Infrastructure Overview Landing Zone and Network Foundation · GCP folders and projects · VPCs, subnets, and Shared VPC · Network Connectivity Center spokes and routes · Cloud Router, Cloud NAT, firewall rules, and DNS policies · IP reservations, load-balancer components, and Private Service Connect · Root and intermediate certificate authorities · Logging sinks, organization-policy overrides, and foundational IAM Security and Encryption · Cloud KMS key rings and keys, including CMEK and HSM-backed encryption · KMS IAM permissions · Secret Manager · Service accounts and IAM roles · Cross-project secret synchronization into GKE using the External Secrets Operator Kubernetes and Compute · GKE clusters provisioned within landing-zone VPCs and subnets · Compute Engine virtual machines and persistent disks · Cloud Functions Data and Analytics · BigQuery datasets, tables, views, scheduled queries, and stored procedures · Cloud Composer and Apache Airflow · Dataflow Databases and Data Stores · Cloud SQL for PostgreSQL and MySQL · Cloud Spanner · Memorystore for Redis · MongoDB Atlas through private connectivity · Cassandra on GCP virtual machines, provisioned with Terraform and Ansible · Supporting network infrastructure for Oracle Database@Google Cloud Messaging and Eventing · Pub/Sub · Confluent Kafka, including private connectivity through Private Service Connect · DNS-related automation and diagnostics Artifact Management Artifact Registry supports Docker, Maven, and npm repositories. Networking Utilities Cloud DNS is supported by automated connectivity and DNS diagnostics, including nslookup, curl, and Kafka Private Service Connect checks. Infrastructure State and Project Onboarding · GCS-based Terraform state buckets · Project-onboarding automation for required APIs and baseline IAM Application Lifecycle GCP Landing Zone → GKE Cluster → Data, Messaging, and Supporting GCP Resources → GitOps/CD → Applications and Microservices The landing-zone automation establishes where the workload will run, including the project, VPC, subnet, encryption, and connectivity foundations. Resource-creation automation then provisions the services the application requires, such as databases, BigQuery, Kafka, Pub/Sub, Redis, secrets, and other managed services. Finally, the GitOps/CD layer deploys application workloads to GKE, where they consume the provisioned platform services.