits

GitHub Actions authenticates to Google Cloud using Workload Identity Federation rather than storing long-lived Google Cloud service account keys in the repository.

CI/CD

GitHub Actions provides automated deployment to GKE.

A push to the main branch triggers the pipeline to:

1. Check out the repository
2. Authenticate to Google Cloud using Workload Identity Federation
3. Configure the Google Cloud SDK
4. Authenticate Docker with Artifact Registry
5. Build the application container
6. Push the image to Artifact Registry
7. Retrieve GKE credentials
8. Deploy the new image to Kubernetes
9. Verify the Kubernetes rollout

This provides a keyless automated deployment workflow from GitHub to GKE.

Monitoring

The project includes Kubernetes and Google Cloud monitoring configuration for observing application and infrastructure behavior.

Operational validation included:

• Pod status
• Deployment status
• CPU utilization
• Horizontal Pod Autoscaler metrics
• Service endpoints
• Rollout status
• Application health checks

Cost Management

The live GKE environment is designed to be reproducible rather than permanently running.

After deployment and validation, Terraform can remove the infrastructure with:

terraform destroy

The complete environment was successfully destroyed after testing, demonstrating infrastructure lifecycle management and preventing unnecessary ongoing cloud compute costs.

Repository Structure

kubernetes-cloud-platform/
├── .github/
│   └── workflows/
│       └── deploy.yml
├── app/
├── architecture/
├── docker/
├── kubernetes/
│   ├── app-secret.yaml
│   ├── configmap.yaml
│   ├── deployment.yaml
│   ├── hpa.yaml
│   ├── ingress.yaml
│   ├── network-policy.yaml
│   ├── pdb.yaml
│   └── service.yaml
├── monitoring/
├── security/
├── terraform/
├── .dockerignore
├── .gitignore
├── LICENSE
└── README.md

Project Validation

The project was validated through an actual Google Cloud deployment rather than configuration files alone.

Testing included:

• Terraform infrastructure provisioning
• Successful GKE cluster creation
• Docker image build and Artifact Registry push
• Kubernetes deployment
• External LoadBalancer connectivity
• Health and readiness endpoint testing
• Horizontal Pod Autoscaler metrics
• PodDisruptionBudget enforcement
• NetworkPolicy deployment
• Kubernetes self-healing
• GitHub Actions CI/CD deployment
• Workload Identity Federation authentication
• Terraform infrastructure teardown

Skills Demonstrated

This project demonstrates practical experience with:

Cloud Engineering: GCP, GKE, cloud networking, IAM, load balancing and infrastructure lifecycle management.

DevOps: GitHub Actions, CI/CD, Docker, Artifact Registry and automated deployments.

Infrastructure as Code: Terraform provisioning, state management, variables, outputs and teardown.

Kubernetes: deployments, services, autoscaling, probes, resource management, networking, disruption budgets and self-healing.

Cloud Security: IAM, Workload Identity Federation, keyless authentication, secrets management and network policies.

Author

Philip Hebert III