The network is the layer everything else stands on, and yet it is usually designed once and not revisited for years. I write about segmentation that limits the impact of an incident, about DNS as a single point of failure, about firewalls between segments, and about link redundancy in organisations that have no dedicated network team.
Error 26 after a server restart means the client could not determine the port of a named instance. Where the driver gets the name, port and protocol, when SQL Browser on UDP 1434 is needed, and why current drivers require a trusted server certificate.
Static routes are enough as long as every subnet has a single path. When BGP pays off with several branches and backup VPN tunnels, why OSPF usually does not, and which safeguards to set from day one.
The API address jumps between nodes, and the network plugin, controllers and DNS restart in its wake. How to tell a kube-vip problem from slow etcd, the network or node resources, and what to change so the address stops moving.
A VPN account for a vendor gives them access to the whole network, with no record of what they did, and often for years after the contract ends. A gateway with session recording, time-limited Active Directory accounts and MFA restrict access to specific machines and a specific time window.
Without any network policy, every pod in the cluster can connect to every other pod. How to introduce default deny per namespace, allow DNS, traffic from the ingress controller and to the database, and not take the applications down in the process.
Three control plane nodes achieve nothing if clients connect to the API at the address of one of them. Three ways to keep a shared address, their configuration, a certificate with the right names, and how to check who really uses the address.
A single flat network is simple until the first incident. A zone plan with example subnets, a matrix of allowed flows and a test showing that management ports cannot be reached from workstations or the guest network.
The ticket says “the network is down”, yet the network is fine and only names fail to resolve. Where DNS hides single points of failure, and how to check clients, DHCP, forwarders and in-cluster DNS.
The second link is often bought, plugged in and never tested. How to set up link health checks, what happens to VPN, telephony and exposed services during failover, and how to test it.
Older applications, printers and scripts send mail to port 25 with no encryption and no authentication. A comparison of the ways to connect them to Microsoft 365 and a Postfix relay configuration that replaces twenty exceptions.