Ansible first_found: predictable host and environment config fallback
Use ansible.builtin.first_found to select host, group, environment, and default configuration files in an explicit, testable order.
AnsibleConfig ManagementRolesAutomation
Working notes
Answers I do not want to rediscover twice.
Concise references from real troubleshooting, grouped so the useful detail is easy to find when the pressure is on.
Automation
2 notesOpen note →
Extend upstream Ansible roles without maintaining a fork
Wrapper roles help keep upstream roles clean while adding your own deployment logic, files, and operational flow.
AnsibleRolesMaintainabilityAutomation
AWS
1 notesAWS SSO login: configure and verify a CLI profile
Configure an AWS CLI SSO profile, sign in with IAM Identity Center, select the correct account and role, and verify the active identity before running commands.
AWS SSOIAM Identity CenterAWS CLIProfile
CI/CD
1 notesGitHub Actions OIDC to AWS: fix AssumeRoleWithWebIdentity AccessDenied
Diagnose AWS AssumeRoleWithWebIdentity AccessDenied in GitHub Actions by checking token permissions, audience, role ARN, and IAM trust-policy subject claims.
GitHub Actions OIDCAWS IAMAssumeRoleWithWebIdentityAccessDenied
Cloud Security
1 notesIAM naming convention: make access reviews faster and safer
Build an IAM naming convention that exposes environment, system, access level, and ownership so access reviews require less guesswork.
IAMAccess ReviewCloud SecurityCompliance
Cloudflare
2 notesTest a Cloudflare origin without changing proxied DNS
Separate Cloudflare edge failures from origin failures using DNS inspection, curl --resolve, the correct Host header, and controlled origin access.
CloudflareDNSProxyOrigin
Cloudflare WAF allowlist: scope exceptions by hostname and path
Create narrow Cloudflare WAF skip rules using hostname, source IP lists, path, owner, and expiry instead of bypassing security for an entire zone.
CloudflareWAFAccess ControlDNS
Compliance
1 notesAudit evidence collection: design logging, backup, and access proof early
Automate audit evidence collection for logging, monitoring, backups, restore tests, access reviews, and changes before an auditor requests samples.
ComplianceISO 27001PCI DSSLogging
Containers
1 notesDocker no space left on device: identify usage before pruning
Resolve Docker no space left on device safely by measuring images, containers, volumes, build cache, logs, and inodes before deleting recoverable data.
Docker Disk SpaceNo Space Left on Devicedocker system dfDocker Prune
DevSecOps
1 notesSonarQube quality gate failed in GitHub Actions: debug the gate
Diagnose a SonarQube quality gate failure in GitHub Actions by separating scanner execution, analysis processing, new-code conditions, and pipeline enforcement.
SonarQube Quality GateGitHub ActionsDevSecOpsCode Coverage
Engineering Practice
1 notesInfrastructure handover checklist: make operations repeatable
Use an infrastructure handover checklist covering ownership, architecture, deployment, observability, access, backup, rollback, and known risks.
InfrastructureMaintainabilityOperationsDocumentation
GCP
1 notesService account key creation is blocked: check organization policy first
When service account key creation is blocked, the reason may be an organization policy even if project-level IAM looks correct.
GCPIAMOrganization PolicyService Account
GitOps
2 notesArgo CD rollback: revert Git instead of patching with kubectl
Roll back an Argo CD application by reverting the failing Git commit, verifying the diff, and letting reconciliation restore the declared state.
ArgoCDGitOpsRollbackKubernetes
Argo CD application stays OutOfSync after sync: find the real diff
Diagnose an Argo CD application that remains OutOfSync by inspecting live-versus-desired diffs, generated fields, mutating controllers, Helm output, and ownership.
Argo CD OutOfSyncGitOpsKubernetesHelm
Kubernetes
5 notesPodMonitor exists but the target is missing: trace selector discovery
Debug a missing Prometheus target by following the selector chain from Prometheus to PodMonitor, pod labels, and the named metrics port.
KubernetesPrometheusPodMonitorObservability
Kubernetes CrashLoopBackOff: debug the actual container failure
Diagnose Kubernetes CrashLoopBackOff by checking pod events, previous container logs, exit codes, probes, configuration, and resource limits in order.
CrashLoopBackOffkubectlPod DebuggingContainer
Kubernetes ImagePullBackOff: fix image name and registry authentication
Fix Kubernetes ImagePullBackOff by reading Pod events, validating the image reference, and checking private-registry credentials in the correct namespace.
ImagePullBackOffimagePullSecretsContainer Registrykubectl
Kubernetes Pod Pending: troubleshoot insufficient CPU and memory
Diagnose Kubernetes Pods stuck Pending by reading scheduler events and checking requests, taints, affinity, storage, quotas, and autoscaler capacity.
Pod PendingInsufficient CPUInsufficient MemoryScheduler
cert-manager Certificate Ready False: trace CertificateRequest and ACME
Troubleshoot cert-manager Certificate Ready False by following Certificate, CertificateRequest, Order, and Challenge resources instead of repeatedly deleting Secrets.
cert-managerCertificate Ready FalseLet's EncryptACME Challenge
Malware Lab
1 notesRepeated EICAR tests stop alerting: check clamd caching and file events
When the first EICAR test alerts but identical retries do not, separate ClamAV scan caching from file-event and SIEM ingestion behavior.
ClamAVEICARMalware TestCache
Observability
2 notesGrafana shows no data: reduce the query before changing collection
Before changing exporters or scrape configs, confirm whether the issue is actually the Grafana query, variable, or label filter.
GrafanaPrometheusPromQLDashboard
Prometheus target down: debug context deadline exceeded
Diagnose Prometheus targets showing context deadline exceeded by checking the rendered scrape URL, DNS, network policy, TLS, authentication, and exporter latency.
Prometheus Target DownContext Deadline ExceededServiceMonitorNetworkPolicy
Operations
1 notesBackup restore testing: prove RTO, RPO, and data integrity
Run an isolated backup restore test, validate application and data integrity, and measure whether recovery meets the required RTO and RPO.
BackupRestoreReliabilityDisaster Recovery
Terraform
1 notesTerraform error acquiring the state lock: recover without state damage
Resolve Terraform state lock errors by identifying active runs, verifying the backend and workspace, waiting safely, and using force-unlock only as a last resort.
Terraform State LockError Acquiring State Lockforce-unlockRemote State
Wazuh
2 notesWazuh FIM reached its file limit: reduce noise before raising it
Review noisy and low-value paths before increasing file_limit on busy Linux servers or container hosts.
WazuhFIMLinuxTuning
Wazuh custom rule does not trigger: start with the real event
Before changing rule logic repeatedly, test custom rules with real log samples and confirm the matched decoder or base rule.
WazuhRulesDecoderTesting