The problem
On-prem hosting limits how far an application can scale and how quickly a team can test changes. Rewriting everything as serverless is rarely the right first step; the goal is to move safely and improve delivery along the way.
Key design decisions
- 01
Containerize first, re-architect later
Each application gets a Dockerfile and a Helm chart, so it runs the same way locally, in CI and in production before any deeper refactoring.
- 02
Managed Kubernetes, separate production
GKE Autopilot or EKS Auto Mode removes node management. Production runs in its own cluster and account, while staging and previews share a non-production cluster.
- 03
Everything in Terraform
Clusters, networking, databases and IAM are defined in Terraform and applied by the pipeline, never by hand.
- 04
Secrets from Vault
Pipelines authenticate to Vault with short-lived OIDC tokens and workloads with their Kubernetes identity, so no long-lived secrets live in repositories or CI variables.
- 05
An environment per branch
Each feature branch deploys to its own namespace in the non-production cluster, so changes are tested in isolation and torn down automatically on merge.