Blog

Procedure for importing a manually deployed Cloud Run service into Terraform state. Covers the IAM binding when the runtime service account differs from the Terraform actor, lifecycle ignore_changes for CI-managed image and env vars, and the multi-container template behavior of gcloud run services update.

Giving developers access to a private Cloud SQL instance without static IP allowlists or shared passwords. Covers the Cloud SQL Auth Proxy TLS 1.3 tunnel, IAM Database Authentication with Google Workspace identities, engine-specific database flags, and Terraform for the instance, users, and project-level bindings.

Using az monitor to measure CPU, memory, and IO utilization on an Azure Database for PostgreSQL Flexible Server, then deciding whether to downscale a Standard_D2s_v3 SKU based on the observed headroom.

Practical VPN setups across cloud platforms: OpenVPN with AWS VPN Gateway, Azure VPN Gateway, and Debian 12, an OpenVPN client on a GitHub Actions macOS runner, WireGuard between cloud infrastructure and clients, and a FortiGate scenario.

Building IPsec S2S tunnels between an Azure workload (Linux VM or VNet) and an on-premise datacenter behind a Mikrotik router. Covers Strongswan on the Azure VM, IPTables for SNAT variants, Azure VPN Gateway with LAN and SNAT scenarios, plus the ports and protocol numbers (ESP 50, AH 51, UDP 500, UDP 4500) that must clear every hop.