Serverpod

The control plane reaches customer clusters without touching the public internet

Ground Control, the Dart control plane, needs to call services inside every tenant's GKE cluster. It does that over Private Service Connect with mutual TLS from a private CA (GCP Certificate Authority Service issuing through cert-manager, root published to the control plane via Secret Manager), entering the cluster through a shared Gateway API. It went from spike to every environment inside a week, shipped as a Helm chart and Terraform modules, with runbooks for the teardown ordering that nobody gets right the first time.

Cloud

GCP / GKE

Shipped as

Helm + Terraform

A deployment pipeline built as a product, not a folder of workflows

The Terragrunt pipeline is a reusable plan → release → apply chain, published as GitHub Actions workflows and consumed by the infrastructure monorepo at pinned SHAs. A hermetic end-to-end suite exercises the whole chain against real modules and gates every merge to main. Plan artifacts are content-addressed, so a stale plan is caught rather than applied, and no apply ever runs in pull request context. Every module in the monorepo (capsules, control plane, monitoring, tenant and cluster infrastructure) was migrated onto it over about a week.

Contract first, then Go, then Dart

Capsule health starts as an OpenAPI contract in an org-wide contracts repo, becomes a Go service running in the tenant cluster, and surfaces in the Dart control plane as a live endpoint and a streaming one. The rest of the work has the same cross-repo shape: the Kubernetes tenant operator extended in Go with Flagger canary support, and Flux GitOps taken from an empty repository to running the platform layer, with per-service reconciliation, secrets delivered by operator on every cluster behind alerting and a runbook, and pull requests that render each cluster's real manifests so a reviewer sees the actual change.

Languages

Go, Dart, HCL

Repos

6, two bootstrapped

The same person wires the cluster and writes the control plane

Capsule secrets used to be created declaratively from the cluster side by Config Connector. Moving that into Ground Control, the Dart control plane, turned infrastructure into application code: it now provisions and deletes those secrets itself, with the IAM and the tenant chart rearranged underneath it. The cutover ran in two reversible phases, marking the existing resources non-destructible before anything changed hands, because a migration you cannot walk back is not one you run against live tenants. Platform engineers do not usually write the product, and product engineers do not usually hold the IAM. Owning both is what turns a change like that into a fortnight instead of a quarter of coordination.