Troubleshooting notes

Use ansible.builtin.first_found to select host, group, environment, and default configuration files in an explicit, testable order.

Wrapper roles help keep upstream roles clean while adding your own deployment logic, files, and operational flow.

Configure an AWS CLI SSO profile, sign in with IAM Identity Center, select the correct account and role, and verify the active identity before running commands.

Diagnose AWS AssumeRoleWithWebIdentity AccessDenied in GitHub Actions by checking token permissions, audience, role ARN, and IAM trust-policy subject claims.

Build an IAM naming convention that exposes environment, system, access level, and ownership so access reviews require less guesswork.

Separate Cloudflare edge failures from origin failures using DNS inspection, curl --resolve, the correct Host header, and controlled origin access.

Create narrow Cloudflare WAF skip rules using hostname, source IP lists, path, owner, and expiry instead of bypassing security for an entire zone.

Automate audit evidence collection for logging, monitoring, backups, restore tests, access reviews, and changes before an auditor requests samples.

Resolve Docker no space left on device safely by measuring images, containers, volumes, build cache, logs, and inodes before deleting recoverable data.

Diagnose a SonarQube quality gate failure in GitHub Actions by separating scanner execution, analysis processing, new-code conditions, and pipeline enforcement.

Use an infrastructure handover checklist covering ownership, architecture, deployment, observability, access, backup, rollback, and known risks.

When service account key creation is blocked, the reason may be an organization policy even if project-level IAM looks correct.

Roll back an Argo CD application by reverting the failing Git commit, verifying the diff, and letting reconciliation restore the declared state.

Diagnose an Argo CD application that remains OutOfSync by inspecting live-versus-desired diffs, generated fields, mutating controllers, Helm output, and ownership.

Debug a missing Prometheus target by following the selector chain from Prometheus to PodMonitor, pod labels, and the named metrics port.

Diagnose Kubernetes CrashLoopBackOff by checking pod events, previous container logs, exit codes, probes, configuration, and resource limits in order.

Fix Kubernetes ImagePullBackOff by reading Pod events, validating the image reference, and checking private-registry credentials in the correct namespace.

Diagnose Kubernetes Pods stuck Pending by reading scheduler events and checking requests, taints, affinity, storage, quotas, and autoscaler capacity.

Troubleshoot cert-manager Certificate Ready False by following Certificate, CertificateRequest, Order, and Challenge resources instead of repeatedly deleting Secrets.

When the first EICAR test alerts but identical retries do not, separate ClamAV scan caching from file-event and SIEM ingestion behavior.

Before changing exporters or scrape configs, confirm whether the issue is actually the Grafana query, variable, or label filter.

Diagnose Prometheus targets showing context deadline exceeded by checking the rendered scrape URL, DNS, network policy, TLS, authentication, and exporter latency.

Run an isolated backup restore test, validate application and data integrity, and measure whether recovery meets the required RTO and RPO.

Resolve Terraform state lock errors by identifying active runs, verifying the backend and workspace, waiting safely, and using force-unlock only as a last resort.

Review noisy and low-value paths before increasing file_limit on busy Linux servers or container hosts.

Before changing rule logic repeatedly, test custom rules with real log samples and confirm the matched decoder or base rule.