Build an HAProxy health check around a meaningful dependency contract
HTTP health checks send a configured request and compare protocol, status, and optional content before changing backend health state.
Read HAProxy timers and termination state before blaming a backend
HAProxy HTTP logs can expose queue, connect, response, total timers, status, retries, and termination state for each request.
Enable HAProxy PROXY protocol only when both peers agree
The PROXY protocol prepends connection metadata before application bytes; the sender and receiver must agree on version and trust boundary.
Drain one HAProxy backend server through the runtime API
The runtime API can change live server administrative state and weight without editing the static configuration, so persistence across reload must be planned separately.
Build an HAProxy stick-table rate limit with bounded memory
Stick tables retain keyed counters for a configured size and expiry; ACLs compare those counters to policy before allowing a request.
Set HAProxy timeouts from protocol phases instead of one large number
Connect, client, server, queue, tunnel, and HTTP request timeouts cover different phases and produce different termination evidence.
Install an HAProxy TLS certificate bundle with chain and key checks
HAProxy loads a certificate, matching private key, and intermediates for a bind; SNI selects among configured certificates during the handshake.
Proxy WebSockets through HAProxy with tunnel-aware timeouts
An HTTP Upgrade handshake switches a connection to bidirectional tunnel behavior, after which tunnel timeout and backend liveness govern the session.
Use ip route get to prove the Linux route for one destination
Ip route get asks the kernel how it would route a specific flow, including source address, interface, gateway, table, and policy results.
Use kubectl auth can-i to test the exact Kubernetes RBAC question
Kubectl auth can-i asks authorization for a verb, resource, namespace, and optional impersonated identity; it does not prove admission or application behavior.
Use kubectl debug without replacing the failing pod too early
Kubectl debug can add an ephemeral container, create a modified pod copy, or create a node debugging pod; each mode has a different evidence and privilege boundary.
Debug kubectl port-forward from API tunnel to pod listener
Kubectl port-forward asks the API path to carry a local TCP connection to a pod or selected resource; the target process must still listen on the forwarded pod port.
Cordon and drain a Kubernetes node without violating availability
Cordon blocks new scheduling while drain evicts eligible pods through the eviction API; controllers and disruption budgets determine replacement behavior.
Create a Kubernetes image pull secret without exposing registry credentials
An imagePullSecret stores registry authentication for the kubelet to fetch images; namespace, ServiceAccount attachment, and secret type determine whether it is used.
Design a PodDisruptionBudget around real serving capacity
A PodDisruptionBudget limits voluntary disruptions for selected healthy pods; it does not create replicas or protect against involuntary node failure.
Use Kubernetes priority and preemption without starving ordinary workloads
PriorityClass affects scheduling order and may allow a pending high-priority pod to preempt lower-priority pods when no feasible node has capacity.
Use kubectl rollout undo with image, config, and schema awareness
Rollout undo changes a workload controller to a previous recorded revision; it does not reverse database, external configuration, or irreversible side effects.
Resolve Kubernetes server-side apply conflicts by field owner
Server-side apply tracks which manager owns each field; a conflict means another manager currently owns a different value for the field being applied.
Spread Kubernetes pods across failure domains without making them unschedulable
Topology spread constraints compare matching pod counts across eligible domains and can reject scheduling or permit skew depending on whenUnsatisfiable.
Add a Linux audit rule that produces useful evidence without flooding
Audit rules select kernel events by syscall, path, fields, and key; ordering and never rules can suppress later matches.
Replace setuid root with the narrow Linux capability actually required
Capabilities divide traditional root privilege into independently checked units that can be attached to a file or bounded in a service process.
Inspect Linux conntrack pressure before raising the limit
Connection tracking records flow state for firewall and NAT decisions; usage, timeout mix, and packet rate explain pressure better than one maximum value.
Recover a read-only Linux filesystem without forcing unsafe writes
The kernel may remount a filesystem read-only to contain damage; recovery starts with preserving logs and identifying the device, not forcing remount-rw.
Open a Linux firewall port only after proving the listener and path
A usable port requires a process listener, correct bind address, route, firewall admission, and often an upstream cloud or provider rule.