Serverpod

01

The control plane reaches customer clusters without touching the public internet

Ground Control, the Dart control plane, needs to call services inside every tenant's GKE cluster. It does that over Private Service Connect with mutual TLS from a private CA (GCP Certificate Authority Service issuing through cert-manager, root published to the control plane via Secret Manager), entering the cluster through a shared Gateway API. It went from spike to every environment inside a week, shipped as a Helm chart and Terraform modules, with runbooks for the teardown ordering that nobody gets right the first time.

Cloud

GCP / GKE

Shipped as

Helm + Terraform

02

A deployment pipeline built as a product, not a folder of workflows

The Terragrunt pipeline is a reusable plan → release → apply chain, published as GitHub Actions workflows and consumed by the infrastructure monorepo at pinned SHAs. A hermetic end-to-end suite exercises the whole chain against real modules and gates every merge to main. Plan artifacts are content-addressed, so a stale plan is caught rather than applied, and no apply ever runs in pull request context. Every module in the monorepo (capsules, control plane, monitoring, tenant and cluster infrastructure) was migrated onto it over about a week.

03

Contract first, then Go, then Dart

Capsule health starts as an OpenAPI contract in an org-wide contracts repo, becomes a Go service running in the tenant cluster, and surfaces in the Dart control plane as a live endpoint and a streaming one. The rest of the work has the same cross-repo shape: the Kubernetes tenant operator extended in Go with Flagger canary support, and Flux GitOps taken from an empty repository to running the platform layer, with per-service reconciliation, secrets delivered by operator on every cluster behind alerting and a runbook, and pull requests that render each cluster's real manifests so a reviewer sees the actual change.

Languages

Go, Dart, HCL

Repos

6, two bootstrapped

04

The same person who wires the cluster ships the product

File storage for capsules is a customer-facing feature with a price list, and it landed across the whole stack: IAM on the tenant projects, then the domain model, entitlement and database migration in the Dart control plane, then the API endpoints and the lifecycle subscribers that make a bucket follow its capsule through creation and deletion, then credentials delivered into the running capsule with seeding so local development keeps working. Once it worked, it became a product: usage metered from Cloud Monitoring through hourly ingestion into billing, plan caps enforced, every capsule given a private and a public storage by default, CORS converged onto existing buckets and extended when a customer attaches a domain, uploads blocked and customers notified when access is revoked, rate limits on the object endpoints, and an end-to-end test uploading from a deployed capsule. The precedent was set earlier in the engagement, when capsule secret provisioning moved from Config Connector on the cluster side into the control plane in two reversible phases. Platform engineers do not usually write the product, and product engineers do not usually hold the IAM. Owning both is what turns a feature like this into weeks instead of a quarter of coordination.

Scope

IAM to billing

Per capsule

Private + public storage