Tutorials
Kubernetes Control Plane Certificate Expiry: A Runbook
When API Server access suddenly breaks with x509 errors; certificate renewal and safe recovery steps for kubeadm-based clusters.
Tutorials
280 posts
Step-by-step guides, practical examples and hands-on tutorials.
Tutorials
A Maintenance-Wave Runbook for Firmware Upgrades on Enterprise…
A runbook that turns firmware upgrade work into a repeatable maintenance rhythm with inventory, ring/wave approach, validation metrics, and a rollback…
Tutorials
A Safe Migration Runbook from iptables to nftables
Reduce risk while moving production firewall rule sets from iptables to nftables using observability, wave-based rollout, and fast rollback.
Tutorials
SLO-Driven Load Testing with k6: Capacity Baselines and Release Gates
A practical approach that turns load testing from a peak-RPS race into an SLO-driven (latency/error) capacity baseline and a CI release gate.
Tutorials
A WORM Backup Layer Runbook with S3 Object Lock
Practical steps for building a WORM (Write Once Read Many) layer against ransomware and accidental deletion using S3 Object Lock, retention policies, and…
Tutorials
An NTS and NTP Hardening Runbook with chrony
A practical chrony runbook for enterprise servers covering secure NTP (NTS), access restrictions, verification commands, and alarm thresholds.
Tutorials
GitOps Secrets Management with SOPS + age
A practical SOPS + age setup and operational discipline for keeping encrypted secrets in Git and decrypting them safely inside CI/CD and the cluster.
Tutorials
Kubernetes RBAC: Least Privilege + Break-Glass Model
A practical RBAC framework for role design, identity integration, and time-boxed emergency access (break-glass) without depending on cluster-admin.
Tutorials
Server Inventory and Security Signals with FleetDM + osquery
Turn 'what's on which server?' into a living inventory; a guide for scaling osquery queries with FleetDM into operational and security signal.
Tutorials
Phased Hardening of Kubernetes with PSA + Kyverno
Roll out security guardrails in production clusters gradually with Pod Security Admission (PSA) and Kyverno: an audit→warn→enforce plan.
Tutorials
AAA on Network Devices with TACACS+: Command Authorization and Audit
A TACACS+ approach that reduces local admin sprawl on network devices and turns session traces into proof through roles, command authorization, and accounting.
Tutorials
Kubernetes ETCD Quorum Loss: Triage and Recovery Runbook
A runbook for quickly diagnosing ETCD quorum during API 5xx/timeout storms and walking through safe recovery steps via snapshot restore.
Tutorials
SSH + FIDO2: Phishing-Resistant Admin Access (Practical Runbook)
Hardening admin access with OpenSSH security keys (ed25519-sk) using PIN + touch confirmation, while keeping break-glass scenarios intact.
Tutorials
Kubernetes Admission Webhook Timeouts: A Runbook for Frozen Deploys
Field runbook to rapidly triage hung deploys caused by Validating/Mutating webhook latency and apply a risk-controlled mitigation.
Tutorials
A Pre-Validation Pipeline for Network Changes with Batfish
A practical Batfish flow that validates routing/ACL changes before they reach production via 'snapshot + question set,' catching human error early.
Tutorials
Workload Identity and mTLS with SPIFFE/SPIRE
A guide to wiring service-to-service mTLS through SPIFFE identities and SPIRE-issued short-lived certificates instead of relying on IPs and static secrets.
Tutorials
Short-Lived SSH Certificates with an OpenSSH CA
An OpenSSH CA-based approach to set up auditable, time-bound SSH access in place of shared bastion accounts and long-lived keys.
Tutorials
Hardening Services with systemd Sandboxing (ProtectSystem…
Constrain services into a tighter permission set without changing the application itself: filesystem, capability, syscall, and network limits.
Tutorials
Protecting the Kubernetes Control Plane with API Priority and Fairness
A practical APF setup that prioritizes critical traffic and fairly queues noisy callers, lowering the risk of API server overload.
Tutorials
Network Drift with NetBox + Nornir: An Approval-Driven Remediation…
Detect configuration drift, approve fixes through Git, and apply them under control: source of truth → report → PR → rollout.
Tutorials
Designing Maintenance Waves for Kubernetes Node OS Patching
Roll out node patches in maintenance waves rather than all-at-once: drain, PDB, parallelism, and a safe rollback path.
Tutorials
Cgroup v2 Memory Pressure Runbook with systemd-oomd
PSI, systemd-oomd policy, testing, and recovery steps to catch a node OOM crisis early and evict workloads in a controlled way.
Tutorials
Fast Failover with BFD on FRR: A Practical Guide
An approach to enabling BFD with FRR (BGP/OSPF) to generate fast signals when the link looks up but traffic isn't flowing (blackhole).
Tutorials
Privileged Command Monitoring Runbook on Linux with Auditd
A practical approach that makes privileged operations observable and auditable in production using sudo, auditd rules, and log forwarding.