Terraform, GitOps & fleets across cloud and on-prem

Who manages what

GKE in Terraform

resource "google_container_cluster" "prod" {
  name     = "prod"
  project  = var.project_id
  location = "europe-west1" # a region: regional cluster

  network    = var.network_self_link # Shared VPC network and subnet
  subnetwork = var.subnet_self_link
  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }

  release_channel { channel = "REGULAR" }
  maintenance_policy {
    recurring_window {
      start_time = "2026-01-06T02:00:00Z"
      end_time   = "2026-01-06T06:00:00Z"
      recurrence = "FREQ=WEEKLY;BYDAY=TU,WE,TH"
    }
  }

  private_cluster_config {
    enable_private_nodes = true
  }
  workload_identity_config { workload_pool = "${var.project_id}.svc.id.goog" }
  datapath_provider = "ADVANCED_DATAPATH" # Dataplane V2
  database_encryption {
    state    = "ENCRYPTED"
    key_name = var.secrets_kms_key
  }

  remove_default_node_pool = true
  initial_node_count       = 1
  deletion_protection      = true
}

resource "google_container_node_pool" "apps" {
  name     = "apps"
  cluster  = google_container_cluster.prod.id
  location = "europe-west1"

  autoscaling {
    total_min_node_count = 3
    total_max_node_count = 30
    location_policy      = "BALANCED"
  }
  management {
    auto_repair  = true
    auto_upgrade = true
  }
  upgrade_settings {
    max_surge       = 1
    max_unavailable = 0
  }
  node_config {
    machine_type    = "n2-standard-8"
    image_type      = "COS_CONTAINERD"
    service_account = var.node_service_account
    oauth_scopes    = ["https://www.googleapis.com/auth/cloud-platform"]
    workload_metadata_config { mode = "GKE_METADATA" }
    shielded_instance_config {
      enable_secure_boot          = true
      enable_integrity_monitoring = true
    }
    labels = { pool = "apps" }
  }
}

• remove_default_node_pool + separate google_container_node_pool resources: pools can change without touching the cluster.
• deletion_protection stops an accidental destroy.
• The cloud-platform scope plus a minimal service account is the recommended pattern: IAM, not scopes, limits access.
• The terraform-google-modules/kubernetes-engine modules wrap these resources with good defaults (including private and Autopilot variants); pin the module version and read its changelog before upgrading it.
• Remote state in a Cloud Storage bucket (versioned, in a separate project), applied from CI with Workload Identity Federation, one state per environment and stack. The Manage EKS with Terraform and Terraform & IaC tracks cover layout, state and pipelines; the same patterns apply here.

GitOps inside the clusters

• Argo CD: runs in a management cluster (or each cluster), pulls from Git, rich UI, ApplicationSets across many clusters. Register GKE clusters with least-privilege credentials, or use Connect gateway for fleet clusters.
• Config Sync: Google's GitOps agent in each cluster, configured per fleet (all clusters get the same "root sync" plus team "repo syncs"), integrates with Policy Controller. Simpler and agent-per-cluster; less UI.
• Config Connector manages Google Cloud resources (buckets, Pub/Sub, IAM) as Kubernetes objects, so app teams can declare their cloud dependencies next to their apps through GitOps.

Pick one GitOps tool per platform, and decide what's platform-owned (add-ons, policies, namespaces) versus team-owned (apps).

Fleets: many clusters, one management plane

A fleet groups clusters for shared management:

Treat fleet members as interchangeable where possible: the same namespace and ServiceAccount names mean the same thing across the fleet (namespace sameness), which is what makes multi-cluster networking and identity work.

Hybrid: on-prem and other clouds

For a platform team running Kubernetes across cloud and on-prem, the pattern is the same everywhere: one Git source of truth, a fleet (or an Argo CD hub) that reaches every cluster, consistent policies, and observability that sees all clusters in one place. Product names and packaging in this area change often; check the current documentation before designing around a specific offering.

Recap

• Terraform for Google Cloud resources (network, clusters, separate node pools, IAM, KMS); remote state in Cloud Storage; deletion_protection on.
• GitOps (Argo CD or Config Sync) for everything inside clusters; Config Connector for cloud resources declared by teams.
• Fleets manage many clusters together: Connect gateway, shared config and policy, multi-cluster Gateways and Services.
• Hybrid: Google Distributed Cloud on-prem and attached clusters elsewhere join the same fleet.