CloudDeploy

Build CloudDeploy, the infrastructure capstone. Provision the same platform on AWS, GCP, and Azure with Terraform and Terragrunt, stand up EKS, GKE, and AKS, and deploy ShopMicro for real — with Datadog observability, Keycloak identity, and GrowthBook feature flags, all shipped by CI/CD.

Start here See the architecture

What you’ll build

Introduction

Why CloudDeploy, how the capstone is structured, and what you’ll have built by the end. Open →

Setup & Tooling

Terraform, Terragrunt, the AWS/GCP/Azure CLIs, and the modules/ + live/ repo layout. Open →

Terraform Foundations

Providers, resources, state, and variables — a first resource on each cloud. Open →

Terragrunt & Remote State

Keep config DRY, with remote state backends and locking across a live/ tree. Open →

Networking

Build reusable VPC/VNet modules — subnets, routing, and security per cloud. Open →

Managed Kubernetes

Provision EKS, GKE, and AKS with node pools and a kubeconfig per cloud. Open →

Identity & IAM

Cloud IAM with least privilege — IRSA, Workload Identity, and Managed Identity. Open →

Managed Data

Provision managed Postgres — RDS, Cloud SQL, and Azure Database. Open →

Deploying ShopMicro

Deploy the ShopMicro Helm chart onto each cluster, with ingress and per-cloud config. Open →

Observability (Datadog)

Wire the Datadog agent for metrics, traces, and logs, with dashboards and monitors. Open →

Identity (Keycloak)

Deploy Keycloak, a realm and OIDC client, and put auth at the ShopMicro gateway. Open →

Feature Flags (GrowthBook)

Deploy GrowthBook and gate a ShopMicro feature behind a flag. Open →

CI/CD

Ship with GitHub Actions — terragrunt plan on PR, apply and deploy on merge, across clouds. Open →

Multi-cloud in Practice

Manage drift and state, watch cost, tear down cleanly — and weigh the honest trade-offs. Open →

Wrap-up

Review what you built, the trade-offs, and where to take CloudDeploy next. Open →

Versions verified

Checked against official docs and registries at the time of writing: Terraform 1.16, Terragrunt 1.1 (run --all, S3 use_lockfile), hashicorp/aws ~> 6.0, hashicorp/google ~> 8.0, hashicorp/azurerm ~> 5.0, EKS/AKS/GKE on Kubernetes 1.36, RDS/Cloud SQL/Azure Database for PostgreSQL 17, DataDog/datadog ~> 4.0, Keycloak 26.x (keycloak/keycloak ~> 5.0 provider), and current GitHub Actions majors (actions/checkout@v7, hashicorp/setup-terraform@v4, aws-actions/configure-aws-credentials@v6, google-github-actions/auth@v3, azure/login@v3). Ingress is native per cloud (ALB / GKE ingress / AGIC) throughout — CloudDeploy does not install ingress-nginx, which the Kubernetes project is retiring upstream in March 2026.