Skip to content
15 years of IT experience
CybexsoftConsultancy Services
← Back to case studies

GCP Production Infrastructure

Production-grade GCP infrastructure for a scaling web platform

A fast-growing product team needed a fully managed, production-ready GCP platform built from scratch. We delivered a Terraform-codified environment covering Cloud Storage, HTTPS load balancing, Compute Engine managed instance groups, Cloud Run app services, and an automated Cloud Build CI/CD pipeline — all wired together inside a secure VPC.

Industry
SaaS / Web Platform
Engagement
8-week build
Team
Platform + backend
Focus
GCP IaC, CI/CD, HA compute

The situation

What was wrong

The team had outgrown a single-server staging setup and needed a repeatable, secure, production-grade GCP platform ready for their next growth phase. No VPC design existed, deployments were manual, assets were stored ad-hoc, and there was no automated build pipeline. Every layer — networking, compute, storage, app runtime, and CI/CD — had to be designed and built from the ground up.

  • No GCP production environment — manual provisioning and ad-hoc resource creation in a shared project.
  • Static assets and user uploads stored locally on a single VM with no redundancy or CDN.
  • Deployments required SSH access to VMs with no repeatable pipeline, creating release bottlenecks.
  • No autoscaling strategy — traffic spikes caused outages and required manual intervention.
Engagement focus
GCPTerraformCloud BuildCloud RunCompute Engine
Outcome

Fully automated, production-ready GCP platform delivered in under 8 weeks with 100% IaC coverage.

How we worked

The approach, step by step

Stabilise delivery early, then build the foundation that keeps it stable once we hand it back.

    1

    Network foundation and project structure

    Set up a dedicated GCP project with a custom VPC, public and private subnets across two regions, Cloud NAT for egress, and firewall rules following least-privilege principles. IAM service accounts scoped to each workload replaced broad project-level permissions.

    2

    Cloud Storage and CDN layer

    Provisioned Cloud Storage buckets for static assets, media uploads, and build artifacts with lifecycle policies and versioning. Wired a Cloud CDN-backed HTTPS load balancer in front of the static bucket and the backend services, with a managed SSL certificate and URL map routing.

    3

    Compute Engine managed instance groups

    Deployed the primary application backend on a regional Managed Instance Group (MIG) using a hardened instance template. Configured autoscaling policies based on CPU utilization and custom metrics, and attached the MIG as a backend to the HTTP(S) load balancer with health checks and connection draining.

    4

    Cloud Run app services

    Containerized stateless microservices and deployed them to Cloud Run for fully managed serverless scale. Services are fronted by the same load balancer via serverless NEGs, share secrets via Secret Manager, and connect to the VPC over Serverless VPC Access for private downstream calls.

    5

    Cloud Build CI/CD pipeline

    Built a Cloud Build pipeline triggered on every push to main: lint → unit tests → container image build and push to Artifact Registry → rolling update to the MIG and Cloud Run revision. Environment-specific substitution variables handle staging and production promotion without branching pipelines.

    6

    IaC, observability, and handoff

    All infrastructure codified in Terraform with remote state in a GCS bucket and state locking via Google Cloud Storage object conditions. Wired Cloud Monitoring dashboards and alerting policies for load balancer error rates, MIG health, and Cloud Run concurrency. Delivered module documentation and a day-2 operations runbook.

Handover

What we delivered

  • Terraform modules for VPC, Cloud Storage, HTTPS LB, MIG, Cloud Run, Cloud Build, and IAM
  • Cloud Storage buckets with lifecycle policies, versioning, and CDN integration
  • HTTPS load balancer with managed SSL, URL routing, and health checks for MIG and Cloud Run backends
  • Regional Managed Instance Group with autoscaling, rolling updates, and connection draining
  • Cloud Run services with Serverless VPC Access and Secret Manager integration
  • Cloud Build pipeline: lint → test → build → Artifact Registry → MIG/Cloud Run deploy
  • Cloud Monitoring dashboards, uptime checks, and alerting policies
  • Terraform remote state in GCS with locking and environment-specific workspaces

Stack

What it runs on

TerraformGCP VPCCloud StorageCloud CDNCloud Load BalancingCompute EngineManaged Instance GroupsCloud RunCloud BuildArtifact RegistrySecret ManagerCloud MonitoringIAM

Afterwards

What changed

Measured after handover, once the client's own team was running the system without us.

8 wk
End-to-end delivery
100%
Infrastructure as Code coverage
12 min
End-to-end CI/CD pipeline

Planning something like this?

Tell us what you are trying to move, migrate or automate and we will reply within one business day with an honest read on the work — including the parts we think you should not do.

Talk to an engineerExplore our services

More engagements

AWS Full-Stack Infrastructure

Full-stack AWS infrastructure for a modern SaaS product

Fully automated, production-ready infrastructure delivered in under 10 weeks.

Read the case study Microsoft Intune — BYOD Endpoint Management

Production Intune tenant for Windows and macOS BYOD in one week

Windows and macOS BYOD enrollment live in one week, with every corporate app behind a device-health check.

Read the case study