Infrastructure Management

<h2 id="infrastructure-management-for-geode" class="position-relative d-flex align-items-center group"> Infrastructure Management for Geode <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="infrastructure-management-for-geode" aria-haspopup="dialog" aria-label="Share link: Infrastructure Management for Geode"> Share link </button> </h2><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Infrastructure as Code (IaC) has transformed how organizations deploy and manage database infrastructure, replacing error-prone manual processes with version-controlled, repeatable, and automated provisioning. This comprehensive guide explores Infrastructure as Code practices for Geode graph database deployments, covering Terraform, CloudFormation, Pulumi, Ansible, and production-ready patterns across cloud and on-premises environments. <h3 id="why-infrastructure-as-code-matters" class="position-relative d-flex align-items-center group"> Why Infrastructure as Code Matters <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="why-infrastructure-as-code-matters" aria-haspopup="dialog" aria-label="Share link: Why Infrastructure as Code Matters"> Share link </button> </h3>Traditional infrastructure management through manual server configuration, point-and-click cloud consoles, and undocumented “tribal knowledge” creates significant operational challenges. Changes are difficult to track, inconsistencies emerge across environments, disaster recovery requires manual reconstruction, and scaling is slow and error-prone. Infrastructure as Code solves these problems by treating infrastructure configuration as software. Every server, network rule, load balancer, and database instance is defined in version-controlled files. Changes go through code review. Deployments are automated and repeatable. Disaster recovery becomes as simple as re-running your infrastructure code in a new region. For Geode deployments, IaC provides critical benefits including consistent environments across development, staging, and production, rapid scaling to handle load increases or create new environments, disaster recovery through infrastructure re-creation in minutes, compliance through auditability of every infrastructure change, and cost optimization by quickly provisioning environments only when needed. <h3 id="infrastructure-architecture-principles" class="position-relative d-flex align-items-center group"> Infrastructure Architecture Principles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="infrastructure-architecture-principles" aria-haspopup="dialog" aria-label="Share link: Infrastructure Architecture Principles"> Share link </button> </h3>Before diving into specific tools, understanding infrastructure architecture principles ensures your Geode deployment is robust, scalable, and maintainable. High Availability Design: Production Geode deployments should span multiple availability zones within a region. Place Geode instances in separate failure domains so that zone outages don’t impact database availability. Use network load balancers to distribute client connections across healthy instances. Configure automatic health checks to remove failed instances from load balancer rotation. Network Segmentation: Isolate Geode instances in private subnets with no direct internet access. Use bastion hosts or VPN connections for administrative access. Place load balancers in public subnets to accept client connections while keeping database instances protected. Configure security groups or network ACLs to restrict traffic to only required ports (3141 for QUIC, 9090 for metrics). Storage Strategy: Use high-performance block storage (AWS EBS gp3, Azure Premium SSD, GCP Persistent SSD) for Geode data directories. Size IOPS and throughput based on workload requirements—typical production deployments need 5,000-16,000 IOPS and 250-1,000 MB/s throughput. Enable encryption at rest for compliance. Configure automated snapshots for backup and recovery. Monitoring and Observability: Deploy monitoring agents to collect metrics, logs, and traces. Export metrics to centralized systems like Prometheus, CloudWatch, or Datadog. Configure alerting for critical conditions like high CPU, disk space exhaustion, connection pool saturation, or query latency spikes. Implement log aggregation for troubleshooting and compliance. Security Hardening: Enable TLS for all connections with certificate management through ACM or cert-manager. Implement least-privilege IAM policies for service accounts. Use secrets management (AWS Secrets Manager, HashiCorp Vault) for credentials. Configure audit logging for compliance requirements. Regularly patch operating systems and update Geode to latest stable versions. <h3 id="terraform" class="position-relative d-flex align-items-center group"> Terraform <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="terraform" aria-haspopup="dialog" aria-label="Share link: Terraform"> Share link </button> </h3> <h4 id="aws-infrastructure" class="position-relative d-flex align-items-center group"> AWS Infrastructure <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="aws-infrastructure" aria-haspopup="dialog" aria-label="Share link: AWS Infrastructure"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-hcl" data-lang="hcl"># main.tf terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } provider "aws" { region = var.aws_region } # VPC resource "aws_vpc" "geode" { cidr_block = "10.0.0.0/16" enable_dns_hostnames = true enable_dns_support = true tags = { Name = "geode-vpc" } } # Security Group resource "aws_security_group" "geode" { name = "geode-sg" description = "Security group for Geode" vpc_id = aws_vpc.geode.id ingress { from_port = 3141 to_port = 3141 protocol = "tcp" cidr_blocks = ["10.0.0.0/8"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } # EC2 Instances resource "aws_instance" "geode" { count = var.instance_count ami = data.aws_ami.ubuntu.id instance_type = var.instance_type subnet_id = aws_subnet.private[count.index].id vpc_security_group_ids = [aws_security_group.geode.id] root_block_device { volume_type = "gp3" volume_size = 100 iops = 3000 throughput = 125 encrypted = true } user_data = file("${path.module}/install-geode.sh") tags = { Name = "geode-${count.index}" } } # EBS Volumes for Data resource "aws_ebs_volume" "geode_data" { count = var.instance_count availability_zone = aws_instance.geode[count.index].availability_zone size = 1000 type = "gp3" iops = 16000 throughput = 1000 encrypted = true tags = { Name = "geode-data-${count.index}" } } resource "aws_volume_attachment" "geode_data" { count = var.instance_count device_name = "/dev/sdf" volume_id = aws_ebs_volume.geode_data[count.index].id instance_id = aws_instance.geode[count.index].id } # Load Balancer resource "aws_lb" "geode" { name = "geode-nlb" internal = true load_balancer_type = "network" subnets = aws_subnet.private[*].id tags = { Name = "geode-nlb" } } resource "aws_lb_target_group" "geode" { name = "geode-targets" port = 3141 protocol = "TCP" vpc_id = aws_vpc.geode.id health_check { protocol = "TCP" port = 3141 } } resource "aws_lb_listener" "geode" { load_balancer_arn = aws_lb.geode.arn port = 3141 protocol = "TCP" default_action { type = "forward" target_group_arn = aws_lb_target_group.geode.arn } } resource "aws_lb_target_group_attachment" "geode" { count = var.instance_count target_group_arn = aws_lb_target_group.geode.arn target_id = aws_instance.geode[count.index].id port = 3141 } </code></pre></div> <h4 id="variables" class="position-relative d-flex align-items-center group"> Variables <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="variables" aria-haspopup="dialog" aria-label="Share link: Variables"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-hcl" data-lang="hcl"># variables.tf variable "aws_region" { description = "AWS region" type = string default = "us-east-1" } variable "instance_count" { description = "Number of Geode instances" type = number default = 3 } variable "instance_type" { description = "EC2 instance type" type = string default = "r6g.2xlarge" } </code></pre></div> <h3 id="cloudformation" class="position-relative d-flex align-items-center group"> CloudFormation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cloudformation" aria-haspopup="dialog" aria-label="Share link: CloudFormation"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode-stack.yaml AWSTemplateFormatVersion: '2010-09-09' Description: Geode Graph Database Infrastructure Parameters: InstanceType: Type: String Default: r6g.2xlarge Description: EC2 instance type InstanceCount: Type: Number Default: 3 Description: Number of Geode instances Resources: GeodeVPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 EnableDnsHostnames: true EnableDnsSupport: true Tags: - Key: Name Value: geode-vpc GeodeSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupName: geode-sg GroupDescription: Security group for Geode VpcId: !Ref GeodeVPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 3141 ToPort: 3141 CidrIp: 10.0.0.0/8 GeodeLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: geode-nlb Type: network Scheme: internal Subnets: - !Ref PrivateSubnet1 - !Ref PrivateSubnet2 - !Ref PrivateSubnet3 GeodeTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: geode-targets Port: 3141 Protocol: TCP VpcId: !Ref GeodeVPC HealthCheckProtocol: TCP HealthCheckPort: 3141 GeodeListener: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref GeodeLoadBalancer Port: 3141 Protocol: TCP DefaultActions: - Type: forward TargetGroupArn: !Ref GeodeTargetGroup Outputs: LoadBalancerDNS: Description: Load balancer DNS name Value: !GetAtt GeodeLoadBalancer.DNSName </code></pre></div> <h3 id="ansible-configuration-management" class="position-relative d-flex align-items-center group"> Ansible Configuration Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="ansible-configuration-management" aria-haspopup="dialog" aria-label="Share link: Ansible Configuration Management"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># ansible/playbook.yml --- - name: Deploy Geode hosts: geode_servers become: yes vars: geode_version: "v0.2.18" geode_data_dir: "/var/lib/geode" tasks: - name: Install dependencies apt: name: - git - ca-certificates state: present update_cache: yes - name: Clone Geode git: repo: "https://github.com/codeprosorg/geode" dest: "/opt/geode" version: "{{ geode_version }}" - name: Build Geode command: make build args: chdir: "/opt/geode" - name: Install Geode binary copy: src: "/opt/geode/zig-out/bin/geode" dest: "/usr/local/bin/geode" mode: "0755" remote_src: true - name: Create geode user user: name: geode system: yes shell: /bin/false - name: Create data directory file: path: "{{ geode_data_dir }}" state: directory owner: geode group: geode mode: '0755' - name: Install systemd service template: src: geode.service.j2 dest: /etc/systemd/system/geode.service - name: Start Geode systemd: name: geode state: started enabled: yes daemon_reload: yes </code></pre></div> <h3 id="pulumi-for-infrastructure" class="position-relative d-flex align-items-center group"> Pulumi for Infrastructure <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="pulumi-for-infrastructure" aria-haspopup="dialog" aria-label="Share link: Pulumi for Infrastructure"> Share link </button> </h3>Pulumi enables infrastructure management using familiar programming languages like Python, TypeScript, and Go: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># pulumi_geode.py import pulumi import pulumi_aws as aws # VPC Configuration vpc = aws.ec2.Vpc("geode-vpc", cidr_block="10.0.0.0/16", enable_dns_hostnames=True, enable_dns_support=True, tags={"Name": "geode-vpc"}) # Private Subnets across AZs private_subnets = [] azs = ["us-east-1a", "us-east-1b", "us-east-1c"] for i, az in enumerate(azs): subnet = aws.ec2.Subnet(f"geode-private-{i}", vpc_id=vpc.id, cidr_block=f"10.0.{i+1}.0/24", availability_zone=az, tags={"Name": f"geode-private-{az}"}) private_subnets.append(subnet) # Geode Security Group geode_sg = aws.ec2.SecurityGroup("geode-sg", vpc_id=vpc.id, description="Geode database security group", ingress=[ aws.ec2.SecurityGroupIngressArgs( from_port=3141, to_port=3141, protocol="tcp", cidr_blocks=["10.0.0.0/8"], description="Geode QUIC protocol" ), aws.ec2.SecurityGroupIngressArgs( from_port=9090, to_port=9090, protocol="tcp", cidr_blocks=["10.0.0.0/8"], description="Prometheus metrics" ) ], egress=[ aws.ec2.SecurityGroupEgressArgs( from_port=0, to_port=0, protocol="-1", cidr_blocks=["0.0.0.0/0"] ) ]) # Geode Instances instances = [] for i in range(3): instance = aws.ec2.Instance(f"geode-{i}", ami="ami-0c55b159cbfafe1f0", # Ubuntu 22.04 instance_type="r6g.2xlarge", subnet_id=private_subnets[i].id, vpc_security_group_ids=[geode_sg.id], root_block_device=aws.ec2.InstanceRootBlockDeviceArgs( volume_type="gp3", volume_size=100, iops=3000, throughput=125, encrypted=True ), user_data="""#!/bin/bash apt-get update apt-get install -y git make git clone https://github.com/codeprosorg/geode cd geode make build cp ./zig-out/bin/geode /usr/local/bin/geode useradd -r -s /bin/false geode mkdir -p /var/lib/geode chown geode:geode /var/lib/geode cat > /etc/systemd/system/geode.service <<EOF [Unit] Description=Geode Graph Database After=network.target [Service] User=geode ExecStart=/usr/local/bin/geode serve --listen 0.0.0.0:3141 --data /var/lib/geode Restart=always [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable --now geode """, tags={"Name": f"geode-{i}", "Role": "database"}) instances.append(instance) # Export endpoint pulumi.export("instance_ips", [inst.private_ip for inst in instances]) </code></pre></div>Pulumi advantages include full programming language support (loops, conditionals, functions), strong typing and IDE autocomplete, easier testing with familiar test frameworks, and reusable components through language packages. <h3 id="gitops-and-cicd-integration" class="position-relative d-flex align-items-center group"> GitOps and CI/CD Integration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="gitops-and-cicd-integration" aria-haspopup="dialog" aria-label="Share link: GitOps and CI/CD Integration"> Share link </button> </h3>Integrate infrastructure changes into your development workflow: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># .github/workflows/infrastructure.yml name: Infrastructure Deployment on: push: branches: [main] paths: - 'infrastructure/**' pull_request: paths: - 'infrastructure/**' jobs: terraform: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Setup Terraform uses: hashicorp/setup-terraform@v2 with: terraform_version: 1.6.0 - name: Terraform Init run: terraform init working-directory: infrastructure/terraform - name: Terraform Validate run: terraform validate working-directory: infrastructure/terraform - name: Terraform Plan run: terraform plan -out=tfplan working-directory: infrastructure/terraform env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: Terraform Apply if: github.ref == 'refs/heads/main' run: terraform apply -auto-approve tfplan working-directory: infrastructure/terraform env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} </code></pre></div>GitOps practices ensure every infrastructure change is reviewed, tested, and auditable through version control. <h3 id="multi-cloud-infrastructure" class="position-relative d-flex align-items-center group"> Multi-Cloud Infrastructure <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-cloud-infrastructure" aria-haspopup="dialog" aria-label="Share link: Multi-Cloud Infrastructure"> Share link </button> </h3>Deploy Geode across multiple cloud providers for redundancy: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-hcl" data-lang="hcl"># multi-cloud/main.tf # AWS Primary Region module "geode_aws_us_east" { source = "./modules/geode-cluster" cloud_provider = "aws" region = "us-east-1" instance_count = 3 instance_type = "r6g.2xlarge" } # Azure Secondary Region module "geode_azure_west_europe" { source = "./modules/geode-cluster" cloud_provider = "azure" region = "westeurope" instance_count = 3 instance_type = "Standard_E16ds_v4" } # GCP Tertiary Region module "geode_gcp_asia" { source = "./modules/geode-cluster" cloud_provider = "gcp" region = "asia-northeast1" instance_count = 3 instance_type = "n2-highmem-16" } # Global Load Balancer resource "cloudflare_load_balancer" "geode_global" { zone_id = var.cloudflare_zone_id name = "geode.example.com" default_pool_ids = [ cloudflare_load_balancer_pool.aws_pool.id, cloudflare_load_balancer_pool.azure_pool.id, cloudflare_load_balancer_pool.gcp_pool.id ] steering_policy = "geo" session_affinity = "cookie" } </code></pre></div> <h3 id="infrastructure-testing" class="position-relative d-flex align-items-center group"> Infrastructure Testing <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="infrastructure-testing" aria-haspopup="dialog" aria-label="Share link: Infrastructure Testing"> Share link </button> </h3>Test infrastructure code before deploying to production: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># tests/test_infrastructure.py import unittest from pulumi import automation as auto class TestGeodeInfrastructure(unittest.TestCase): def test_vpc_cidr_valid(self): """Test VPC CIDR block is correct""" stack = auto.select_stack("dev") outputs = stack.outputs() vpc_cidr = outputs["vpc_cidr"].value self.assertEqual(vpc_cidr, "10.0.0.0/16") def test_security_group_ports(self): """Test security group allows required ports""" stack = auto.select_stack("dev") outputs = stack.outputs() sg_rules = outputs["security_group_rules"].value required_ports = [3141, 9090] allowed_ports = [rule["from_port"] for rule in sg_rules] for port in required_ports: self.assertIn(port, allowed_ports) def test_encryption_enabled(self): """Test encryption is enabled on all volumes""" stack = auto.select_stack("prod") outputs = stack.outputs() volumes = outputs["ebs_volumes"].value for volume in volumes: self.assertTrue(volume["encrypted"]) if __name__ == '__main__': unittest.main() </code></pre></div> <h3 id="disaster-recovery-infrastructure" class="position-relative d-flex align-items-center group"> Disaster Recovery Infrastructure <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="disaster-recovery-infrastructure" aria-haspopup="dialog" aria-label="Share link: Disaster Recovery Infrastructure"> Share link </button> </h3>Automate disaster recovery with infrastructure code: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">#!/bin/bash # disaster-recovery.sh # Disaster Recovery Orchestration Script set -e BACKUP_REGION="us-west-2" DR_REGION="eu-west-1" echo "Starting disaster recovery procedure..." # Step 1: Provision infrastructure in DR region echo "Provisioning DR infrastructure..." cd terraform/dr-region terraform init terraform apply -auto-approve \ -var="region=$DR_REGION" \ -var="instance_count=3" # Step 2: Retrieve latest backup echo "Retrieving latest backup from S3..." LATEST_BACKUP=$(aws s3 ls s3://geode-backups-$BACKUP_REGION/ \ --region $BACKUP_REGION | sort | tail -n 1 | awk '{print $4}') aws s3 cp "s3://geode-backups-$BACKUP_REGION/$LATEST_BACKUP" \ /tmp/latest-backup.tar.gz --region $BACKUP_REGION # Step 3: Restore to DR instances echo "Restoring database to DR instances..." DR_INSTANCES=$(terraform output -json instance_ips | jq -r '.[]') for instance in $DR_INSTANCES; do scp /tmp/latest-backup.tar.gz geode@$instance:/tmp/ ssh geode@$instance "geode restore --backup=/tmp/latest-backup.tar.gz" done # Step 4: Update DNS for failover echo "Updating DNS to point to DR region..." aws route53 change-resource-record-sets \ --hosted-zone-id Z1234567890ABC \ --change-batch file://dns-failover.json echo "Disaster recovery complete. Database is now running in $DR_REGION" </code></pre></div> <h3 id="cost-optimization-strategies" class="position-relative d-flex align-items-center group"> Cost Optimization Strategies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cost-optimization-strategies" aria-haspopup="dialog" aria-label="Share link: Cost Optimization Strategies"> Share link </button> </h3>Optimize infrastructure costs while maintaining performance: Right-sizing Instances: Use monitoring data to identify over-provisioned instances and downsize appropriately. ARM-based instances (AWS Graviton) offer 20-40% cost savings with equivalent performance. Spot Instances for Development: Use spot instances for non-production environments to reduce costs by 70-90%. Implement graceful shutdown handling for spot interruptions. Storage Tiering: Use appropriate storage classes—gp3 for active databases, st1 for infrequently accessed backups, Glacier for long-term retention. Auto-Scaling: Implement auto-scaling for development environments that shut down outside business hours: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-hcl" data-lang="hcl">resource "aws_autoscaling_schedule" "shutdown_evening" { scheduled_action_name = "shutdown-evening" min_size = 0 max_size = 0 desired_capacity = 0 recurrence = "0 18 * * MON-FRI" # 6 PM weekdays autoscaling_group_name = aws_autoscaling_group.geode_dev.name } resource "aws_autoscaling_schedule" "startup_morning" { scheduled_action_name = "startup-morning" min_size = 3 max_size = 5 desired_capacity = 3 recurrence = "0 8 * * MON-FRI" # 8 AM weekdays autoscaling_group_name = aws_autoscaling_group.geode_dev.name } </code></pre></div> <h3 id="production-deployment-checklist" class="position-relative d-flex align-items-center group"> Production Deployment Checklist <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="production-deployment-checklist" aria-haspopup="dialog" aria-label="Share link: Production Deployment Checklist"> Share link </button> </h3>Before deploying Geode infrastructure to production: <ul> <li><input disabled="" type="checkbox"> Multi-AZ deployment configured with at least 3 availability zones</li> <li><input disabled="" type="checkbox"> Network segmentation with private subnets for database instances</li> <li><input disabled="" type="checkbox"> Security groups restrict traffic to required ports only</li> <li><input disabled="" type="checkbox"> Encryption enabled for all volumes (root and data)</li> <li><input disabled="" type="checkbox"> TLS certificates configured for encrypted client connections</li> <li><input disabled="" type="checkbox"> Load balancer health checks configured and tested</li> <li><input disabled="" type="checkbox"> Automated backups scheduled with appropriate retention</li> <li><input disabled="" type="checkbox"> Monitoring and alerting configured in CloudWatch/Prometheus</li> <li><input disabled="" type="checkbox"> Disaster recovery procedures documented and tested</li> <li><input disabled="" type="checkbox"> IAM roles follow least-privilege principle</li> <li><input disabled="" type="checkbox"> Secrets stored in AWS Secrets Manager or HashiCorp Vault</li> <li><input disabled="" type="checkbox"> Infrastructure code in version control with required approvals</li> <li><input disabled="" type="checkbox"> Terraform state stored remotely with locking enabled</li> <li><input disabled="" type="checkbox"> Runbook documented for common operational tasks</li> <li><input disabled="" type="checkbox"> Performance testing completed with production-like load</li> </ul> <h3 id="troubleshooting-common-infrastructure-issues" class="position-relative d-flex align-items-center group"> Troubleshooting Common Infrastructure Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting-common-infrastructure-issues" aria-haspopup="dialog" aria-label="Share link: Troubleshooting Common Infrastructure Issues"> Share link </button> </h3>Terraform State Corruption: If Terraform state becomes corrupted, restore from backup and re-import resources. Enable state versioning and locking to prevent concurrent modifications. Security Group Conflicts: Ensure security group rules don’t conflict. Use Terraform’s <code>terraform plan</code> to preview changes before applying. Instance Launch Failures: Check IAM permissions, AMI availability in target region, and EC2 service limits. Review CloudTrail logs for detailed error messages. Network Connectivity Issues: Verify route tables, NAT gateways, and security group rules. Use VPC Flow Logs to debug traffic patterns. High Infrastructure Costs: Review unused resources (idle instances, unattached volumes, old snapshots). Implement cost allocation tags and budget alerts. <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/deployment/" >Deployment</a> : Deployment strategies and patterns</li> <li><a href="/tags/cloud/" >Cloud</a> : Cloud platform integrations</li> <li><a href="/tags/containers/" >Containers</a> : Container technologies</li> <li><a href="/tags/orchestration/" >Orchestration</a> : Kubernetes orchestration</li> <li><a href="/tags/monitoring/" >Monitoring</a> : Infrastructure monitoring</li> <li><a href="/tags/security/" >Security</a> : Security best practices</li> <li><a href="/tags/high-availability/" >High Availability</a> : HA architectures</li> <li><a href="/tags/backup/" >Backup</a> : Backup and recovery</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li>Infrastructure as Code Guide: <code>/docs/operations/infrastructure-as-code/</code></li> <li>Terraform Best Practices: <code>/docs/operations/terraform-best-practices/</code></li> <li>Configuration Management: <code>/docs/operations/configuration-management/</code></li> <li>Cloud Deployment Patterns: <code>/docs/deployment/cloud-patterns/</code></li> <li>Cost Optimization: <code>/docs/operations/cost-optimization/</code></li> <li>Disaster Recovery Planning: <code>/docs/operations/disaster-recovery/</code></li> </ul>

Popular

Related Articles