In-Depth Guides & Analysis
Deep technical dives into cloud architecture, Kubernetes, CI/CD pipelines, and infrastructure best practices.
Showing 1-30 of 117 articles
Page 1 of 4
How to Give Applications AWS Credentials Without Storing Any
Every long-lived access key in your account is a copy waiting to leak, and no amount of rotation discipline fixes that. The alternative is to have no key at all, because each place an application normally needs credentials already has a mechanism that hands it fresh ones on demand. This walks through instance profiles on EC2, task roles on ECS, EKS Pod Identity and IRSA on Kubernetes, and OIDC federation for a CI pipeline, with the trust policy shape for each. It also covers the one condition in the CI trust policy that decides whether the whole thing is secure or theatre.
Read articleHow to Reach a Private RDS Without a Bastion Host
A jump host with a public IP and an open SSH port is the most commonly attacked thing in a lot of AWS accounts, and it exists only so somebody can occasionally run a query. Systems Manager forwards a local port through a managed node to any host that node can reach, so the database stays in its private subnet and nothing accepts inbound connections. This covers the exact command, the agent version and permissions it needs, how it works with no NAT gateway at all, and how to drop the stored database password as well.
Read articleHow to Recover an EC2 Instance You Can No Longer SSH Into
When a box stops answering there is an order to work through, and two of the options only exist if somebody enabled them on a calm afternoon months earlier. This covers what the status checks are telling you, reading console output, the serial console and everything it needs configured in advance, and the volume detach and reattach route as the last resort. The part worth reading before you need it is which mechanisms have prerequisites, because that decides what is available to you at 2am.
Read articleHow to Make an S3 Bucket That Cannot Be Deleted by Accident
Protecting a bucket against a mistake and protecting it against a stolen credential are two different jobs, and the settings that do one do not do the other. This walks through versioning, MFA delete and Object Lock in both of its modes, what each one can and cannot be undone by, and where an attacker with the right permission walks straight through your protection. Several of these settings cannot be reversed once enabled, including one where AWS says the only remaining way to delete the data is to close the account, so the warnings sit next to the commands.
Read articleHow to Stop Paying for NAT Gateway Traffic You Do Not Need
A large share of NAT gateway spend on a typical account is traffic to AWS services that could have reached those services privately, and it shows up as one anonymous line on the bill. This shows how to tell AWS-bound traffic from internet-bound traffic in Cost Explorer, how to find the exact destination in flow logs, and which endpoint type actually removes the charge. It also covers the traps, including why a bucket in another Region keeps going out through the NAT after you add the endpoint.
Read articleHow to Set Up Budgets and Anomaly Detection Before the Bill Surprises You
Finding out about a spend problem from the invoice means finding out weeks late. AWS gives you two different mechanisms for catching it earlier, and they are not interchangeable. A budget fires when a number you chose is crossed, while Cost Anomaly Detection models what your spend normally looks like and tells you when the shape changes. This walks through setting up both from the CLI, the delay each one carries between the spend happening and the alert arriving, who should be on which notification, and the charges neither one will catch for you.
Read articleHow to Choose Between ALB, NLB and CloudFront for Your Traffic
The three services sit at different layers, accept different protocols, and a handful of the choices you make when you create them cannot be changed afterwards. This is what each one is actually for, where the protocol list makes the decision for you, the two cases where the right answer is a pair of them working together, and the settings that mean rebuilding rather than editing if you get them wrong.
Read articleHow to Run Multi AZ So It Actually Survives an AZ Failure
Most AWS accounts are multi AZ on paper already, and then a zone has a bad day and the site goes down anyway. Spreading a deployment across zones and keeping it serving when one disappears are two different properties. This covers what the managed services really do during a zone failure, including which failovers reset every open connection and how long each one takes, the single points that quietly survive a multi AZ design, and the commands to rehearse all of it on purpose.
Read articleHow to Migrate a Server to AWS Without a Big Bang Cutover
A big bang cutover is a plan with exactly one attempt in it. The incremental version costs a little more elapsed time and keeps a working rollback available until the very last step. This walks through the inventory that decides whether the cutover is clean, continuous replication that runs while the old server keeps serving, a dress rehearsal you can repeat, the DNS time to live arithmetic you have to do backwards from the cutover date, and the single action that ends the rollback window for good.
Read articleHow to Set Up Least Privilege IAM Without Blocking Your Own Team
Least privilege earns its reputation for costing a week of tickets whenever someone writes the minimal policy first and discovers what was missing by breaking people's work. The order that avoids that is the reverse. Cap the blast radius, let the team work, collect evidence about what was actually used, and tighten against the evidence. This covers the AWS reporting that supplies the evidence, exactly what data each report is built from and what it silently omits, and the checks that catch an over-tightened policy before it ships.
Read articleHow to Upgrade PostgreSQL Major Versions With Almost No Downtime
An in-place major upgrade takes your database down for as long as the upgrade runs, and once it has started there is no way back. Logical replication turns that into a cutover you can measure in seconds, with the old server still consistent and still able to take traffic if the first minute goes badly. The method works because the new server is built and caught up while the old one keeps serving. The risk is entirely in what logical replication declines to carry across, so this guide spends most of its time on sequences, DDL, large objects and tables without a replica identity.
Read articleHow to Change a Schema on a Busy MySQL Table Without Locking It
A plain ALTER on a large InnoDB table can hold up every writer until it finishes, which on a busy table means an outage nobody scheduled. Modern MySQL does far more instantly than most teams realise, so the first job is checking whether you need a tool at all. When you do, the copy-and-swap approach builds a shadow table, keeps it in step from the binary log, and swaps the two at the end. This guide covers what the table has to look like for that to work, and how to stop a migration safely once it is running.
Read articleHow to Run Ephemeral CI Runners on Your Own Hardware
A build that passes because of something left behind by the previous build is not a passing build, it is a coincidence. Ephemeral runners remove that class of problem by giving every job a machine that has never run anything else. GitHub supports this directly through single-use runner registration and just-in-time configuration, so the runner deregisters itself after one job and your automation disposes of the host. This guide covers both approaches, the Kubernetes version, and the one situation where self-hosted runners are the wrong answer.
Read articleHow to Keep a Build Cache That Survives Ephemeral Runners
Throwing away the runner after every job is the right call, and it costs you the build cache unless the cache lives somewhere else. On GitHub Actions it already does, which means the real work is writing keys that hit instead of keys that always miss. This guide covers restore-keys and how partial matching actually resolves, the hidden part of a cache key that nobody sets, why a cache saved on a feature branch is invisible to main, and what to do when a bad cache entry starts poisoning every run.
Read articleHow to Handle Secrets in CI Without Leaking Them Into Logs
The safest credential in your pipeline is the one that does not exist between jobs. OpenID Connect lets a workflow authenticate directly to a cloud provider and receive a token that expires on its own, which removes the stored key entirely. Masking is the backstop for everything left over, and it is worth knowing exactly where it stops working, because it relies on finding an exact match for the value. This guide covers the short-lived credential setup, the limits of redaction, and what to actually do in the ten minutes after a secret reaches a log.
Read articleHow to Restore One Table From a Full Cluster Backup
Somebody emptied one table and the rest of the database is still taking orders. Restoring the whole backup over production would throw away every write since the dump, to fix damage that lives in a single table. This is the side restore instead, with the format choice that decides whether selective restore is even possible, the pg_restore flags that behave differently from the pg_dump ones you know, and the foreign keys and sequences that turn a successful restore into a broken application an hour later.
Read articleWhat a Real Disaster Recovery Drill Looks Like on a Tuesday
A recovery plan gets tested one of two ways, on a Tuesday morning with a scenario and a stopwatch, or at three in the morning with a customer on the phone. This is the first version, run in working hours and announced in advance, because the failures worth finding are missing documents and expired credentials rather than whether anyone can be woken up. What to scope, the four numbers to measure, what counts as a pass, and the failures a drill turns up nearly every time.
Read articleHow to Patch on a Schedule Without a Maintenance Window
A quarterly maintenance window means three months of known vulnerabilities waiting for a Saturday night, and then forty machines changing at once while everyone is asleep. Patching continuously and restarting in waves gets fixes on faster and removes the outage entirely. Here is the configuration that actually applies updates rather than only downloading them, how the machine tells you whether a reboot is genuinely required, and how to build waves so no two hosts behind the same load balancer ever go down together.
Read articleHow to Read a CVE and Decide in Ten Minutes If It Touches You
An alarming headline and a severity score are not a decision, and the score cannot become one because the part of it that would describe your environment is the part nobody filled in. This is the ten minute route from a CVE number to a defensible answer, covering what the scoring specification actually says, why your installed version number may be lying about whether you are patched, and which public sources report real exploitation rather than the possibility of it.
Read articleHow to Configure Varnish for Magento So It Stops Caching the Wrong Thing
Varnish in front of Magento serves anonymous pages without touching PHP. The wrong Varnish in front of Magento serves one shopper's cart to everybody, which is worse than having no cache at all. Magento generates its own configuration and most of the work is using that rather than something copied from a forum. This covers what the generated file refuses to cache and why, how invalidation actually works as a ban rather than a purge, the two ways it silently fails, and how to prove a page came from cache.
Read articleHow to Back Up and Restore etcd Before You Need It
A verified etcd snapshot is the difference between a control plane you rebuild in twenty minutes and a cluster you reassemble from memory over a weekend. This walks through taking a snapshot on a self-managed cluster, proving the file is actually restorable rather than merely present, and bringing a cluster back that no longer comes up. It also covers the commands that moved between binaries in recent etcd releases, because the old ones are the ones everybody copies.
Read articleHow to Run Postgres on Kubernetes With Point in Time Recovery
A nightly dump cannot answer the question that actually gets asked after an incident, which is to put the database back the way it was at 10.42, just before the migration ran. Continuous archiving can. This is an operator based setup on Kubernetes with base backups and write ahead log shipped to object storage, plus recovery to a named timestamp. It also flags the configuration change that makes most copied CloudNativePG YAML out of date.
Read articleHow to Set Requests and Limits From Real Usage Instead of Guesses
Copied resource blocks cause two expensive problems at once, pods killed for memory they never used and latency nobody can explain. This shows how to read what your workloads actually consume, how CPU throttling shows up in metrics, and why a CPU limit and a memory limit are completely different decisions. The result is a set of numbers you can defend in a review instead of numbers that were inherited from a tutorial.
Read articleHow to Run Cron in Kubernetes So Jobs Never Overlap or Vanish
Scheduled work in Kubernetes fails in two quiet ways, a slow job that starts a second copy of itself and a schedule that silently stops firing. Both are configuration, not luck. This covers the CronJob fields that control concurrency, missed schedules, history retention and failure handling, with the actual defaults, so the nightly billing run is still there in the morning and there is a log to read when it is not.
Read articleHow to Do Canary Releases Without a Service Mesh
You can send five percent of production traffic at a new version, watch the error rate, and roll back in seconds without installing a service mesh. This walks through replica weighted canaries with a progressive delivery controller, real percentage splitting at the edge, an automated pass or fail check against Prometheus, and the rollback path. It also covers what changed when Kubernetes retired Ingress NGINX in March 2026.
Read articleHow to Keep a WooCommerce Checkout Up on Black Friday
Ten times the traffic barely troubles a WooCommerce catalogue and takes the checkout down. The reason is that the catalogue is served from a page cache while the cart, the checkout and the account pages cannot be, so every one of those requests boots WordPress and hits the database. This guide walks through what WooCommerce itself excludes from caching, which cookies and AJAX endpoints have to be routed past the cache, where the cart and the order actually get stored, and how to turn the checkout ceiling into a number you can size instead of a surprise you discover on the day.
Read articleHow to Cut LCP With an Image Pipeline Without Touching the Theme
On most content and commerce pages the Largest Contentful Paint element is a single image, which means one image decides the score. This guide covers the decisions that belong to the delivery layer rather than to a template, from format negotiation on the Accept header to the size actually credited by the metric, the priority the browser assigns to an image before layout, and the one attribute that quietly ruins a hero. Every attribute here is checked against the HTML standard or web.dev, including which images must never be lazy loaded.
Read articleHow to Write Alerts That Wake a Human Only When a Human Is Needed
An on-call rota fails long before anyone quits, at the moment the team stops reading the pages. This guide covers the three changes that keep that from happening: alerting on what a customer can feel rather than on a cause, replacing threshold pages with burn rate alerts against an objective, and grouping so that one incident produces one notification. It ends with a query that tells you which of your alerts nobody has acted on, and what to do with them.
Read articleHow to Run OpenTelemetry on a Small Cluster Without a Vendor Bill
A self-hosted OpenTelemetry path is genuinely within reach for a team that does not want its observability metered by somebody else. This guide covers the parts that matter, starting with what the collector actually does with a pipeline, then the difference between running it as an agent and as a gateway, where traces, metrics and logs can land, and how to work out how much disk a retention window needs before you commit to it. Every component name and default here is checked against the OpenTelemetry and backend documentation.
Read articleHow to Set SLOs and Error Budgets for a Team of Five
Reliability targets written for a company of a thousand do not survive contact with a team of five. This guide keeps the arithmetic and drops the ceremony, working through how to pick one or two objectives a customer would actually notice, how to turn a percentage into minutes and into a count of failed requests, and how to use the remaining budget to settle the argument about whether to ship the feature or fix the bug. Every calculation is shown so you can check it against your own numbers.
Read article