Notes · İsmail Altıntaş https://ismailaltintas.com/en/notes/ Field notes on networking, systems, Kubernetes and automation. en Patching a PHP vulnerability without code changes https://ismailaltintas.com/en/notes/php-security-patch-backport-base-image/ https://ismailaltintas.com/en/notes/php-security-patch-backport-base-image/ Thu, 29 Oct 2026 09:00:00 +0300 Closing a critical hole in end-of-life PHP 7.4 / 8.1 apps with a patched base image, no code changes: the stopgap measures and the lasting fix. No restore drill, no backup https://ismailaltintas.com/en/notes/kubernetes-backup-restore-drill/ https://ismailaltintas.com/en/notes/kubernetes-backup-restore-drill/ Thu, 29 Oct 2026 09:00:00 +0300 Three-layer Kubernetes backups with Velero, Longhorn volume backups and etcd snapshots, plus the step that really matters: the restore drill. Windows LAPS: delegating password read access to a group https://ismailaltintas.com/en/notes/windows-laps-password-read-permission/ https://ismailaltintas.com/en/notes/windows-laps-password-read-permission/ Mon, 26 Oct 2026 09:00:00 +0300 Controlled access to local admin passwords without Domain Admin: delegating Windows LAPS read permission to a dedicated group and auditing it. PostgreSQL high CPU: start with pg_stat_statements https://ismailaltintas.com/en/notes/postgresql-high-cpu-pg-stat-statements/ https://ismailaltintas.com/en/notes/postgresql-high-cpu-pg-stat-statements/ Mon, 26 Oct 2026 09:00:00 +0300 When PostgreSQL CPU spikes, find the source with query stats instead of server graphs: setting up pg_stat_statements and finding the costliest queries. Kubernetes certificate errors in GitLab CI: not the code https://ismailaltintas.com/en/notes/gitlab-ci-kubernetes-certificate-error/ https://ismailaltintas.com/en/notes/gitlab-ci-kubernetes-certificate-error/ Mon, 26 Oct 2026 09:00:00 +0300 When kubectl in GitLab CI fails with x509 or expired certificate errors, separate the issue from the code and narrow it to kubeconfig, CA and credentials. Backend says 200, Caddy says 503: the health check trap https://ismailaltintas.com/en/notes/caddy-health-check-503/ https://ismailaltintas.com/en/notes/caddy-health-check-503/ Mon, 26 Oct 2026 09:00:00 +0300 A common reason Caddy returns 503 while the app is healthy: the health check expects a status code the backend no longer returns. Diagnosis and fix. A read-only Kubernetes role: no Secrets, no exec, no changes https://ismailaltintas.com/en/notes/kubernetes-read-only-rbac-role/ https://ismailaltintas.com/en/notes/kubernetes-read-only-rbac-role/ Mon, 26 Oct 2026 09:00:00 +0300 Designing a Kubernetes RBAC role that lets teams see their pods and logs but can't read Secrets, exec into containers or change anything.