Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Migrating a Kubernetes-deployed nginx proxy that dispatches HTTPS traffic by header value to a GCP global external Application Load Balancer using Internet NEGs and URL-map header matches.

Procedure for importing a manually deployed Cloud Run service into Terraform state. Covers the IAM binding when the runtime service account differs from the Terraform actor, lifecycle ignore_changes for CI-managed image and env vars, and the multi-container template behavior of gcloud run services update.