Hot Tips
Short, specific technical tips across Kubernetes, Terraform, networking, security, observability, and CI/CD.
kubectl debug --copy-to creates a throwaway pod
kubectl debug pod/mypod -it --image=busybox --copy-to=debug-pod spins up a disposable copy pod with your debug image attached, leaving the original pod completely untouched.
Readiness probes gate traffic, liveness probes restart
A failing readiness probe just removes the pod from Service endpoints; a failing liveness probe kills and restarts the container. Mixing up the two causes silent traffic loss or unnecessary restarts.
PodDisruptionBudgets do not stop node crashes
A PDB blocks voluntary evictions like kubectl drain and cluster autoscaler scale-downs, but does nothing against involuntary disruptions like a node crashing or OOM-killing the kubelet.
terraform plan -refresh=false skips a slow drift check
By default every plan re-reads real infrastructure state first. Skipping the refresh with -refresh=false speeds up iterative work, but can plan against stale state.
lifecycle prevent_destroy blocks even a full destroy
Setting prevent_destroy = true on a resource blocks terraform destroy and any plan that would replace it — you must remove the flag first, even for an intentional teardown.
moved blocks rename resources without a destroy/recreate
A moved block tells Terraform a resource was renamed or moved between modules, updating state in place instead of destroying and recreating the real infrastructure.
MTU mismatches show up as random large-packet timeouts
A tunnel or overlay network with a lower MTU than the host can silently drop large packets, since ICMP fragmentation-needed messages are often blocked — small requests work, large payloads hang.
SYN floods and slow clients look identical in netstat
A high count of connections stuck in SYN_RECV can mean a SYN flood attack or just a burst of real slow clients — check source IP diversity before assuming it is malicious.
DNS TTL of 0 does not mean instant propagation
Many resolvers and clients cache records for a minimum interval regardless of a 0 or very low TTL, so a DNS cutover can still take minutes to fully propagate.
IMDSv2 blocks the classic SSRF-to-credentials attack
IMDSv1 lets any process (including one exploited via SSRF) fetch instance credentials with a plain GET; IMDSv2 requires a session token from a PUT first, which most SSRF payloads cannot forge.
A 0.0.0.0/0 security group rule is not always public
If the security group only attaches to a private-subnet resource with no public IP or NAT path, 0.0.0.0/0 in the rule is unreachable from the internet — check the real network path, not just the rule.
Short-lived tokens still need revocation, not just expiry
A stolen token with a 15-minute lifetime is still valid for the full 15 minutes unless you can actively revoke it — short expiry limits blast radius, it does not replace incident response.
High cardinality labels can silently blow up Prometheus
A label like user_id or request_id adds one new time series per unique value — combine a few such labels on one metric and the multiplication can reach millions of series fast enough to exhaust memory.
p99 latency can look fine while a slice of users still suffers
If traffic is bimodal (most requests fast, a distinct slow path), p99 can sit below your SLO while a meaningful minority of real users hit the slow path every time.
Trace sampling at the edge can hide the request you need
Head-based sampling decides whether to keep a trace before it knows the outcome — the slow, error-prone request you actually want to debug is the one most likely to get sampled out.
A green pipeline does not mean that build is what is deployed
CI can report success on a build and deploy step while a later manual rollback or hotfix leaves production on a different artifact — pipeline status is not deployed status.
Pinned Docker base image tags are not immutable
A tag like node:20 can be repointed to a new image by its publisher at any time; only a digest reference (node@sha256:...) guarantees the exact same bytes on every build.
Cache poisoning in CI often looks like a flaky test
A build cache keyed too loosely (e.g. by branch name instead of lockfile hash) can serve stale dependencies across unrelated commits, showing up as an intermittent test failure.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.