CloudSpinx Engineering
Infrastructure Engineering, Virtualization, Networking, Automation
The CloudSpinx engineering group. Used for technical posts that come out of the practice as a whole rather than from one engineer's desk.
Articles by CloudSpinx
k3s vs RKE2 vs kubeadm: We Cut the Power on All Three
k3s vs RKE2 vs kubeadm on identical 4 GB VMs: memory in use, seconds back after a hard power cut, and the pods RKE2's CIS profile refuses.
OpenStack Skip-Level Upgrade: What Epoxy to Gazpacho Changes
An OpenStack skip-level upgrade from Epoxy to Gazpacho skips Flamingo, not its changes: 18 nova options go unwarned and nova-api moves to threading.
PostgreSQL Point-in-Time Recovery: What 35 Days Costs
PostgreSQL point-in-time recovery cost, measured: a 755 MB database at 100 transactions a second wrote WAL at 80 GB a day. What RDS, Azure and S3 bill.
ingress-nginx Is Retired: Alternatives and What Breaks
ingress-nginx is retired. We served ingress2gateway output on Envoy Gateway: a 15 s default timeout, an open admin route, and which alternative to pick.
Ubuntu vs Rocky Linux vs AlmaLinux: Check the CPU First
Rocky Linux 10 needs an x86-64-v3 CPU and Ubuntu does not. We tested Ubuntu, Rocky and AlmaLinux on nine emulated CPU models, Proxmox defaults included.
DNS Failover and TTL: What 39 Kenyan Bank Sites Set
DNS failover waits on the TTL unless a proxy fronts the site. We read the DNS of 39 Kenyan bank sites: 18 point straight at a server, 5 at 4 hours or more.
Remove a Secret From Git History Without It Coming Back
Remove a secret from git history after rotating it. In our test TruffleHog found no M-Pesa key, gitleaks missed 6 of 12 copies, a merge undid the rewrite.
MongoDB Backup Encryption: Dumps and Logs Stay Readable
MongoDB backup encryption, tested: under LUKS and under Percona's encryption at rest, every mongodump we took held all 5,000 ID numbers in plain text.
Ceph Squid End of Life on Proxmox: The Upgrade Order
Ceph Squid end of life on Proxmox: Tentacle needs PVE 9, and 19.2.6 raises HEALTH_ERR until cephx keys move. The upgrade order, read from the repos.
ISP Failover Test: What Drops When the Link Switches
ISP failover test on a dual-WAN router: our health check moved new connections in 3 s, a VPN behind static NAT stayed down 186 s. What to test in Kenya.
INACCESSIBLE_BOOT_DEVICE on Proxmox: Two Fixes, One Worked
INACCESSIBLE_BOOT_DEVICE after moving a Windows VM to Proxmox VirtIO SCSI: in our lab it still crashed after pnputil, and a 1 GiB dummy disk fixed it.
AWS Direct Connect in Kenya or a VPN: Cost and SLA
AWS Direct Connect in Kenya runs from one Nairobi location. What a port, a VPN and egress cost a month, what a 95% SLA means, and when a VPN is enough.
PostgreSQL 14 End of Life: Upgrading to 18 on Ubuntu
PostgreSQL 14 end of life is 12 November 2026. We upgraded an Ubuntu 22.04 server to 18: two refusals, a 433-second default and lost extended statistics.
Proxmox Backup Server Review: We Tested Dedup, Sync and GC
Proxmox Backup Server review, 4.2 lab: cross-VM dedup saved disk but not upload, a deleted backup freed nothing for a day, one bad chunk failed 3 backups.
Email Migration in Kenya: Where Mail Gets Lost at Cutover
Email migration loses mail at cutover and quietly in the copy. We tested imapsync delta passes: what a final sync skips and what a mirror pass deletes.
What SQL Server Disaster Recovery on AWS Costs in Kenya
SQL Server disaster recovery on AWS from Kenya: the license AWS bills per vCPU-hour, when the standby copy is free, and three DR shapes priced a month.
Kubernetes Certificate Expired: Why Renewing Is Not Enough
Kubernetes certificate expired? Our kubeadm cluster kept serving until a reboot, then stayed down after kubeadm certs renew until two pods restarted.
Self-Hosted vs GitHub-Hosted Runners in Kenya
Self-hosted vs GitHub-hosted runners: minutes rarely decide it. Reach does, then Kenyan power, and GitHub says not to allowlist its 7,038 IP ranges.
MongoDB Atlas Migration in Kenya: Moving Off With mongosync
MongoDB Atlas migration to a replica set in Kenya: the four checks that decide if mongosync can move you, and what our lab cutover blocked, kept and left.
Terraform to OpenTofu Migration: What Breaks and Why
Terraform to OpenTofu migration, tested on Terraform 1.16.6 and OpenTofu 1.13.1: the lock file, ignored version pins, encrypted state, and who should stay.
Kubernetes Node Failure: How Long Before Pods Move
Kubernetes node failure, timed: NotReady at 48.5 seconds, one pod running again at 5m50s, and a StatefulSet that stayed down until we tainted the node.
Microsoft 365 vs Google Workspace in Kenya: Same Price Now
Microsoft 365 and Google Workspace now both list USD 7, 14 and 22 per user. What decides it in Kenya: storage, desktop Office and what your clients run.
Argo CD Setup: Auto-Sync, Self-Heal and Prune, Tested
Argo CD setup on its defaults keeps drift and orphaned resources. Our v3.5.5 lab timed auto-sync, self-heal and prune, and what GitOps still will not fix.
Bank of Tanzania Cloud Guidelines: Where Core Banking Runs
Bank of Tanzania cloud guidelines keep core banking in Tanzania, and the 2025 revision is still a draft. Where a DR site may sit, read from four BoT texts.
eTIMS Integration in Kenya: OSCU or VSCU for Your ERP
eTIMS integration runs through an OSCU or a VSCU, and KRA's own list certifies Odoo 16 both ways. What decides it is what your tills do offline.
Kubernetes 1.34 End of Life: What It Costs to Stay On It
Kubernetes 1.34 end of life is 27 October 2026, but EKS, GKE and AKS each set their own date and bill. Our kubeadm test shows why 1.37 takes three hops.
Why Outlook Rejects Your Mail: SPF, DKIM and DMARC
Outlook now rejects unauthenticated bulk mail with 550 5.7.515. What SPF, DKIM and DMARC alignment it checks, and how Kenya's 39 banks set DMARC.