Technologies
Tools we use
The tools, patterns, and platforms we use most often, with short notes on why we choose them.
Infrastructure as Code
Infrastructure as code keeps resources and changes reviewable, and makes environments easier to reproduce.
Terraform
Terraform has a broad provider ecosystem and a large body of shared knowledge. It is our usual default when a team needs to manage resources across cloud and third-party providers.
Pairs with: Terragrunt, Infracost
OpenTofu
OpenTofu offers a closely compatible HCL workflow under an open-source license. It is a useful option for teams starting fresh or reviewing their dependency on Terraform.
Pairs with: Terragrunt, Infracost
Terragrunt
Terragrunt can reduce repetition once Terraform configurations span several environments. We use it to manage shared configuration, remote state, and directory structure when those concerns would otherwise be duplicated.
Pairs with: Terraform, OpenTofu
Ansible
When you need to configure what’s inside the machine, not just provision it, Ansible is the pragmatic choice. Agentless, SSH-based, readable YAML playbooks. We reach for it when cloud-init isn’t enough and a full control plane would be overkill.
Pairs with: Terraform, OpenTofu
Infracost
Infracost adds estimated infrastructure changes to pull requests. It gives reviewers useful cost context before resources are provisioned.
Pairs with: Terraform, FinOps
FinOps
Cloud spend benefits from feedback inside the engineering workflow. Tags, budgets, anomaly alerts, and right-sizing data help teams include cost in architecture decisions.
Pairs with: Infracost, Terraform
CI/CD & Delivery
A reliable delivery pipeline reduces the routine work and uncertainty around testing, deployment, and rollback.
GitHub Actions
GitHub Actions is a practical default when the code already lives on GitHub. We use it for tests, container builds, and deployments that benefit from being close to the pull request.
Pairs with: ArgoCD, GitOps
GitLab CI/CD
For teams already using GitLab, its integrated pipelines, container registry, environments, and review apps keep the delivery workflow in one platform.
Pairs with: GitOps, ArgoCD
Cloud Build
On GCP, Cloud Build can keep CI close to Cloud Run, GKE, and Artifact Registry. We use it when simpler cloud authentication matters more than the broader GitHub Actions ecosystem.
Pairs with: GitOps, ArgoCD
ArgoCD
ArgoCD reconciles Kubernetes state from a Git repository. It makes deployment changes, rollbacks, and configuration drift visible through the same versioned workflow.
Pairs with: GitOps, GitHub Actions
Nx
Nx provides incremental builds, affected-only test runs, and dependency-aware task orchestration. We use it when a monorepo needs to avoid rebuilding and retesting unrelated projects.
Pairs with: GitHub Actions, GitLab CI/CD
GitOps
With GitOps, desired state lives in version control and automation reconciles the running system to match. Changes become easier to review, audit, and reverse.
Pairs with: ArgoCD, GitHub Actions
Observability & Monitoring
Useful observability narrows the search during development and incidents by connecting service behavior to traces, metrics, and logs.
OpenTelemetry
OpenTelemetry is the instrumentation layer we usually standardize on. Its vendor-neutral traces, metrics, and logs make it possible to change backends without rewriting application instrumentation.
Pairs with: Cloud Trace, Grafana
Cloud Trace
On GCP, Cloud Trace is a low-overhead starting point with native integration for Cloud Run, GKE, and Cloud Functions.
Pairs with: OpenTelemetry, Cloud Logging
Cloud Logging
GCP’s native logging supports structured logs, log-based metrics, and alerts without another vendor. We use it as a default until query or retention requirements suggest a different backend.
Pairs with: Cloud Trace, Cloud Monitoring
Cloud Monitoring
Cloud Monitoring provides dashboards, service-level objective tracking, and uptime checks with existing integrations for GCP managed services.
Pairs with: Cloud Logging, Cloud Trace
Grafana
When you need dashboards that pull from multiple data sources or you’re running multi-cloud, Grafana earns its place. We use it to unify metrics across providers and self-hosted systems, but if you’re single-cloud GCP, the native dashboards usually get you there with less overhead.
Pairs with: OpenTelemetry, Datadog
Datadog
The right call when your observability needs outgrow native tooling, complex APM, cross-service dependency maps, and anomaly detection across hundreds of services. Powerful, but it’s a real line item. We scope it tightly and make sure you’re using what you’re paying for.
Pairs with: OpenTelemetry, Sentry
PagerDuty
PagerDuty handles escalation, on-call schedules, and incident routing when a team needs more structure than a shared notification channel.
Pairs with: Cloud Monitoring, Datadog
Sentry
Sentry connects application exceptions with stack traces, breadcrumbs, and release information, which can make reproduction and triage more direct.
Pairs with: Datadog, Cloud Logging
Security & Zero Trust
Security controls are easier to maintain when they are part of the normal delivery workflow and enabled by default.
IAM-as-Code
Defining IAM policies in Terraform keeps role and binding changes versioned, reviewable, and reproducible across environments.
Pairs with: Workload Identity
Workload Identity
Services authenticate with cloud APIs using their own identity, no service account keys, no shared secrets, no rotation schedules to forget about. The credential that can’t leak is the one that never existed.
Pairs with: IAM-as-Code, Cloud IAP
Cloud IAP
Cloud IAP puts internal tools behind identity-aware access. It is useful when access policy should follow the user rather than depend only on a network perimeter.
Pairs with: Workload Identity, IAM-as-Code
Cloud Armor (WAF)
Rate limiting, geo-blocking, and OWASP rule sets applied at the edge before traffic hits your services. We codify the policies in Terraform so your WAF config is reviewed and versioned like everything else.
Pairs with: Cloud IAP, IAM-as-Code
DMARC / SPF / DKIM
DMARC, SPF, and DKIM reduce domain spoofing when they are configured and monitored together. We usually work toward an enforced DMARC policy after validating legitimate mail sources.
Pairs with: IAM-as-Code
Architecture & Edge
Architecture choices should fit the current workload while leaving a clear path for the system to change.
Kubernetes
The standard for container orchestration when your workloads outgrow serverless. We run GKE and EKS, but we’re honest about when you need it, most startups are better served by Cloud Run until they hit the complexity threshold where K8s earns its operational overhead.
Pairs with: ArgoCD, Horizontal scaling
Event-driven architecture
Pub/Sub, Cloud Tasks, and asynchronous workers can isolate workloads and keep a spike in one path from cascading through the rest of the system. We introduce them where the operational tradeoff is justified.
Pairs with: Horizontal scaling, Database scaling patterns
Horizontal scaling
Stateless services, autoscaling groups, container orchestration, and load-balanced workers provide a path to horizontal scaling when traffic or workload concurrency requires it.
Pairs with: Event-driven architecture, Database scaling patterns
CDN / Edge networks
Cloud CDN and Cloudflare can serve suitable static assets, API responses, and rendered pages closer to users while reducing work at the origin.
Pairs with: Compression, Horizontal scaling
Compression
Brotli for static assets, gzip for API responses, and correct protocol negotiation can reduce transfer size with relatively little operational complexity.
Pairs with: CDN / Edge networks, Horizontal scaling
Caching & page speed
We use browser cache headers, CDN caching, application caches such as Redis or Memorystore, and static prerendering where each layer has a clear invalidation strategy. Image optimization, lazy loading, and code splitting address the client side of the same problem.
Pairs with: CDN / Edge networks, Compression
Database scaling patterns
Read replicas, connection pooling, and carefully chosen consistency boundaries can address specific database bottlenecks as the workload grows.
Pairs with: Event-driven architecture, Horizontal scaling