L7 — Infra & Deployment

Production GCP topology. The whole estate runs on Cloud Run (since the 2026-07 migration off GKE): scale-to-zero v2 Services behind a single global external-managed HTTPS load balancer with one IP, plus min-0 v2 Jobs for one-shot work. There is no cluster, no node pool, no NAT, and no Kubernetes manifests — services egress directly and authenticate to GCP with per-service runtime service accounts.

Reading notes

• Services vs Jobs: anything serving HTTP is a scale-to-zero Service; anything whose natural unit is “one game / one task / one render” is a min-0 Job — zero idle cost, launched by a workflow or a service.
• One trust boundary at the edge: every public domain resolves to the same LB IP; Cloud Armor policies attach per-backend. /internal/* handler routes are reachable only through internal load-balancer ingress — external requests are denied at the platform layer, not by shared credentials.
• Secrets are read directly from Secret Manager at startup by each service using its own least-privilege runtime SA. The lean-runner runs with a no-permission SA inside an egress-denied VPC — it executes untrusted code and holds nothing worth stealing.
• CI is the only path to production: per-service GitHub Actions workflows authenticate via Workload Identity Federation, run the test gate inside the Docker build, and deploy with gcloud run deploy. Terraform owns everything else in infra/ and deliberately ignores image drift so applies never revert CI deploys.