All posts on infrastructure, automation and systems, newest first.
A playbook written by one person works exactly as long as that person stays at the company. A few structural rules that let the next administrator understand it within an hour.
A single flat network is simple until the first incident. Five segments are enough for most organisations, provided that policy stands between them and not just a VLAN number.
Two hundred alerts a day means nobody reads any of them. How to design alerts so that each one requires action, and the one at three in the morning is actually worth it.
You do not need to buy a privileged access management system to stop logging on to workstations with a domain administrator account. Three tiers, separate accounts and a few Group Policy settings are enough.
The ticket says „the network is down”, and the network is fine. Name resolution is not. Where DNS hides single points of failure, and how to design it so that the failure of one element goes unnoticed.
A Docker daemon in the pipeline means a privileged container with access to the host. There are tools that build images from the same Dockerfile without that cost; they differ in what they demand from the cluster.
A script executes steps. GitOps maintains state. That difference decides what happens when somebody changes something on the cluster by hand.
Publishing a strict policy in one day ends with your own invoices and newsletters being rejected. Sender authentication is rolled out in a specific order, with reports as the guide.
The backup job finishes with a green status every night, and yet the restore can still fail. How to define what "we have a backup" means, and how to check it regularly.
A snapshot of a domain controller's virtual machine is not a backup of the directory. Which Active Directory failure scenarios require what, and what a full forest recovery looks like when no working domain controller is left.
Ansible is a good tool for many things and a poor one for a few. A list of situations where it is the right choice, and where it is better left alone.
Two ways for updates to hurt: never install them, or install them on every machine on the same day. Deployment rings spread the risk across stages, and each stage is a gate for the next.
Creating an account, granting access, a new virtual machine: fifteen minutes of work and two days of waiting. How to connect the ticketing system to the automation platform so that the request fulfils itself.
Collecting everything every second gives thousands of time series and zero answers. A small set of metrics that answers the questions „is it working” and „why not”, plus rules for storing them.
Three nodes and etcd are not enough to call a cluster highly available. The points that break most often in small Kubernetes clusters, and how to design around them.
A message caught by a filter does not always generate a notification. Whether the user ever finds out depends on the quarantine policy assigned to the filter that caught it.
Twenty repositories and twenty copies of the same CI file, each slightly different. How to move the logic into one template and leave projects only what really sets them apart.
A central log system without a strategy becomes an expensive warehouse of noise. How to decide which events reach the central system, in what form, and for how long.
The second link is often bought, plugged in and never tested. How to design the switchover so that it works on the day of the outage, and what will not switch by itself even with a perfect configuration.
Group Policy and an endpoint management tool can set the same things. The trouble starts when they do it at the same time. A split of responsibility that can actually be maintained.
A GitOps-managed cluster can be rebuilt from scratch in an hour. That does not mean it needs no backups: it needs them for exactly the things the repository does not contain.
Containers have not replaced virtual machines and will not. How to split workloads between classic virtualisation and a container platform without ideology.
Older applications, printers and scripts send mail to port 25 with no encryption and no authentication. A cloud mail service will not accept that. One internal relay solves the problem better than twenty exceptions.
Every workstation prepared by hand is different, and the differences show up at the first ticket. How to split a workstation into layers so that any machine can be rebuilt in an hour with no human involved.