Com2us Platform · Multi-cloud
Summoners War: Sky Arena multi-cloud and firewall redesign
A massive game platform across GCP and Tencent Cloud, with 600 servers and 70 databases, a full firewall policy redesign, and patching with no maintenance window.
- 600
- Servers
- 70
- Databases
- -40%
- Deployment time after moving to Terragrunt
- Problem
-
This was the company's largest project, with Tencent added for service in China. Firewall policies across the two clouds had grown duplicated and complex, and code spread across many regions had become hard to manage with Terraform alone.
- Approach
-
A full analysis of cross-cloud firewall policies removed duplicate and unneeded rules and regrouped the rest by role: web, game, database, and admin. Terraform moved to a Terragrunt structure to remove code duplication. Most servers sat behind load balancers, so patches rolled through by taking servers out and back one at a time.
- Result
-
Simpler firewall policies were easier to review and change, with a smaller exposed surface. Moving to Terragrunt cut deployment time by 40%, and GCP Cloud Armor provided DDoS protection.
- What I learned
-
The big lesson was that a firewall policy that only ever gains rules soon becomes unreadable. Regrouping long-accumulated rules by role, web, game, DB, and management, made it obvious where to look for any change and shrank the exposed surface along with it. Code hit the same problem at scale, so Terraform that had grown across many regions had to move to a Terragrunt structure to strip out the duplication. Running without maintenance windows came less from any special technique than from a structure where servers sit behind load balancers and can be taken out and put back one at a time. And because a policy cleaned up by one full analysis piles up again over time, I learned that cleanup has to be a recurring check, not a one-time job.