DevOps & Automation
guides.

DevOps & Automation articles

38 guides

• Argo CD Pruning and Self-Heal: Define What Git Is Allowed to Delete or Restore ↗

  Review Argo CD automated sync, pruning, self-healing, stateful resources, and database migrations with a recovery plan that goes beyond reverting a Git commit.

• Ansible Check Mode: Understand What a Clean Simulation Has Not Proven ↗

  Use Ansible check and diff modes with module support, registered-variable dependencies, secret-safe output, and a real canary change that verifies service behaviour.

• Terraform Import and Drift: Decide Which Configuration Owns an Existing Resource ↗

  Adopt existing infrastructure in Terraform with clear ownership, controlled provider versions, reviewed configuration, and a plan that avoids accidental changes.

• OpenTofu State Encryption: Test Key Recovery Before Enabling the Policy ↗

  Prepare OpenTofu state and plan encryption with protected backups, pipeline key access, migration sequencing, and a recovery drill from a clean environment.

• Jenkins Agent Loss: Retry Infrastructure Failures Without Repeating External Actions ↗

  Use Jenkins retry conditions and durable release records to recover from agent loss or controller restart without repeating uncertain external actions.

• GitLab Resource Groups: Serialise Deployments and Stop Older Pipelines Winning Later ↗

  Choose GitLab resource-group process modes, coordinate downstream pipelines, and prevent stale releases from deploying after newer candidates are accepted.

• GitHub Actions Re-runs: Preserve the Original Commit and Every Mutable Build Input ↗

  Review GitHub Actions re-run identity, original commit behaviour, mutable dependencies, artifact retention, and safe release continuation after partial failure.

• Ansible Rolling Updates: Coordinate serial, Delegation, and Shared Load-Balancer Changes ↗

  Build Ansible rolling updates with explicit batch size, delegated load-balancer actions, shared-state concurrency control, and per-host verification.

• Terraform Backend Migration: Preserve State Identity Across Workspaces and Recovery ↗

  Plan Terraform backend migration with writer coordination, state backups, workspace inventory, access validation, and a plan that preserves resource identity.

• Terraform create_before_destroy: Check Names, Quotas, and Dependencies Before Replacement ↗

  Review Terraform create_before_destroy against unique names, temporary capacity, dependency behaviour, and stateful cutover requirements before applying a plan.

• GitLab cache and artifacts: define the build handoff ↗

  Separate reusable dependency caches from required build artifacts, then verify job dependencies, cache keys, expiry and protected-branch behavior.

• Jenkins credentials: inspect binding and shell boundaries ↗

  Use Jenkins credential bindings with narrow scope, safe shell expansion and isolated execution while verifying what masking does and does not cover.

• Actions environments: verify branch and target mapping ↗

  Connect workflow triggers, environment restrictions and server destinations so each branch reaches its intended deployment target with the right configuration.

• Actions artifacts: promote the verified build identity ↗

  Bind deployment artifacts to their source run, commit and digest, then enforce the acceptance checks required before promotion.

• GITHUB_TOKEN permissions: trace the event and job ↗

  Diagnose Actions authorization with event context, repository policy and job permissions while keeping untrusted pull-request code outside privileged execution.

• GitHub Actions concurrency: choose the queue contract ↗

  Choose GitHub Actions concurrency behavior for builds and deployments, then verify pending-run replacement, queueing and cancellation against release needs.

• Ansible Vault and no_log: Protect the Runtime Boundary ↗

  Keep vaulted values protected after decryption by reviewing task output, registered results and callback logs. Verify behavior with synthetic secrets.

• Ansible Become: Verify the User That Runs the Task ↗

  Separate the connection user from Ansible's become identity. Test a scoped read-only task and check escalation policy without weakening host permissions.

• Ansible Inventory: Trace the Winning Variable Value ↗

  Find why an Ansible host receives an unexpected variable by following inventory sources, group hierarchy and host overrides with nonsecret diagnostic values.

• Terraform Outputs: Design a Consumer Contract ↗

  Publish a small, stable Terraform output contract for downstream jobs. Review root outputs, versioning and the full-state access implied by remote-state readers.

• Terraform Drift: Review Before Adding ignore_changes ↗

  Separate observed drift from intended configuration changes with a refresh-only plan. Use ignore_changes only for a documented shared-ownership boundary.

• Terraform Provider Aliases: Verify Module Wiring ↗

  Trace a module's provider configuration from root alias to child resource. Prevent accidental use of the default endpoint when managing multiple environments.

• Terraform Sensitive Values: Protect State and Plans ↗

  Understand what sensitive hides and what Terraform still stores. Review state, saved plans, output formats and CI handling using synthetic validation data.

• Known After Apply: Trace Terraform Unknown Values ↗

  Understand when Terraform unknown values are normal and when they prevent planning. Keep collection shape known while passing computed attributes as values.

• Terraform for_each: Keep Resource Keys Stable ↗

  Prevent avoidable resource churn by choosing stable for_each map keys. Review address changes separately from edits to each resource's configuration values.

• Terraform Preconditions: Choose a Blocking Guardrail ↗

  Choose between variable validation, preconditions, postconditions and check blocks. Test a small guardrail with harmless input before depending on it in a release.

• Terraform Import Blocks: Review the First Managed Plan ↗

  Bring an existing resource into Terraform with an import block and a reviewed plan. Check object identity, generated configuration and unintended lifecycle changes.

• PHP OPcache Releases: Verify the Running Code Lifecycle ↗

  Investigate stale PHP behavior after deployment by checking the web runtime, timestamp validation and release activation across every application instance.

• Ansible handlers: make configuration activation visible to validation ↗

  Diagnose Ansible handler timing and change notifications so configuration checks run against the intended active service state rather than an earlier process.

• Terraform moved blocks: refactor addresses without accidental replacement ↗

  Plan Terraform resource and module renames with explicit address moves, state evidence and environment-by-environment review before applying a refactor.

• Terraform provider lockfiles: make workstation and CI selection reproducible ↗

  Resolve Terraform provider checksum and platform differences by reviewing constraints and the dependency lockfile instead of deleting reproducibility controls.

• GitLab Protected Environments: Review Who Can Release ↗

  Review GitLab protected environments, deployment permissions and production approval paths. Test intended release access without confusing branch protection with environment control.

• GitHub Actions OIDC: Restrict the Cloud Trust Boundary ↗

  Plan GitHub Actions OIDC with specific repository and environment trust conditions. Test approved and denied workflows before retiring long-lived deployment credentials.

• Ansible Check Mode: Understand What the Preview Proves ↗

  Use Ansible check and diff modes with module-specific expectations, protected output and representative hosts. Validate changes beyond a successful preview.

• Terraform State Locking: Handle a Busy Workspace Safely ↗

  Review Terraform state locking, concurrent pipeline behavior and stale-lock recovery. Build a team workflow that protects shared infrastructure changes.

• Keep environment boundaries clear. ↗

  Give development, testing and production distinct configurations and responsibilities.

• Infrastructure your team can understand. ↗

  Use infrastructure as code to make changes visible, reviewable and repeatable.

• Make every release more predictable. ↗

  Reliable delivery begins with a repeatable process and clear environment boundaries.