Archive · 2019 to 2025

Hands-on archive

Older notes and fixes from real Linux, Docker, AWS, Kubernetes and CI/CD work, newest first.

145 posts
7 years
7 tracks

202515 posts

September

DevOps15 Sept 2025Self-Hosted Kafka: Security, Monitoring and Day-Two OperationsEncrypt and authenticate a KRaft cluster with TLS and SCRAM, set ACLs and quotas, monitor the signals that matter, and run upgrades, rebalancing and disaster recovery.

Apache Kafka 4.0
SASL/SCRAM
TLS

DevOps1 Sept 2025Self-Hosted Kafka 4: A Three-Node KRaft ClusterApache Kafka 4.0 has no ZooKeeper at all. Build a KRaft cluster with dedicated controllers and brokers, sized, tuned and tested for production, with a smaller combined-node option.

Apache Kafka 4.0
KRaft
OpenJDK 17

August

GCP18 Aug 2025GCP Services: Cloud SQL, Pub/Sub and Cloud MonitoringA managed database on private IP, a message bus with dead-letter handling, and alerting with logs and metrics, wired into one order-processing architecture.

Cloud SQL
Pub/Sub
Cloud Monitoring

GCP4 Aug 2025GCP Services: Cloud Run and Artifact RegistryBuild, scan and deploy containers with Cloud Build, Artifact Registry and Cloud Run, with private ingress, secrets, a database connection and gradual rollouts.

Cloud Run
Artifact Registry
Cloud Build

July

GCP21 Jul 2025GCP Basics: Compute Engine, VPC and Cloud StorageBuild a private network with IAP access and Cloud NAT, run VMs in a managed instance group, and use Cloud Storage safely, with the differences from AWS.

Compute Engine
VPC
Cloud NAT

GCP7 Jul 2025GCP Basics: Projects, IAM and the gcloud CLIHow Google Cloud organises resources and access: the resource hierarchy, IAM roles and inheritance, service accounts, workload identity federation and a sensible first setup.

Google Cloud
gcloud CLI
Cloud IAM

June

Kubernetes17 Jun 2025MySQL Pod Recovery on MicroK8s: InnoDB Crash Recovery and Forced RecoveryRecover a MySQL pod that restarts in a loop on MicroK8s: read the InnoDB error, fix permissions and disk, use innodb_force_recovery safely to dump data, and rebuild a clean instance.

MicroK8s 1.32
MySQL 8.4 LTS
InnoDB

May

Kubernetes20 May 2025MongoDB Pod Recovery on MicroK8s: Unclean Shutdown, Repair and ResyncBring back a MongoDB pod that crashes after a node reboot or full disk on MicroK8s: read the WiredTiger error, repair or resync the member, and avoid the mistakes that destroy data.

MicroK8s 1.32
MongoDB 8.0
StatefulSet

April

Kubernetes21 Apr 2025On-Prem Platform: Databases, TLS and ZabbixDeploy MongoDB, MySQL, PostgreSQL and Redis with Helm in replicated form, issue internal TLS with cert-manager, and monitor the cluster and databases with Zabbix.

MicroK8s 1.32
Helm 3.17
Zabbix 7.0 LTS

Kubernetes7 Apr 2025On-Prem Platform: Design and Node SetupDesign a cloud-style platform on servers you own: a three-node MicroK8s cluster with load balancing, ingress, storage options, namespaces, quotas and network policies.

MicroK8s 1.32
Ubuntu 24.04 LTS
MetalLB

March

Kubernetes18 Mar 2025Redis Pod Recovery on MicroK8s: Corrupt AOF, Full Disk and PermissionsRecover a Redis pod that will not start on a MicroK8s cluster: read the failure, repair or restore the AOF and RDB files on the hostpath volume, and harden the deployment so it recovers by itself.

MicroK8s 1.32
Redis 7.2
StatefulSet

February

DevOps17 Feb 2025Jenkins: Build an Angular UI and Deploy It to S3 in Every RegionOne build, then a parallel deploy to regional S3 buckets and CloudFront with region-specific API URLs, approvals, smoke tests and rollback.

Jenkins 2.492 LTS
Angular 19
Node.js 22 LTS

DevOps3 Feb 2025Angular for Many Regions: Build Once, Configure at RuntimeAvoid one build per region: load the API URL and feature flags from a config file at startup, with the caching, validation and hosting setup that makes it safe.

Angular 19
Node.js 22 LTS
Amazon S3

January

AWS20 Jan 2025Azure to AWS Migration: Connectivity, Data and CutoverConnect the clouds, replicate servers and databases, copy files, then switch traffic with a rehearsed runbook and a rollback point.

AWS Application Migration Service
AWS DMS
AWS DataSync

AWS6 Jan 2025Azure to AWS Migration: Assessment and Service MappingPlan a migration before moving anything: discovery, dependency mapping, a service map, a wave plan and a landing zone, with the target architecture.

Microsoft Azure
AWS Application Discovery Service
AWS Migration Hub

202421 posts

December

AWS16 Dec 2024LocalStack with Terraform and GitHub Actions: Test Infrastructure Before AWSUse tflocal to apply Terraform against LocalStack, run it in a GitHub Actions job as a pre-merge check, and keep real AWS deployment as a separate gated step.

LocalStack 4.0
tflocal
Terraform 1.10

AWS2 Dec 2024LocalStack 4.0: A Local AWS Dev Environment with Docker and awslocalRun LocalStack in Docker Compose, use awslocal and SDKs against it, seed resources with init hooks, and know where a local emulator stops being accurate.

LocalStack 4.0
awslocal
Docker 27

November

Kubernetes18 Nov 2024MicroK8s 1.31: Three-Node HA, MetalLB, Ingress and Automatic TLSJoin three nodes into an HA cluster, give ingress a stable virtual IP with MetalLB, and issue Let's Encrypt certificates automatically with cert-manager.

MicroK8s 1.31
MetalLB
Ingress NGINX

Kubernetes4 Nov 2024MicroK8s 1.31 on Ubuntu 24.04: Install and Core Add-onsInstall a single-node MicroK8s 1.31 cluster, enable DNS, storage, ingress, metrics and RBAC, deploy a sample app, and learn upgrade and removal commands.

MicroK8s 1.31
Kubernetes 1.31
Ubuntu 24.04 LTS

October

Kubernetes15 Oct 2024Kafka Pod in CrashLoopBackOff: Finding the Cause and RecoveringA step-by-step method for a Kafka broker pod stuck in CrashLoopBackOff on Kubernetes: read the exit code and logs, then fix cluster ID mismatches, full disks, memory limits, bad listeners and corrupt logs.

Kafka 3.8 KRaft
Kubernetes 1.30
StatefulSet

September

DevOps30 Sept 2024PostgreSQL 17 Released: What Changed and a Safe Upgrade RunbookPostgreSQL 17.0 arrived on 26 September 2024. The features worth knowing, and a tested pg_upgrade plan with rollback for moving a 16 cluster.

PostgreSQL 17.0
pg_basebackup
pg_upgrade

DevOps2 Sept 2024PostgreSQL 16: Install, Secure and Tune on Ubuntu 22.04A production-minded PostgreSQL 16.4 install from the PGDG repository with scram authentication, pg_hba rules, memory tuning, pgBackRest backups and a streaming replica.

PostgreSQL 16.4
Ubuntu 22.04 LTS
pg_hba.conf

August

DevOps19 Aug 2024MongoDB 7.0: Replica Set, Failover and Backups You Can RestoreBuild a three-member replica set with a hidden backup member, set write concern correctly, and take and test backups with mongodump and point-in-time options.

MongoDB 7.0
Replica set
mongodump

DevOps5 Aug 2024MongoDB 7.0: Install on Ubuntu with Authentication and TLSInstall MongoDB 7.0 from the official repository, enable role-based access control, restrict network exposure, add TLS, and prepare the host properly.

MongoDB 7.0
mongosh 2.2
Ubuntu 22.04 LTS

July

Linux23 Jul 2024Elasticsearch 8 and Kibana on Ubuntu: Secure Single-Node SetupInstall Elasticsearch and Kibana 8.14 from the Elastic apt repository with security on by default, enrol Kibana, set heap and system limits, index some data and take a snapshot.

Elasticsearch 8.14
Kibana 8.14
Ubuntu 22.04 LTS

June

DevOps17 Jun 2024Kafka 3.7: Partitions, Replication, Consumer Groups and LagHow partitions, replication, min.insync.replicas and consumer groups fit together, with settings for safe producers, rebalancing and lag monitoring.

Apache Kafka 3.7
kafka-consumer-groups.sh
KRaft

DevOps3 Jun 2024Apache Kafka 3.7: Installing a KRaft Broker Without ZooKeeperInstall Kafka 3.7 in KRaft mode on Ubuntu with a systemd service, a safe data directory, a first topic, and the path from a single node to a production quorum.

Apache Kafka 3.7
KRaft
OpenJDK 17

May

DevOps14 May 2024Private npm Registry on an Ubuntu VM with Verdaccio and NginxHost a private npm registry with Verdaccio on Ubuntu 22.04: systemd service, Nginx with TLS, users and package access rules, upstream proxying, publishing and CI use.

Verdaccio 5
Node.js 20 LTS
Nginx

April

DevOps15 Apr 2024Redis 7.2: Install, Persistence, Security and Sentinel HAA hardened Redis 7.2 on Ubuntu 22.04 with ACL users, AOF and RDB persistence, memory limits, backups and a three-node Sentinel setup for failover.

Redis 7.2
Ubuntu 22.04 LTS
Redis Sentinel

DevOps1 Apr 2024Redis Licence Change and Valkey: What It Means for YouOn 20 March 2024 Redis moved future versions to source-available licences and the Linux Foundation announced Valkey. A practical look at what changes and how to decide.

Redis 7.2
Redis 7.4 licence change
Valkey

March

DevOps18 Mar 2024SonarQube: Scanning in CI and Enforcing Quality GatesRun sonar-scanner from Jenkins and GitLab CI with a token, fail builds on a quality gate, and set sensible gate conditions for new code.

SonarQube 10.4
sonar-scanner 5.0
Jenkins 2.440 LTS

DevOps4 Mar 2024SonarQube: Production-Style Install with Docker ComposeRun SonarQube Community Build behind a TLS proxy with an external PostgreSQL, correct kernel settings, backups and an upgrade path.

SonarQube 10.4 Community
PostgreSQL 15
Docker Compose 2.24

February

DevOps19 Feb 2024GitLab CI: Runners, Executors and a Real PipelineRegister Docker-executor runners with the current authentication-token workflow, write a build, test and deploy pipeline, and handle caching, tags and security.

GitLab 16.9
GitLab Runner 16.9
Docker 25.0

DevOps5 Feb 2024Installing GitLab CE on Ubuntu 22.04A self-managed GitLab using the Omnibus package, with HTTPS, SMTP, the container registry, scheduled backups, hardening and a safe upgrade routine.

GitLab CE 16.8
Ubuntu 22.04 LTS
Omnibus

January

Azure22 Jan 2024Azure Setup: Terraform azurerm and BicepTwo ways to describe Azure infrastructure as code, with remote state, a reviewed pipeline, what-if checks and the Terraform licence change.

Terraform 1.7
azurerm 3.x
Bicep

Azure8 Jan 2024Azure Setup: Azure CLI, Login and a First DeploymentInstall the Azure CLI on Ubuntu, sign in, deploy a locked-down VM in a resource group, and set up identities for automation without stored passwords.

Azure CLI 2.55
Ubuntu 22.04 LTS
Microsoft Entra ID

202321 posts

December

Azure18 Dec 2023Azure Basics: Virtual Networks and Virtual MachinesCreate a virtual network, subnet, network security group and Linux VM with the Azure CLI, connect without leaving SSH open, understand billing, disks and Azure Bastion.

Azure Virtual Network
Azure VM
NSG

Azure4 Dec 2023Azure Basics: Tenants, Subscriptions and Resource GroupsHow Azure organises identity, billing and resources, explained for someone who knows AWS: tenants, management groups, subscriptions, resource groups, RBAC scopes, policy, tags and a sensible starting layout.

Microsoft Azure
Microsoft Entra ID
Azure RBAC

November

DevOps21 Nov 2023Automating MySQL Dumps: Jenkins Through a Bastion to Local ServersA scheduled Jenkins pipeline that reaches a private MySQL server through a bastion host, takes a consistent dump, and copies it to local backup servers with retention and checks.

Jenkins 2.426 LTS
Declarative Pipeline
mysqldump

October

Docker17 Oct 2023Docker Compose Demo: MySQL and phpMyAdmin with a Persistent VolumeRun MySQL 8 and phpMyAdmin together with Docker Compose, with a named volume, a healthcheck, secrets kept out of the file, and a safe way to test that data survives.

Docker Engine 24
Docker Compose v2
MySQL 8.0

September

AWS18 Sept 2023CloudFormation: Change Sets, Drift and StackSetsPreview changes before applying them, detect manual edits with drift detection, protect stateful resources, and roll out a baseline to many accounts and regions with StackSets.

AWS CloudFormation
StackSets
Drift detection

AWS4 Sept 2023CloudFormation: Template Anatomy and a VPC ExampleLearn the sections of a CloudFormation template through a working VPC with public and private subnets, route tables, a conditional NAT gateway, intrinsic functions, outputs and linting.

AWS CloudFormation
cfn-lint 0.x
Amazon VPC

August

DevOps21 Aug 2023Ansible Dynamic Inventory for AWS EC2Let Ansible discover EC2 instances by tag with the aws_ec2 inventory plugin, build groups and host variables dynamically, use an IAM role, and connect through SSM Session Manager without opening SSH.

ansible-core 2.15
amazon.aws collection
boto3

DevOps7 Aug 2023Ansible: Roles, Variables and VaultOrganise playbooks into roles with defaults, handlers and templates, understand variable precedence, encrypt secrets with Ansible Vault and test roles before they reach production.

ansible-core 2.15
Ansible 8
Ubuntu 22.04 LTS

July

AWS18 Jul 2023AWS to On-Premises Tunnel: Site-to-Site VPN with strongSwanConnect a VPC to an on-premises network with an AWS Site-to-Site VPN, using a Ubuntu 22.04 box running strongSwan as the customer gateway, with route propagation and tests.

AWS Site-to-Site VPN
Virtual Private Gateway
strongSwan 5.9

June

DevOps19 Jun 2023Grafana 10: Alerting and Dashboards as CodeGrafana 10.0 was released on 12 June 2023. Provision alert rules, contact points, notification policies, data sources and dashboards from files in Git and avoid click-ops.

Grafana 10.0
Grafana Alerting
Provisioning

DevOps5 Jun 2023Installing Grafana 9.5 and Adding Data SourcesInstall Grafana OSS 9.5 on Ubuntu 22.04 from the official repository, secure it behind nginx with TLS and SSO, connect Prometheus and CloudWatch, and provision data sources and dashboards.

Grafana OSS 9.5
Prometheus 2.44
Ubuntu 22.04 LTS

May

DevOps22 May 2023Prisma Cloud: Image Scanning and IaC ChecksShift security left: scan container images with twistcli in CI, set pass/fail policy, run Checkov on Terraform and CloudFormation, handle suppressions and understand runtime Defenders.

Prisma Cloud Compute
twistcli
Checkov 2.3

DevOps8 May 2023Prisma Cloud: Onboarding an AWS AccountConnect AWS accounts to Prisma Cloud for posture management: a read-only cross-account role with an external ID, Monitor versus Monitor and Protect, organization onboarding, compliance standards and triage.

Prisma Cloud
CSPM
CloudFormation

April

DevOps17 Apr 2023Jenkins: Agents, Credentials and Configuration as CodeRun builds on separate SSH or inbound agents, manage credentials safely, and describe the Jenkins controller with Configuration as Code and a pinned plugin list so it can be rebuilt from Git.

Jenkins 2.387 LTS
Configuration as Code plugin
Docker 23.0

DevOps3 Apr 2023Installing Jenkins LTS on Ubuntu 22.04Install Jenkins 2.387 LTS with Java 17 from the stable repository, put nginx and TLS in front, change the port, harden the controller and plan upgrades and backups.

Jenkins 2.387 LTS
OpenJDK 17
Ubuntu 22.04 LTS

March

DevOps20 Mar 2023New Relic: NRQL Dashboards and AlertsQuery telemetry with NRQL, build a dashboard, and turn a query into an alert condition with sensible thresholds, signal-loss handling, workflows and muting rules.

New Relic One
NRQL
Alert conditions

DevOps6 Mar 2023New Relic: Infrastructure and APM AgentsInstall the New Relic infrastructure agent on a Linux host and the Node.js APM agent in an application, configure them safely, control data volume and troubleshoot missing data.

New Relic One
Infrastructure agent
Node.js agent

February

DevOps20 Feb 2023Bitbucket Pipelines: Build and Push an ImageA bitbucket-pipelines.yml that tests every pull request, builds and scans a Docker image on main, authenticates to AWS with OIDC and gates production deploys.

Bitbucket Pipelines
Docker 23.0
Node.js 18

DevOps6 Feb 2023Bitbucket Cloud: Repositories, Pull Requests and Branch RulesSet up a Bitbucket Cloud workspace so changes reach main only through review: workspaces and projects, SSH keys, Jira links, branch permissions, merge checks, CODEOWNERS-style default reviewers and recovery tips.

Bitbucket Cloud
Git 2.39
Jira

January

AWS23 Jan 2023S3 Now Encrypts New Objects by DefaultSince 5 January 2023 every new S3 object is encrypted at rest with SSE-S3. What changes, what stays your choice, how to use SSE-KMS and Bucket Keys, and how to enforce and audit it.

Amazon S3
SSE-S3
AWS KMS

DevOps9 Jan 2023Measuring DevOps with the Four Key MetricsDeployment frequency, lead time, change failure rate and time to restore: how to define them, collect them from Git, CI and incident data, read them honestly and avoid misuse.

DORA metrics
GitHub
CloudWatch

202224 posts

December

AWS19 Dec 2022Secrets Manager and KMSStore credentials in AWS Secrets Manager, read them with least-privilege roles, rotate them automatically and control the KMS keys behind them, with notes on Parameter Store and Kubernetes.

AWS Secrets Manager
AWS KMS
AWS CLI 2.9

AWS5 Dec 2022A Security Baseline for a New AWS AccountSwitch on CloudTrail, GuardDuty, Config, Security Hub and Access Analyzer, lock down root and S3, enforce encryption, and route findings to people who will act on them.

AWS CloudTrail
Amazon GuardDuty
AWS Config

November

AWS28 Nov 2022New AWS Region: Hyderabad (ap-south-2)AWS opened a second India region on 22 November 2022: how to enable the opt-in region, plan DR between Mumbai and Hyderabad, and what to verify before moving workloads.

AWS Region ap-south-2
AWS Region ap-south-1
AWS CLI 2.9

AWS7 Nov 2022Running Containers on ECS with FargateDeploy a container behind an Application Load Balancer on ECS Fargate: task definition, IAM roles, networking, autoscaling, circuit breaker rollbacks and debugging with ECS Exec.

Amazon ECS
AWS Fargate
Amazon ECR

October

DevOps17 Oct 2022CloudFormation and the AWS CDKUse CloudFormation stacks, change sets and drift detection, then write the same infrastructure in TypeScript with CDK v2, including bootstrapping, diffs and safe deletion policies.

AWS CloudFormation
AWS CDK v2
TypeScript

AWS3 Oct 2022RDS: Multi-AZ, Backups and RestoresRun a relational database on RDS with Multi-AZ failover, automated backups and snapshots, point-in-time restore, encryption, parameter groups and a tested recovery plan.

Amazon RDS
PostgreSQL 14
MySQL 8.0

September

AWS19 Sept 2022SQS, SNS and EventBridge: Which to UseThree AWS messaging services compared with a fan-out design, dead-letter queues, FIFO ordering, idempotent consumers, filtering, retries and monitoring.

Amazon SQS
Amazon SNS
Amazon EventBridge

AWS5 Sept 2022DynamoDB BasicsTables, keys, indexes, capacity modes, consistency, TTL, point-in-time recovery and single-table design thinking, with CLI examples and common pitfalls.

Amazon DynamoDB
AWS CLI 2.7
Region ap-south-1

August

AWS15 Aug 2022AWS SSO Is Now IAM Identity CenterSet up single sign-on across AWS accounts with groups, permission sets and short-lived credentials, and use it from the CLI instead of IAM users and long-lived keys.

IAM Identity Center
AWS Organizations
AWS CLI 2.7

DevOps1 Aug 2022Ansible: Configure Servers Without Logging InInventories, idempotent playbooks, variables, handlers, templates, roles and Vault with ansible-core 2.13, plus safe rollout and troubleshooting.

ansible-core 2.13
Python 3.10
Ubuntu 22.04 LTS

July

DevOps18 Jul 2022Terraform Remote State and Locking on AWSStore Terraform state in a hardened S3 bucket with DynamoDB locking, bootstrap it safely, split states by environment and recover from locks and corruption.

Terraform 1.2
Amazon S3
Amazon DynamoDB

DevOps4 Jul 2022Terraform: Infrastructure as Code BasicsWrite, plan and apply AWS resources with Terraform 1.2: providers, variables, outputs, modules, the plan and apply workflow, drift, imports and safe practices.

Terraform 1.2
AWS provider 4.x
Region ap-south-1

June

AWS20 Jun 2022Lambda Function URLsExpose a Lambda function over HTTPS without API Gateway: create a function URL, choose the auth type, set CORS, secure it with IAM, and know when API Gateway is still better.

AWS Lambda
Python 3.9
AWS CLI 2.7

DevOps6 Jun 2022Jenkins: A Declarative PipelineWrite a declarative Jenkinsfile with stages, agents, credentials, parallel steps, post actions and approvals, and run Jenkins safely with a shared library and ephemeral agents.

Jenkins 2.332 LTS
Java 11
Pipeline plugin

May

DevOps16 May 2022Continuous Integration with GitHub ActionsBuild a CI workflow with caching, a test matrix, least-privilege permissions, concurrency control, container image builds and keyless deployment to AWS using OIDC.

GitHub Actions
actions/checkout v3
Node.js 16

DevOps2 May 2022A Git Workflow That Teams Can FollowTrunk-based development with short-lived branches, pull requests and protected main: commands, branch protection, commit conventions, and how to recover from mistakes.

Git 2.36
GitHub
Branch protection

April

Kubernetes18 Apr 2022Getting Ready for Dockershim Removal in 1.24Kubernetes 1.24 removes dockershim. How to find nodes and workloads that depend on Docker Engine, migrate to containerd, and the cri-dockerd alternative.

Kubernetes 1.23
containerd 1.6
Kubernetes 1.24

Kubernetes4 Apr 2022Back Up etcd Before You UpgradeTake and verify an etcd snapshot, back up certificates, and run a kubeadm minor upgrade with drain, uncordon and a tested rollback plan on Kubernetes 1.23.

kubeadm 1.23
etcd 3.5
Kubernetes 1.23

March

Kubernetes21 Mar 2022Troubleshooting Pods: A Short ChecklistA decision-tree approach to Pending, ImagePullBackOff, CrashLoopBackOff, OOMKilled, probe failures and stuck Terminating pods, with the exact kubectl commands to use.

Kubernetes 1.23
kubectl 1.23
kubectl debug

Kubernetes7 Mar 2022A Managed Cluster on Amazon EKSCreate a production-shaped EKS cluster with eksctl: managed node groups, IAM roles for service accounts, add-ons, access control, logging, cost and upgrades.

Amazon EKS 1.21
eksctl 0.8x
Region ap-south-1

February

Kubernetes21 Feb 2022Monitoring a Cluster with kube-prometheus-stackInstall the kube-prometheus-stack Helm chart, understand ServiceMonitors and PrometheusRules, add your own app and alerts, size storage and retention, and manage CRD upgrades.

kube-prometheus-stack
Prometheus Operator
Grafana 8

Kubernetes7 Feb 2022GitOps with Argo CDDeploy to Kubernetes from Git with Argo CD 2.2: repository layout, Applications, automated sync with prune and self-heal, projects, RBAC, secrets and rollbacks.

Argo CD 2.2
Kubernetes 1.23
Git

January

Kubernetes24 Jan 2022Free TLS Certificates with cert-managerInstall cert-manager 1.6, configure Let's Encrypt issuers for HTTP-01 and DNS-01 challenges, issue certificates from Ingress annotations, and debug the request chain.

cert-manager 1.6
Let's Encrypt
Kubernetes 1.23

Kubernetes10 Jan 2022StatefulSets for Databases and QueuesWhat a StatefulSet guarantees, how to build a PostgreSQL primary and replicas safely, the storage, upgrade and failure behaviour to understand, and when to use an operator instead.

Kubernetes 1.23
StatefulSet
PostgreSQL 14

202124 posts

December

Kubernetes20 Dec 2021Log4Shell and Your ContainersFind, fix and contain the Log4j vulnerability (CVE-2021-44228) across container images and Kubernetes workloads, with a timeline of fixes and what is still uncertain.

Log4j 2.17.0
CVE-2021-44228
Trivy

Kubernetes13 Dec 2021Kubernetes 1.23: What ChangedThe Kubernetes 1.23 release: stable HPA v2, dual-stack networking, Pod Security Admission in beta, CSI migration and the road to removing dockershim in 1.24.

Kubernetes 1.23
Pod Security Admission beta
HPA autoscaling/v2

November

Kubernetes15 Nov 2021Network Policies: Default DenyReplace the open Kubernetes pod network with explicit allow rules: default-deny policies, DNS exceptions, namespace and pod selectors, testing, and CNI requirements.

Kubernetes 1.22
NetworkPolicy
Calico 3.20

Kubernetes1 Nov 2021RBAC and Service AccountsControl who and what can do which actions in a Kubernetes cluster: Roles, bindings, service accounts, token behaviour in 1.22, and an audit routine.

Kubernetes 1.22
rbac.authorization.k8s.io/v1
ServiceAccount

October

Kubernetes18 Oct 2021Autoscaling Pods with the HPAInstall metrics-server, configure a HorizontalPodAutoscaler on CPU and memory, tune scaling behaviour, and combine it with node autoscaling and load testing.

Kubernetes 1.22
metrics-server 0.5
autoscaling/v1

Kubernetes4 Oct 2021Helm: Packaging and Installing ApplicationsUse Helm 3 to install, configure, upgrade and roll back applications, write a small chart of your own, and avoid the common release-management mistakes.

Helm 3
Kubernetes 1.22
Chart.yaml

September

Kubernetes20 Sept 2021IngressClass and ingress-nginx 1.0What changed in ingress-nginx 1.0: the Ingress v1 API, IngressClass resources, the deprecated annotation, and a safe upgrade path from 0.x.

ingress-nginx 1.0
Kubernetes 1.22
IngressClass

Kubernetes6 Sept 2021Persistent Volumes and ClaimsHow PersistentVolumes, PersistentVolumeClaims, StorageClasses and CSI drivers work, with dynamic provisioning on EKS-style clusters, expansion, snapshots and backup practice.

Kubernetes 1.22
CSI
StorageClass

August

Kubernetes23 Aug 2021Ingress: One Entry Point for Many ServicesRoute HTTP and HTTPS traffic to many Services through one load balancer using the networking.k8s.io/v1 Ingress API and ingress-nginx, with TLS and path rules.

Kubernetes 1.22
Ingress networking.k8s.io/v1
ingress-nginx 0.49

Kubernetes9 Aug 2021Kubernetes 1.22: Removed APIs to Fix Before UpgradingKubernetes 1.22 removes several long-deprecated v1beta1 APIs including Ingress and CustomResourceDefinition. How to find what you use, convert manifests and Helm charts, and plan the upgrade.

Kubernetes 1.22
kubectl-convert
pluto

July

Kubernetes19 Jul 2021Health Probes and Resource RequestsConfigure liveness, readiness and startup probes correctly, set requests and limits from measurements, and understand QoS classes, throttling and evictions.

Kubernetes 1.21
Startup probe GA
metrics-server

Kubernetes5 Jul 2021ConfigMaps and SecretsSeparate configuration from images with ConfigMaps and Secrets, choose between env vars and mounted files, use immutable objects, and understand what Secrets do and do not protect.

Kubernetes 1.21
Immutable ConfigMaps GA
Secrets

June

Kubernetes21 Jun 2021Services and Cluster DNSHow Services give pods a stable address, the four Service types, headless Services and cluster DNS naming, with a debugging routine for traffic that does not arrive.

Kubernetes 1.21
CoreDNS 1.8
kube-proxy

Kubernetes7 Jun 2021Pods and DeploymentsWrite a production-shaped Deployment: labels, rolling updates, resources, security context, scaling, rollouts and rollbacks, plus how pods really behave.

Kubernetes 1.21
apps/v1 Deployment
ReplicaSet

May

Kubernetes17 May 2021A Local Cluster in a Minute with kindRun a real multi-node Kubernetes cluster inside Docker for learning and CI, with port mappings for ingress, local image loading, and clean teardown.

kind 0.10
Kubernetes 1.20 node image
kubectl 1.21

Kubernetes3 May 2021Kubernetes Architecture in One PageThe control plane, nodes and objects of a Kubernetes 1.21 cluster, what happens when you run kubectl apply, and where each component fails.

Kubernetes 1.21
containerd
etcd 3.4

April

AWS19 Apr 2021Cost Visibility: Budgets, Cost Explorer and TagsA practical cost routine for AWS: tagging, budgets, Cost Explorer views, anomaly detection and the usual suspects behind surprise bills.

AWS Budgets
AWS Cost Explorer
Cost Anomaly Detection

AWS5 Apr 2021IAM Roles for EC2: No Keys on ServersGive applications on EC2 temporary AWS permissions through instance profiles, scope policies tightly, require IMDSv2, and remove long-lived access keys.

AWS IAM
Instance profile
AWS CLI 2.1

March

AWS22 Mar 2021Serving Traffic: ALB and Route 53Put an Application Load Balancer with HTTPS in front of EC2 or containers, issue a free ACM certificate, point Route 53 at it, and set health checks and redirects.

Application Load Balancer
Amazon Route 53
AWS Certificate Manager

Docker8 Mar 2021Prometheus and Grafana with Docker ComposeRun Prometheus, node_exporter, cAdvisor and Grafana with Compose, write scrape configs and a first alert rule, provision the data source as code, and plan retention and security.

Prometheus 2.25
node_exporter 1.1
Grafana 7.4

February

AWS22 Feb 2021CloudWatch Container Insights for ECSTurn on Container Insights for ECS clusters on Fargate or EC2, understand the metrics and performance logs, build alarms and dashboards, and control the cost.

Amazon ECS
CloudWatch Container Insights
AWS Fargate

Docker8 Feb 2021Docker Logging and Resource LimitsStop containers from filling disks or exhausting the host: log drivers and rotation, memory, CPU and PID limits, OOM kills and how to see usage.

Docker Engine 20.10.3
json-file log driver
local log driver

January

AWS25 Jan 2021VPC Basics: Subnets, Routes and NATDesign a VPC for Mumbai with public and private subnets across two Availability Zones, route tables, an internet gateway, NAT gateways, endpoints and flow logs.

Amazon VPC
Internet Gateway
NAT Gateway

Docker11 Jan 2021Scanning Images for Vulnerabilities with TrivyScan container images and file systems with Trivy, fail CI builds on serious findings, handle unfixed and accepted risks, and keep the scan database fresh.

Trivy 0.14
Docker Engine 20.10.2
alpine:3.12

202024 posts

December

AWS28 Dec 2020re:Invent 2020: Changes Worth KnowingThe announcements from AWS re:Invent 2020 that affect everyday DevOps work: storage, containers, Lambda and security, with what to try or change first.

Amazon S3
Amazon EBS gp3
AWS Lambda

Docker14 Dec 2020Docker 20.10 and the Kubernetes dockershim NoticeWhat Docker Engine 20.10 adds, what the Kubernetes 1.20 deprecation of Docker as a runtime does and does not mean, and how to check your clusters.

Docker Engine 20.10
Kubernetes 1.20
containerd

November

AWS16 Nov 2020S3 Basics: Buckets, Versioning and Public AccessCreate buckets that are private, encrypted and recoverable: Block Public Access, bucket policies, versioning, lifecycle rules, logging and the consistency behaviour to know about.

Amazon S3
AWS CLI 2.0
Region ap-south-1

Docker2 Nov 2020Docker Hub Pull Limits Start TodayDocker Hub's pull rate limits take effect on 2 November 2020. How the limits work, how to check your remaining pulls, and practical fixes for CI, servers and clusters.

Docker Hub
Docker Engine 19.03.13
registry-mirrors

October

AWS19 Oct 2020CloudWatch Logs and Logs InsightsSend application logs to CloudWatch, set retention, turn log lines into metrics, and query them quickly with Logs Insights for incidents and reports.

CloudWatch Logs
CloudWatch Logs Insights
CloudWatch Agent

Docker5 Oct 2020Multi-Stage Builds and BuildKitBuild small, safer images by separating the build toolchain from the runtime, and speed up builds with BuildKit caching, secrets and parallel stages.

Docker Engine 19.03.13
BuildKit
golang:1.15

September

AWS21 Sept 2020CloudWatch Agent: Memory and Disk MetricsInstall the unified CloudWatch agent on Amazon Linux 2 with the right IAM role, collect memory, disk and swap metrics, store config in SSM, and alarm on them.

CloudWatch Agent
Amazon Linux 2
IAM role CloudWatchAgentServerPolicy

Docker7 Sept 2020Docker Compose for Multi-Container AppsDescribe a web app, cache and database in one file with networks, volumes, health checks and environment files, and run it reliably on a single host.

Docker Compose 1.26
Docker Engine 19.03.12
Redis 6

August

AWS17 Aug 2020CloudWatch Metrics and AlarmsUnderstand what CloudWatch collects for EC2 by default, create alarms with SNS notifications, handle missing data, and use auto-recovery and composite alarms.

Amazon CloudWatch
Amazon EC2
Amazon SNS

Docker3 Aug 2020Docker Volumes and NetworksKeep data safe with volumes and bind mounts, connect containers with user-defined networks and DNS, and publish ports without exposing more than you intend.

Docker Engine 19.03.12
PostgreSQL 12
overlay2

July

AWS20 Jul 2020Launching Your First EC2 InstanceLaunch, secure and connect to an Amazon Linux 2 instance in Mumbai with the CLI, including key pairs, security groups, IMDSv2 and clean-up.

Amazon EC2
Amazon Linux 2
t2.micro

AWS6 Jul 2020Installing and Configuring AWS CLI v2Install the self-contained AWS CLI v2 on Ubuntu 20.04, configure named profiles and safer credentials, and use queries and waiters for scripting.

AWS CLI 2.0
Ubuntu 20.04 LTS
IAM

June

AWS15 Jun 2020First Steps in a New AWS AccountSecure the root user, create an admin identity, set a password policy, turn on billing alerts and budgets, and choose a region before you launch anything.

AWS IAM
AWS Billing
AWS Budgets

Docker1 Jun 2020Writing Your First DockerfileBuild a small Node.js image properly: layer caching, .dockerignore, a non-root user, health checks and the habits that keep images small and safe.

Docker Engine 19.03.9
Node.js 12 LTS
node:12-alpine

May

Docker18 May 2020Images and Containers: The First Ten CommandsThe core Docker commands for pulling images, running and inspecting containers, reading logs, getting a shell, cleaning up, and the mental model behind them.

Docker Engine 19.03.9
Docker Hub
nginx 1.18

Docker4 May 2020Installing Docker on Ubuntu 20.04Install Docker Engine from the official repository, run it as a service, give users access safely, set sane logging defaults and verify the installation.

Ubuntu 20.04 LTS
Docker Engine 19.03.8
containerd

April

Linux27 Apr 2020Ubuntu 20.04 LTS Is Out: What ChangedWhat Ubuntu 20.04 LTS (Focal Fossa) brings for servers, what changed from 18.04, and a sensible plan for when and how to upgrade.

Ubuntu 20.04 LTS
Linux kernel 5.4
systemd 245

Linux6 Apr 2020Quality of Life: ~/.ssh/config and tmuxFaster, safer SSH with per-host config, jump hosts and multiplexing, and tmux sessions that survive disconnects.

Ubuntu 18.04.4 LTS
OpenSSH 7.6
tmux 2.6

March

Linux16 Mar 2020Debugging with strace, lsof and tcpdumpThree tools that show what a process really does: system calls, open files and network packets, with worked examples for common production mysteries.

Ubuntu 18.04.4 LTS
strace 4.21
lsof 4.89

Linux2 Mar 2020SELinux and AppArmor in Plain TermsHow mandatory access control adds a second layer behind file permissions, how to diagnose denials on CentOS and Ubuntu, and fix them without turning protection off.

CentOS 7.7
SELinux
Ubuntu 18.04.4 LTS

February

Linux17 Feb 2020Updates, Kernels and LivepatchA patching routine for Ubuntu servers: security updates, kernel and reboot handling, the HWE kernel, Livepatch, and how to roll back safely.

Ubuntu 18.04.4 LTS
Linux kernel 5.3 HWE
unattended-upgrades

Linux3 Feb 2020Performance Triage: Load, CPU, Memory and DiskA repeatable five-minute method for finding which resource is the bottleneck, using vmstat, iostat, sar and pidstat, plus how to read the numbers.

Ubuntu 18.04.3 LTS
sysstat 11.6
procps-ng 3.3.12

January

Linux20 Jan 2020LVM: Growing a Volume Without DowntimeHow physical volumes, volume groups and logical volumes fit together, and a safe runbook for extending a mounted filesystem when a disk is full.

Ubuntu 18.04.3 LTS
LVM2 2.02
ext4

Linux6 Jan 2020Python 2 Reaches End of LifeWhat the end of Python 2 means for servers and scripts, how to find every use of it, and a safe migration plan with testing and fallbacks.

Ubuntu 18.04.3 LTS
Python 3.6
CentOS 8.1

201916 posts

December

Linux16 Dec 2019Backups with rsync and tarBuild a simple, restorable backup routine with tar and rsync: what to back up, how to rotate copies, how to verify them, and how to restore without surprises.

Ubuntu 18.04.3 LTS
rsync 3.1
GNU tar 1.29

Linux2 Dec 2019Host Firewalls: ufw and firewalldDefault-deny rules on Ubuntu with ufw and on CentOS with firewalld, safe rule testing over SSH, zones, rate limiting and how cloud security groups fit in.

Ubuntu 18.04.3 LTS
ufw 0.36
CentOS 7.7

November

Linux18 Nov 2019Logs: /var/log, journalctl and logrotateKnow where the important logs live, read them effectively, and configure rotation and retention so logs help you instead of filling the disk.

Ubuntu 18.04.3 LTS
rsyslog 8.32
logrotate 3.11

Linux4 Nov 2019Scheduling Jobs: cron and systemd TimersWrite reliable cron entries, understand why jobs that work in a terminal fail under cron, prevent overlapping runs, and compare cron with systemd timers.

Ubuntu 18.04.3 LTS
cron 3.0
systemd 237

October

Linux21 Oct 2019Shell Scripting BasicsVariables, conditions, loops, functions and exit codes, with the strict-mode header, quoting rules and logging pattern that make scripts safe to run on servers.

Ubuntu 18.04.3 LTS
bash 4.4
ShellCheck 0.4

Linux7 Oct 2019SSH Keys and a Safer sshdReplace passwords with keys, harden sshd_config safely without locking yourself out, restrict users, and add basic brute-force protection.

Ubuntu 18.04.3 LTS
OpenSSH 7.6
CentOS 7.7

September

Linux16 Sept 2019Networking Basics: ip, ss, dig and NetplanA layer-by-layer method for diagnosing connectivity: addresses, routes, listening ports and DNS, plus how to set a static IP on Ubuntu 18.04 and CentOS 7.

Ubuntu 18.04.3 LTS
Netplan
iproute2 4.15

Linux2 Sept 2019Managing Services with systemdStart, stop, enable and debug services, read their logs, write a hardened unit file with restart policy, and use drop-ins instead of editing vendor files.

Ubuntu 18.04.3 LTS
systemd 237
CentOS 7.6

August

Linux19 Aug 2019Disks and Mounts: lsblk, fdisk, mkfs and fstabAdd a new disk safely: identify it, partition, create ext4, mount it persistently by UUID, and avoid the fstab mistakes that stop a server booting.

Ubuntu 18.04.3 LTS
util-linux 2.31
ext4

Linux5 Aug 2019Text Processing: grep, sed, awk and PipesChain small tools to answer real questions about logs and configuration: count errors, find top clients, edit files safely and format reports.

Ubuntu 18.04.2 LTS
GNU grep 3.1
GNU sed 4.4

July

Linux15 Jul 2019Processes: ps, top and SignalsSee what is running, find what is consuming CPU and memory, understand process states, and stop processes in the right order using signals.

Ubuntu 18.04.2 LTS
procps-ng 3.3.12
CentOS 7.6

Linux1 Jul 2019Installing Software: apt on Ubuntu, yum on CentOSHow package managers, repositories and signatures work, the daily commands on both families, and how to add third-party repositories without weakening the system.

Ubuntu 18.04.2 LTS
apt 1.6
dpkg

June

Linux17 Jun 2019Reading and Setting File PermissionsWhat rwxr-xr-x really means, how chmod, chown and umask work together, and the special bits that explain odd permission problems.

Ubuntu 18.04.2 LTS
coreutils 8.28
CentOS 7.6

Linux3 Jun 2019Users, Groups and sudoCreate users and groups, grant exactly the access they need through sudo, lock accounts, and audit who can do what on Ubuntu and CentOS.

Ubuntu 18.04.2 LTS
sudo 1.8.21
CentOS 7.6

May

Linux20 May 2019Moving Around the Shell: ls, cd, find and FriendsThe commands that cover daily navigation, safe habits for deleting and copying, and the bash 4.4 shortcuts that save the most time.

Ubuntu 18.04.2 LTS
bash 4.4
GNU coreutils 8.28

Linux6 May 2019Where Things Live: The Linux Filesystem HierarchyA map of the directories on every Linux server, what belongs in each, how mounts fit in, and the commands that show you where space and files really are.

Ubuntu 18.04.2 LTS
Linux kernel 4.15
CentOS 7.6