The foundational guide to infrastructure as code in 2026 — the declarative model and why the state file is the hard part, the Terraform BUSL license change and the OpenTofu fork, real configuration and workflow, remote state and locking after the DynamoDB era, modules, the broader landscape from Pulumi to Crossplane, and the failure modes nobody warns you about.
Infrastructure-as-Code
-
Infrastructure as Code in 2026: Terraform, OpenTofu, and the State You Have to Manage -
AWS CDK Deep Dive Construct levels L1/L2/L3, stacks and environments, custom constructs, CDK Pipelines, escape hatches, testing, and an honest CDK vs Terraform comparison.
-
AWS IAM: Permission Boundaries, SCPs, and Least Privilege at Scale IAM policy evaluation logic, permission boundaries, Service Control Policies, IAM Access Analyzer, ABAC with tags, and the common misconfigurations that lead to privilege escalation.
-
AWS Networking Deep Dive: VPCs, Transit Gateway, and PrivateLink A practical guide to AWS network design: CIDR planning that won't strand you later, subnet layout by tier and AZ, security groups vs NACLs, VPC peering vs Transit Gateway vs PrivateLink decision framework, NAT Gateway patterns, and Route 53 Resolver for private DNS and hybrid environments.
-
AWS Systems Manager: Beyond Parameter Store Session Manager for SSH-free access, Run Command for fleet operations, Patch Manager, Automation runbooks, State Manager for configuration drift, and the full no-bastion-host architecture.
-
Cloud Cost Engineering: FinOps Without the Buzzwords A practical guide to cloud cost engineering: commitment discounts (Savings Plans vs Reserved Instances vs Spot), tagging governance for real cost allocation, rightsizing with Compute Optimizer, hunting idle and zombie resources, data transfer costs that hide in plain sight, storage tier optimization, and the organizational work that matters more than any tool.
-
Crossplane: Kubernetes-Native Cloud Infrastructure Managed Resources, Composite Resources, Claims, XRDs, and Compositions in depth. Provider auth, composition functions, ArgoCD integration, and an honest comparison with Terraform.
-
etcd: The Brain of Kubernetes What lives in etcd, Raft consensus and quorum, backup and restore with etcdctl/etcdutl, compaction and defragmentation, the NOSPACE alarm, sizing guidelines, and the disaster recovery playbook.
-
HAProxy Deep Dive: Load Balancing, ACLs, and SSL Termination at Scale The HAProxy configuration DSL from first principles: frontends, backends, ACL-based routing, all load balancing algorithms, stick tables for rate limiting, SSL termination with automatic certificate renewal, the runtime API, and Prometheus observability — all without a sidecar.
-
HashiCorp Packer: Golden AMIs and Immutable Infrastructure HCL2 build templates, multi-builder parallelism, provisioners, post-processors, HCP Packer lineage tracking, and building a production AMI pipeline in GitHub Actions.
-
Karpenter: Kubernetes Node Autoscaling Done Right A practical guide to Karpenter: how it differs from cluster-autoscaler, NodePool and EC2NodeClass configuration, Spot instance handling with automatic fallback, consolidation and disruption budgets, weighted NodePools for multi-tier workloads, GPU node provisioning, drift detection, and the operational patterns that reduce your EC2 bill.
-
Terraform at Scale: Modules, Remote State, and the Drift Problem A practical guide to running Terraform in production: S3 remote state with native locking, workspace vs directory-based environment separation, module versioning strategies, Terragrunt for DRY configuration, drift detection in CI, moved blocks for safe refactoring, and state surgery when things go sideways.
-
ZFS for the Homelab: Storage That Doesn't Lie A practical guide to ZFS on Linux: pool layout decisions (RAIDZ vs mirrors), dataset properties, snapshot strategies, send/receive replication for offsite backup, scrub scheduling, and ARC tuning for systems where RAM is not unlimited.
-
Nix and NixOS: Reproducible Infrastructure from the Ground Up Declarative system configuration, the Nix store, flakes, home-manager, and why 'it works on my machine' becomes irrelevant — along with an honest account of where Nix makes your life harder before it makes it better.
-
Writing a Kubernetes Operator: The Complete Pattern Custom Resource Definitions, controllers, reconciliation loops, finalizers, status conditions, and building a real operator with controller-runtime that manages a stateful workload — with every pattern you need to do it right.
-
Ansible Playbooks: Idempotent Configuration Management at Any Scale A comprehensive guide to Ansible for sysadmins, DevOps engineers, and homelabbers — covering installation, inventory management, playbook anatomy, Jinja2 templating, roles, Ansible Vault, and practical playbooks for bootstrapping servers, deploying Docker apps, and running bulk OS updates.
-
Terraform for the Homelab: Manage Local and Cloud Resources with One Workflow A comprehensive guide to using Terraform in your homelab — covering the Proxmox provider for VMs and LXC containers, Hetzner and DigitalOcean for cloud overflow, Cloudflare DNS management, remote state with MinIO, reusable modules, and CI/CD workflows that treat your infrastructure like code.