Learn WebSocket - Infrastructure as Code

#Introduction

Building infrastructure through the cloud console is an expensive habit: no record of who made what, changes cannot be reviewed, and "temporary" servers live for years. Infrastructure as Code turns infrastructure into files that are reviewed, verified, and rolled back like ordinary code.

Episode 31 covers infrastructure as code for WebSocket applications: Terraform for cloud provisioning, Helm and Kustomize for Kubernetes packaging, GitOps with ArgoCD, and managing secrets and feature flags.

#Terraform

#Cloud Provisioning

Terraform declares infrastructure in HCL files.

resource "aws_vpc" "utama" {
  cidr_block = "10.0.0.0/16"
}
 
resource "aws_lb" "ws" {
  name               = "ws-alb"
  internal           = false
  load_balancer_type = "application"
  subnets            = [aws_subnet.public_a.id, aws_subnet.public_b.id]
}
 
resource "aws_lb_target_group" "ws_tg" {
  name        = "ws-tg"
  port        = 8080
  protocol    = "HTTP"
  vpc_id      = aws_vpc.utama.id
  target_type = "ip"
 
  health_check {
    path = "/healthz"
  }
 
  stickiness {
    type = "lb_cookie"
  }
}

aws_lb_target_group with stickiness and the /healthz health check builds the WebSocket foundation covered in episode 29 — now as code that can be reviewed.

#The Terraform Workflow

terraform plan
terraform apply

terraform plan shows the changes before they are applied, terraform apply executes them. The plan enables review: the team sees exactly what will change in the infrastructure.

#Helm and Kustomize

#Helm Charts

Helm packages Kubernetes manifests into parameterizable bundles.

replicas: 3
image:
  repository: registry.example.com/ws-server
  tag: "1.4.0"
resources:
  limits:
    cpu: "500m"
    memory: 256Mi
ingress:
  enabled: true
  host: ws.example.com

values.yaml separates configuration from templates. One chart can serve staging and production with different values: helm upgrade --install ws ./chart -f values-production.yaml.

#Kustomize

Kustomize (integrated into kubectl) patches manifests without templating. It fits teams that prefer pure YAML: kubectl kustomize overlays/production merges a base with per-environment overlays.

#GitOps with ArgoCD

#Git as the Source of Truth

GitOps makes the Git repository the single source of the cluster's state. ArgoCD continuously compares the cluster with what is in Git and syncs the differences.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: ws-server
spec:
  destination:
    namespace: ws
    server: https://kubernetes.default.svc
  source:
    repoURL: https://github.com/example/ws-infra
    path: charts/ws-server
    targetRevision: main
  syncPolicy:
    automated:
      prune: true

automated.sync: prune: true automatically applies changes in Git to the cluster. Rollback is done by reverting a commit — Git records everything.

#GitOps Advantages

• Every infrastructure change goes through a pull request.
• A complete audit trail from the Git history.
• One cluster or a hundred clusters managed the same way.
• Failures are rolled back with a revert, not a manual command.

#Secrets and Feature Flags

#Secret Management

Never put secrets in Git. Use encrypted storage.

kubectl create secret generic ws-secret --from-literal=JWT_SECRET=...

For larger teams, the External Secrets Operator pulls secrets from Vault, AWS Secrets Manager, or a cloud secret store straight into the cluster — with automatic rotation.

#Feature Flags

Feature flags separate deploy from release: a feature ships to production but stays off until enabled.

Feature flag on the server

const flags = { roomV2: false };
 
socket.on("room:join", (data) => {
  if (flags.roomV2) {
    handleRoomV2(data);
  } else {
    handleRoomV1(data);
  }
});

flags.roomV2 enables switching behavior without a redeploy. Once a new feature proves stable, the flag is removed and the old code is discarded.

#Closing

Episode 31 united infrastructure and code: Terraform builds the cloud, Helm and Kustomize package Kubernetes, GitOps enforces consistency, and secrets and feature flags keep security and release speed high.

Key takeaways:

• Terraform declares cloud infrastructure as reviewable code.
• Plan before apply gives visibility into infrastructure changes.
• Helm parameterizes charts; Kustomize patches without templates.
• ArgoCD syncs the cluster with the state in Git.
• GitOps makes Git the source of truth and rollback.
• Secrets are stored encrypted; feature flags separate deploy from release.

In the next episode we look to the future: modern alternatives — HTTP/3, WebTransport, gRPC streaming, GraphQL subscriptions, and edge computing.