Multi-Cloud Foundation & Fleet-Scale Kubernetes Automation
Standardizing 60+ Kubernetes clusters and 200+ cloud projects across GCP, Azure, AWS, and on-premises RKE2 using Terraform & Ansible
Senior Platform Engineer & Cloud/DevOps Technical Lead
60+ Clusters
Provisioned and supported 60+ production and non-production Kubernetes clusters across hybrid and multi-cloud environments.
200+ Projects
Standardized cloud foundation and project/subscription provisioning across 200+ GCP and multi-cloud environments.
Minutes vs. Days
Reduced HA Kubernetes and RKE2 cluster bootstrap time from days of manual setup to minutes via Ansible and Terraform.
01 // Engineering Problem
Rapid cloud adoption across business units created snowflake cloud accounts, inconsistent IAM policies, manual Kubernetes cluster builds, and unoptimized infrastructure spend.
02 // Business & Operational Context
Enterprise engineering organizations required a repeatable 'Cloud & Cluster Factory' capable of provisioning compliant GCP projects, Azure subscriptions, AWS accounts, and production-ready Kubernetes clusters in hours instead of weeks.
Architecture Topology // Multi-Cloud Foundation & Fleet-Scale Kubernetes Automation
Reusable Terraform Modules
Versioned Terraform modules provisioning 200+ GCP projects, Azure subscriptions, VPCs, and IAM guardrails.
Ansible + HAProxy/Keepalived
Zero-touch Ansible playbooks bootstrapping 3-master stacked etcd HA clusters and RKE2 nodes with VRRP VIPs.
Rancher + Anthos + Fleet
Centralized multi-cluster authentication, Let's Encrypt TLS automation, and GitOps policy synchronization.
Autoscaling & Rightsizing
Continuous resource optimization, node auto-provisioning, and automated non-prod scheduling.
Mermaid Topology Specification (Architecture-as-Code) ▼
flowchart LR
subgraph IaC["Declarative Infrastructure Factory"]
TF["Modular Terraform Registry\n(VPC + IAM + Landing Zones)"]
Ans["Ansible Automation Roles\n(OS Hardening + RKE2 / Kubeadm)"]
end
subgraph Fleet["Multi-Cloud & Hybrid Fleet (60+ Clusters / 200+ Projects)"]
GCP["Google Cloud (200+ Projects)\nGKE & Anthos Clusters"]
Azure["Microsoft Azure\nAKS & Hub-Spoke Landing Zones"]
AWS["Amazon Web Services\nEKS & Multi-AZ VPCs"]
OnPrem["On-Prem Bare-Metal / VMware\nRKE2 HA & Kubeadm + HAProxy/Keepalived"]
end
subgraph Mgmt["Central Fleet Governance"]
Rancher["SUSE Rancher + Fleet\n(Multi-Cluster RBAC & Lifecycle)"]
end
TF --> GCP & Azure & AWS
Ans --> OnPrem
GCP & Azure & AWS & OnPrem --> RancherKey Architectural Decisions & Engineering Tradeoffs
DECISION 01
Design composable Terraform modules with strict input validation and remote state locking
Allowed application and platform squads to provision new GCP projects, GKE clusters, or Azure resources using standardized 20-line module invocations that enforce naming, tagging, and network security automatically.
Requires strict semantic versioning and CI module testing before releasing breaking provider upgrades.
DECISION 02
Standardize bare-metal and VM cluster bootstrapping on Ansible + RKE2 / kubeadm with HAProxy & Keepalived
Provides cloud-like high availability on-premises by pairing Keepalived VRRP floating virtual IPs with HAProxy L4 API server load balancing.
Requires careful sysctl, kernel module, and etcd disk latency validation on bare-metal hosts.
Zero-Trust Security Guardrails
- CIS-hardened RKE2 and Linux OS baselines applied automatically via Ansible roles.
- Least-privilege cloud IAM roles, Workload Identity bindings, and private cluster API endpoints across GCP, Azure, and AWS.
SRE & Reliability Engineering
- Eliminated single points of failure on bare-metal clusters using dual HAProxy + Keepalived load balancers fronting 3 stacked etcd control plane nodes.
- Centralized multi-cluster visibility and lifecycle management across 60+ clusters.
Engineering Challenge
Operating at enterprise scale—supporting 60+ Kubernetes clusters and 200+ cloud projects across GCP, Azure, AWS, and on-premises data centers—makes manual console provisioning impossible. Any inconsistency in network CIDR allocation, IAM bindings, container runtime configuration, or load balancer timeouts quickly compounds into production outages.
Solution Architecture
1. Multi-Cloud Terraform Landing Zones
We built a versioned library of reusable Terraform modules covering:
- Cloud Foundations: Automated GCP Project Factory, Azure Landing Zones, hub-and-spoke VPCs, Cloud NAT, and least-privilege IAM bindings.
- Managed Kubernetes: Standardized GKE, AKS, and EKS cluster modules pre-wired with Workload Identity, private nodes, autoscaling node pools, and Prometheus telemetry.
2. Automated Bare-Metal HA Kubernetes & RKE2 (rke2-ha-setup-ansible & kubernetes-ha-setup)
For on-premises environments, we engineered zero-touch Ansible playbooks paired with HAProxy + Keepalived:
- Layer-4 VIP Failover: Two load-balancer nodes run Keepalived VRRP to maintain a floating Virtual IP (VIP) and HAProxy to distribute traffic across three control-plane nodes on port
6443. - Idempotent Ansible Roles: Automate swap disablement, kernel modules (
overlay,br_netfilter), containerd/RKE2 server initialization, Calico/Canal CNI rollout, and worker registration.