Infrastructure¶

Terraform-managed, multi-cloud (GCP + AWS) infrastructure for the ML-MLOps Portfolio.

Multi-Cloud Architecture¶

flowchart TB
    subgraph GH ["GitHub"]
        Code[Source Code] --> CI[GitHub Actions\n10 jobs]
        CI --> |push images| AR[Artifact Registry]
        CI --> |push images| ECR[ECR]
    end

    subgraph GCP ["GCP — us-central1"]
        AR --> GKE[GKE Cluster\n1-5 nodes auto-scaling\ne2-medium]
        GCS[(Cloud Storage\nModels + Datasets)]
        CSQL[(Cloud SQL\nMLflow Backend)]
        GKE --> |init containers| GCS
        GKE --> CSQL
    end

    subgraph AWS ["AWS — us-east-1"]
        ECR --> EKS[EKS Cluster\n1-5 nodes auto-scaling\nt3.small]
        S3[(S3\nArtifacts + Datasets)]
        RDS[(RDS PostgreSQL\nMLflow Backend)]
        EKS --> S3
        EKS --> RDS
    end

    subgraph K8s ["Kubernetes — Same Manifests"]
        direction LR
        BC[BankChurn API] ~~~ NLP[NLPInsight API] ~~~ CT[ChicagoTaxi API]
        PROM[Prometheus] ~~~ GRAF[Grafana] ~~~ MLF[MLflow]
    end

    GKE --> K8s
    EKS --> K8s

    TF[Terraform IaC] --> GCP
    TF --> AWS

Side-by-Side: GCP vs AWS¶

Cloud-agnostic design: The same K8s base manifests deploy to both clouds. Only image registry URLs and storage class annotations differ (via Kustomize overlays).

Cloud Resources¶

GCP (Live Production)¶

AWS (Live Production)¶

GKE Workloads	EKS Workloads	Container Registries

Artifact Registry (GCP)	S3 Buckets (AWS)	GCS Models (GCP)

Kubernetes¶

Resource Calibration (2 uvicorn workers)¶

CPU-only HPA: ML models have fixed memory footprint. Memory-based scaling would never scale down.

Terraform Commands¶

cd infra/terraform/gcp    # or aws/
terraform init
terraform plan -var-file=terraform.tfvars
terraform apply -var-file=terraform.tfvars

Infrastructure Testing¶

Automated validation suite in tests/infra/:

bash tests/infra/run_all_tests.sh

Terraform Multi-Cloud	K8s Overlays	Infra Tests

Security¶

• Encryption at rest (GCS, Cloud SQL, S3, RDS)
• Workload Identity (GCP) / IRSA (AWS) for pod-level IAM
• Non-root containers (UID 1000)
• Private database networking
• CI/CD scanning: Trivy, Bandit, Gitleaks, pip-audit
• Least-privilege: storage.objectViewer for GKE pods
• IaC scanning: tfsec, checkov (advisory findings documented in .tfsec.yml)

Security Hardening (Terraform — Production-Grade)¶

The Terraform configuration includes security hardening that goes beyond what is applied to the running demo cluster:

Architecture Decision: The running GKE demo cluster was provisioned before the security hardening was added to the Terraform code. Applying these changes would force cluster recreation (private_cluster_config and ip_allocation_policy are ForceNew attributes in the GCP provider), destroying all 6 running pods and requiring full redeployment.

Additionally, master_authorized_networks_config restricts API access to the VPC subnet (10.10.0.0/24), which would require a bastion host or Cloud Shell for kubectl access — appropriate for production but impractical for a portfolio demo that requires frequent local interaction.

The Terraform code represents the production-ready target state. The running cluster demonstrates deployment capabilities (APIs, monitoring, autoscaling, CI/CD). Both are valid portfolio artifacts — the code shows security engineering, the cluster shows operational execution. A real production deployment would apply the hardened configuration from initial provisioning.

Monitoring Stack¶

Grafana — ML Production Dashboard	Prometheus — 16/16 Targets UP
Request rate, P95 latency, predictions/hr, error rate, CPU, memory	All ML services + K8s auto-discovered pods

Last Updated: March 2026 — v3.5.3 (both clouds live with LoadBalancer Ingress)