- Private GKE cluster, Workload Identity, Shielded Nodes
- VPC-native networking, Cloud NAT, Calico network policies
- Helm chart, Prometheus alerting, Fluent Bit logging
- GitHub Actions CI/CD with tfsec security scanning
- Full docs, k8s manifests, RBAC, examples, scripts