A new region is a new cell, not a bigger cluster

The problem

One large cluster per environment concentrates the blast radius. A bad admission policy, a CNI upgrade or a noisy tenant takes everything down at once, and every upgrade becomes a high-stakes event that nobody wants to schedule.

The approach

The unit of deployment became a cell: one account and region, one VPC with private, egress and public tiers, one EKS cluster, its own keys and identities. A new region or a customer that needs isolation is a new cell. Terramate globals cascade from the organization through the account to the cell, so a new cell is one small stack file; the backend, providers and module call are generated and committed so reviewers read real Terraform.

The bridge

Terraform knows the AWS facts that manifests need: role ARNs, queue names, key ARNs, the VPC. It writes them once into a cell-metadata ConfigMap, and every Flux Kustomization substitutes ${variables} from it. Manifests carry no account, region or ARN, so one GitOps tree serves every cell. Terraform installs only what must exist before Flux: Cilium, the egress gateway and Flux itself.

What changed

Blast radius became one cell. Upgrades roll cell by cell, development first. Creating a cell went from a project to a pull request, and the same reviewed code builds every one of them.

Described as a pattern: names, numbers of systems and identifiers from the environments where this was built are left out.