# chmielewski.dev — Production GCP Engineering & Architecture Blueprints

> Official technical publication by Mateusz Chmielewski (Platform Engineer @ Reckitt | GCP Cloud Architect). Production-grade Google Cloud Platform (GCP) infrastructure, Kubernetes (GKE), Cloud Run serverless, Terraform automation, and cloud security guardrails.

## Core Guides & Architecture Blueprints

- [Cloud Armor Tutorial: WAF Rules, Rate Limiting, and Bot Defense for Your Load Balancer | 2026](https://chmielewski.dev/tutorial/cloud-armor-waf-rate-limiting-bot-defense): Google Cloud Armor is the WAF and DDoS layer for the external Application Load Balancer — you attach one security policy to your backend service and get OWASP Core Rule Set WAF rules, per-IP rate-based bans, and reCAPTCHA bot defense enforced at Google's edge. This tutorial builds that policy end to end with gcloud and Terraform, including preview-mode tuning so you never block legitimate users.
- [The Perfect Terraform Module: File Structure, Versioning, Packaging & GitHub Actions CI | 2026](https://chmielewski.dev/tutorial/terraform-module-structure-versioning-github-actions): A production-grade Terraform module is a fixed file layout (main.tf, variables.tf, outputs.tf, versions.tf, README.md, CHANGELOG.md, INSTRUCTIONS.md, examples/) versioned with SemVer git tags, packaged for consumption via pinned git refs or a registry, and guarded by a GitHub Actions pipeline running fmt, validate, tflint, and terraform-docs on every pull request. This guide builds exactly that module — a small terraform-google-network module — from empty directory to automated release.
- [How to Audit a GCP Project for the CIS Benchmark with gcloud (Script Included) | 2026](https://chmielewski.dev/tutorial/gcp-cis-benchmark-audit-gcloud-script): A CIS benchmark audit of a GCP project is a set of read-only checks against IAM policies, audit logging, firewall rules, and storage configuration — this guide implements the highest-impact CIS Google Cloud Foundations controls as a single gcloud/bash script that prints PASS/FAIL per control and exits non-zero on any failure, so it runs identically on a laptop and in CI.
- [Per-Team Cost Allocation on GCP: Labels, Folders & Billing Queries | 2026](https://chmielewski.dev/tutorial/gcp-per-team-cost-allocation-labels-folders-billing-queries): Per-team cost allocation on GCP is built in three layers — enforce a label taxonomy (`team`, `env`, `cost-center`) via Terraform `default_labels` and organization policy, group projects into team folders, and query the BigQuery Detailed billing export by label and project ancestry to produce a showback report with near-complete attribution.
- [GKE Autopilot Production Checklist: PDBs, HPA/VPA, Spot Pods & Cost Controls | 2026](https://chmielewski.dev/tutorial/gke-autopilot-production-checklist-pdb-hpa-vpa-spot-cost): A production-ready GKE Autopilot workload needs four things — a PDB that uses `maxUnavailable` (so it never blocks scale-down or upgrades), HPA on `autoscaling/v2` paired with VPA in recommendation-only mode, spot pods guarded by a fallback replica count and graceful shutdown, and cost controls built on right-sized resource requests, since Autopilot bills per requested vCPU/memory, not per node.
- [How to Build a Training Pipeline with Vertex AI Pipelines (Kubeflow SDK, End to End) | 2026](https://chmielewski.dev/tutorial/vertex-ai-pipelines-training-pipeline-kubeflow-sdk-end-to-end): An end-to-end Vertex AI training pipeline is built with the Kubeflow Pipelines SDK v2 — define Python functions as `@dsl.component` steps (data prep, custom training, evaluation), wire them into a `@dsl.pipeline` DAG with an evaluation gate that conditionally registers the model, compile to YAML with `kfp.compiler`, and submit or schedule it as a Vertex AI `PipelineJob` against a Cloud Storage pipeline root.
- [Workload Identity Federation for GitHub Actions — Drop Service Account Keys Forever | 2026](https://chmielewski.dev/tutorial/workload-identity-federation-github-actions-gcp): Workload Identity Federation (WIF) lets GitHub Actions pipelines authenticate to Google Cloud using short-lived OIDC tokens instead of service account JSON keys, eliminating the biggest CI/CD credential leak risk with zero cost. This guide ships a production-ready Terraform module for WIF pool creation, OIDC provider registration, and least-privilege service account bindings so you never store a GCP key in GitHub Secrets again.
- [Low-Cost 3-Tier Application on Firebase — Secure by Default with API Key Restrictions, App Check & Security Rules | 2026](https://chmielewski.dev/tutorial/firebase-3-tier-app-low-cost-security-hardening): A secure, low-cost 3-tier application on Firebase means Hosting for the frontend, callable Cloud Functions for the logic tier, and Firestore plus Cloud Storage for data — hardened with four controls: restrict the Firebase API key to your domain and only the needed APIs, enforce App Check on every backend, lock Firestore and Storage behind least-privilege security rules, and configure CORS correctly on functions and buckets. On the Blaze plan's free tiers, this stack runs at $0–5/month for low-traffic apps.
- [GCP Organization Policies to Enable by Default](https://chmielewski.dev/tutorial/gcp-organization-policies-defaults-terraform-module): Every GCP organization should enforce a baseline set of organization policies by default: disable service account key creation, restrict IAM members to your Workspace domains, skip default network creation, require shielded VMs, block VM external IPs, forbid public Cloud SQL IPs, and enforce uniform bucket-level access with public access prevention. Managing them as code through one Terraform module built on google_org_policy_policy makes the baseline versioned, auditable, and impossible to weaken by accident.
- [GCP Secret Manager Terraform Module with Automatic Rotation — Production Guide | 2026](https://chmielewski.dev/tutorial/gcp-secret-manager-terraform-module-automatic-rotation): A Terraform module for GCP Secret Manager can enforce automatic secret rotation by default: set a `rotation` block with `rotation_period` (e.g., 7776000s = 90 days) on every `google_secret_manager_secret`, attach a Pub/Sub topic for rotation notifications, and let a Cloud Function subscriber perform the actual credential rollover — so no secret is ever created without an expiry schedule.
- [Event-Driven VM Auto-Scheduling on GCP — Start & Stop VMs with Cloud Scheduler, Pub/Sub & Cloud Functions | 2026](https://chmielewski.dev/tutorial/event-driven-vm-auto-scheduling-cloud-functions-pubsub-scheduler): Use Cloud Scheduler to publish start/stop messages to Pub/Sub, then let Cloud Functions (2nd gen) filter Compute Engine VMs by the label `autoscheduling=true` and control their state. This event-driven pattern is serverless, cost-effective, and follows least-privilege IAM.
- [Fix Over-Privileged IAM with Policy Analyzer and IAM Recommender | 2026](https://chmielewski.dev/tutorial/fix-overprivileged-iam-policy-analyzer-recommender): GCP IAM Recommender flags unused permissions and over-granted roles, while Policy Analyzer lets you query who can access what across your organization. Together they replace manual IAM spreadsheet audits with data-driven least-privilege remediation.
- [Spot VMs and Preemptible Capacity: Cut GKE Compute Costs 60–91% Without Downtime | 2026](https://chmielewski.dev/tutorial/spot-vms-preemptible-gke-cost-optimization): GKE Spot VMs give you the same Compute Engine capacity as on-demand instances at up to 91% lower cost. By isolating Spot workloads on dedicated node pools, adding PodDisruptionBudgets, and handling the 25-second preemption notice, you can run non-prod GKE clusters with zero downtime and a fraction of the compute bill.
- [Route Cloud Run & GKE Egress Through a Static IP with Terraform | Serverless VPC Access + NAT](https://chmielewski.dev/tutorial/cloud-run-gke-static-egress-ip-terraform-serverless-vpc-access-nat): Cloud Run and GKE use ephemeral IPs by default, which breaks third-party IP allow-lists and audit requirements. By attaching a Serverless VPC Access connector, routing traffic through a VPC, and using Cloud NAT with reserved static IPs, you get predictable egress addresses with fully Terraform-managed infrastructure.
- [How to Build an HA External HTTPS Load Balancer on GCP — Multi-Region Backends, Cloud CDN, Managed Certs | 2026](https://chmielewski.dev/tutorial/ha-external-https-load-balancer-gcp): A Google Cloud external HTTPS load balancer is a global Layer 7 proxy that terminates TLS, distributes traffic across multi-region backends, and caches content at the edge with Cloud CDN. This guide shows you how to deploy a production-ready HA setup strictly using Terraform HCL.
- [Shared VPC on GCP with Terraform — Host Project, Service Projects & IAM Done Right | 2026](https://chmielewski.dev/tutorial/shared-vpc-gcp-terraform-host-service-projects-iam): Shared VPC allows multiple service projects to share a single Virtual Private Cloud network hosted in a dedicated host project. Using Terraform, you can automate host project activation, service project attachment, subnet delegation, and least-privilege IAM so teams get centralized network governance without losing project autonomy.
- [Terraform VPC Service Controls — Enterprise Security & Custom Module Guide | 2026](https://chmielewski.dev/tutorial/terraform-vpc-service-controls-custom-module-guide): VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud managed services (like BigQuery, Cloud Storage, and SQL) to block data exfiltration. Using a custom Terraform module allows teams to declaratively deploy perimeters, manage access levels, and leverage dry-run mode to prevent unexpected outages.

## Key Directories & Category Hubs

- [All Blueprints Directory](https://chmielewski.dev/posts): Complete catalog of production GCP blueprints, Terraform manifests, and architecture guides.
- [Kubernetes Tutorials](https://chmielewski.dev/topic/kubernetes): GKE Autopilot, Spot VMs, ingress controllers, and cluster networking.
- [Security Tutorials](https://chmielewski.dev/topic/security): IAM least privilege, Cloud Armor WAF, and VPC Service Controls perimeters.
- [Serverless Tutorials](https://chmielewski.dev/topic/serverless): Cloud Run v2, Eventarc triggers, and Pub/Sub microservice architectures.
- [Networking Tutorials](https://chmielewski.dev/topic/networking): Shared VPC, Cloud NAT, external load balancing, and DNS.
- [About Author](https://chmielewski.dev/about): Mateusz Chmielewski's professional CV, GCP certifications, and portfolio.
- [Contact & Inquiries](https://chmielewski.dev/contact): Technical inquiries and cloud architecture consultations.
- [Privacy Policy](https://chmielewski.dev/privacy): Privacy policy and GDPR compliance statement.

## System Resources & Machine Index

- [XML Sitemap](https://chmielewski.dev/sitemap.xml): Machine-readable XML sitemap for web crawlers.
- [RSS Feed](https://chmielewski.dev/rss.xml): RSS feed for blog updates.