self-service-infrastructure

What this skill does

# Self-Service Infrastructure

Patterns for enabling developers to provision infrastructure without tickets, while maintaining governance and control.

## When to Use This Skill

- Designing infrastructure self-service capabilities
- Creating reusable Terraform/Pulumi modules
- Building environment provisioning systems
- Implementing infrastructure guardrails
- Reducing infrastructure request bottlenecks
- Balancing developer autonomy with governance

## Self-Service Fundamentals

### What is Self-Service Infrastructure?

```text
Self-Service Infrastructure:
Enabling developers to provision and manage infrastructure
directly, without filing tickets or waiting for ops teams.

Traditional Model:
┌─────────────────────────────────────────────────────────────┐
│ Developer → Ticket → Ops Review → Manual Provision → Done  │
│                                                              │
│ Timeline: Days to weeks                                      │
│ Bottleneck: Ops team capacity                               │
│ Result: Shadow IT, workarounds, frustration                 │
└─────────────────────────────────────────────────────────────┘

Self-Service Model:
┌─────────────────────────────────────────────────────────────┐
│ Developer → Portal/API → Automatic Provision → Done         │
│                                                              │
│ Timeline: Minutes to hours                                  │
│ Bottleneck: None (automated)                                │
│ Result: Speed, consistency, compliance                      │
└─────────────────────────────────────────────────────────────┘

Self-Service Spectrum:
├── Fully Managed: Click a button, get a database
├── Template-Based: Customize from approved templates
├── Policy-Constrained: Write IaC within guardrails
└── Full Freedom: Any infrastructure (risky)

Sweet Spot: Template-Based with Policy Guardrails
```

### Key Benefits

```text
Self-Service Benefits:

For Developers:
├── Speed: Minutes instead of days
├── Autonomy: Provision when needed
├── Consistency: Same infrastructure every time
├── Learning: Understand infrastructure better
└── Ownership: More responsibility, more control

For Operations:
├── Scale: Handle more requests without more people
├── Consistency: Enforce standards automatically
├── Focus: Work on platform, not tickets
├── Audit: Clear trail of who provisioned what
└── Compliance: Built-in policy enforcement

For Organization:
├── Velocity: Faster time to market
├── Cost: Reduced ops overhead
├── Governance: Better compliance posture
├── Security: Consistent security controls
└── Efficiency: Resources provisioned when needed
```

## Self-Service Architecture

### Component Architecture

```text
Self-Service Infrastructure Architecture:

┌─────────────────────────────────────────────────────────────┐
│                     USER INTERFACE                           │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐         │
│  │   Portal    │  │    CLI      │  │    API      │         │
│  │   (Web UI)  │  │ (Terraform) │  │  (REST/gRPC)│         │
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘         │
│         └────────────────┼────────────────┘                 │
│                          │                                   │
├──────────────────────────┼───────────────────────────────────┤
│                          ▼                                   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │               ORCHESTRATION LAYER                    │    │
│  │  ├── Request validation                              │    │
│  │  ├── Policy evaluation (OPA/Sentinel)               │    │
│  │  ├── Cost estimation                                 │    │
│  │  ├── Approval workflow (if needed)                  │    │
│  │  └── Execution orchestration                        │    │
│  └─────────────────────────────────────────────────────┘    │
│                          │                                   │
├──────────────────────────┼───────────────────────────────────┤
│                          ▼                                   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │               TEMPLATE LIBRARY                       │    │
│  │  ├── Database modules (RDS, Cloud SQL)              │    │
│  │  ├── Compute modules (EKS, GKE, VMs)               │    │
│  │  ├── Storage modules (S3, GCS)                      │    │
│  │  ├── Network modules (VPC, subnets)                 │    │
│  │  └── Composite modules (full environments)          │    │
│  └─────────────────────────────────────────────────────┘    │
│                          │                                   │
├──────────────────────────┼───────────────────────────────────┤
│                          ▼                                   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │               EXECUTION ENGINE                       │    │
│  │  ├── Terraform Cloud/Enterprise                     │    │
│  │  ├── Pulumi Service                                 │    │
│  │  ├── Crossplane                                     │    │
│  │  └── Cloud-native (CDK, ARM, Deployment Manager)   │    │
│  └─────────────────────────────────────────────────────┘    │
│                          │                                   │
├──────────────────────────┼───────────────────────────────────┤
│                          ▼                                   │
│  ┌─────────────────────────────────────────────────────┐    │
│  │               CLOUD PROVIDERS                        │    │
│  │  AWS  │  GCP  │  Azure  │  Kubernetes  │  Others    │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘
```

### Request Flow

```text
Self-Service Request Flow:

┌─────────────────────────────────────────────────────────────┐
│ 1. REQUEST                                                   │
│    Developer: "I need a PostgreSQL database for staging"    │
│    └── Via portal, CLI, or API                              │
└─────────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│ 2. VALIDATION                                                │
│    ├── User has permission?          ✓ Team member          │
│    ├── Request well-formed?          ✓ Valid config         │
│    ├── Within quotas?                ✓ Under team limit     │
│    └── Meets policy?                 ✓ Allowed instance type│
└─────────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│ 3. ENRICHMENT                                                │
│    ├── Apply defaults                 db.t3.medium          │
│    ├── Generate names                 myapp-staging-db      │
│    ├── Assign network                 staging-vpc           │
│    ├── Configure monitoring           Datadog integration   │
│    └── Estimate cost                  ~$50/month            │
└─────────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│ 4. APPROVAL (if required)                                    │
│    ├── Auto-approve: staging, dev     ✓ Auto-approved       │
│    ├── Manual approve: production     (Would need approval) │
│    └── Cost threshold: >$500/month    (Would need approval) │
└─────────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│ 5. EXECUTION                                                 │
│    ├── Generate Terraform             Based on template     │
│    ├── Plan                           Preview changes       │
│