Problem Statement
Apna Mart runs a live, always-on retail and grocery platform spanning 200+ stores and a fast-growing online delivery business, backed by infrastructure, CI/CD, configuration management, 27 microservices, middleware, and production databases on Microsoft Azure. As the business scaled into more tier-2 and tier-3 markets, Apna Mart needed to move its entire stack to Google Cloud Platform — without pausing store operations or online orders even for a moment. The migration was not a single lift-and-shift: it spanned infrastructure-as-code, CI/CD pipelines, configuration management, AKS-to-GKE microservice migration, middleware re-platforming, and a production database cutover, all under strict security and compliance requirements. Apna Mart brought in BuildPiper to orchestrate this multi-layer, end-to-end migration as a governed, automated program rather than a manual, high-risk cutover.
Top 3 Achievements
Challenges
Rebuilding Azure infrastructure on GCP without service interruption
VPC, subnets, IAM, NAT, GKE, GAR and more needed to be reproduced on GCP with the same reliability Apna Mart's stores depended on, while keeping every change reviewable and reversible.
No unified CI/CD across infrastructure, containers, and microservices
Terraform, container builds, and microservice deployments were not governed by a single, consistent pipeline, increasing the risk of manual error during a large-scale migration.
Configuration drift across environments
OS hardening, agents, secrets, and provisioning for Redis, OpenSearch, and RabbitMQ were handled inconsistently across dev, QA, staging, and prod, risking environment-specific failures post-migration.
Migrating 27 microservices from AKS to GKE with zero downtime
15 frontend and 12 backend microservices needed redesigned service discovery, scaling, health probes, and secrets management all while the live platform kept serving customers and franchise stores.
Re-platforming stateful middleware without data loss or performance regression
Redis, OpenSearch, Elasticsearch, RabbitMQ, and Kafka all needed to move from AKS-based infrastructure to GCP including Memorystore and optimized VM-based clusters without disrupting dependent services.
Cutting over the production database under strict security constraints
The production database had to move to AlloyDB with minimal downtime and full validation, while every step of the migration enforced restricted access, IP whitelisting, controlled ports, and vulnerability scanning.
Solutions
Modular Terraform IaC, governed through BuildPiper pipelines
BuildPiper orchestrated the complete GCP infrastructure rebuild :- VPC, subnets, IAM, NAT, GKE, GAR and more through modular Terraform with automated fmt, validate, Checkov, plan, and apply stages gated before every change.
Unified CI/CD across Terraform, containers, and microservices
BuildPiper automated linting, security scanning, testing, image builds, and deployments in a single pipeline, enabling zero-touch provisioning with automated post-deployment validation at every stage.
Ansible configuration management delivered continuously through CI/CD
Modular Ansible roles for OS hardening, agent installation, secrets, and Redis/OpenSearch/RabbitMQ provisioning were integrated into BuildPiper pipelines, achieving 100% automated, drift-free configuration across environments.
Governed AKS-to-GKE migration for all 27 microservices
BuildPiper-driven pipelines redesigned service discovery, scaling, probes, and secrets for every microservice, and rolled them out via rolling updates with automated validation to guarantee zero downtime.
Middleware re-architected and migrated through BuildPiper pipelines
Redis was migrated to Memorystore; OpenSearch, Elasticsearch, and RabbitMQ moved to GCP VM-based infrastructure; and Kafka was re-architected from AKS into an optimized, VM-based cluster.
Production database cutover via GCP DMS with security built in
BuildPiper orchestrated continuous replication to AlloyDB through GCP DMS, followed by a minimal-downtime cutover with full validation — enforcing restricted access, IP whitelisting, controlled ports, and vulnerability scans throughout.
