Ritesh Grover

Windows 10 - 11 migration series Option 3 - Azure Virtual Desktop (Single and Multi-Session) In our series of migrations from Windows 10 to Windows 11, the next focus is on Azure Virtual Desktop (AVD). Some businesses have expressed concern about upgrading their current Windows 10 AVD sessions to Windows 11 and questioned the deployment of new images and hostpools instead of an in-place upgrade. Unfortunately, there is currently no in-place upgrade approach for Azure VMs, though this may change in the future. Some users have tried switching from Gen 1 VMs to Gen 2 by enabling trusted launch (why still on Gen1?) and following the long process. However, this method does not provide an in-place upgrade. In lab settings, this approach led to profile issues, black screens, and application crashes, and remains unsupported. Our approach to upgrading clients on AVD to Windows 11 is as follows: 1. The Windows 10 image will only contain baseline applications. Deploy a new Windows 11 24H2 Enterprise Multisession with M365 Apps for multisession desktops or Windows 11 Enterprise for single-session desktops from the Azure Marketplace. 2. Install the agreed baseline applications to the image, optimise it, and capture the image. Package the rest of the required applications in Intune and deploy direct to the hostpool 3. Complete User Acceptance Testing (UAT), and obtain sign-off. 4. Deploy all required Windows 11 hostpools to replace Windows 10, ensuring the necessary policies and security baselines are applied. 5. Migrate users from Windows 10 to the Windows 11 hostpools. 6. Decommission and clean up any Windows 10 related Azure resources. Here at Advania UK we turn this around really quickly. There is no reason to delay your migration reach out today!

49

5 kommentarer

Virtualization vs. Containerization: The Architecture Battle In the world of DevOps and Cloud Engineering, understanding the layer-by-layer difference between a Virtual Machine (VM) and a Container is fundamental. ​Looking at the architecture: ​🔹 Virtualization (The Heavy Lifter) As seen on the left, VMs rely on a Hypervisor (like VMware ESXi or KVM) to emulate hardware. • Key Trait: Hardware-level virtualization. • Cost: Each VM requires a full Guest OS. This means running 3 VMs equals running 3 separate kernels, which is resource-intensive (RAM/CPU hungry). • Use Case: Perfect for complete isolation and running different OS types on one server. ​🔹 Containerization (The Agile Sprinter) As seen on the right, Containers utilize a Container Engine (like Docker or Podman) to sit on top of the Host OS. • Key Trait: OS-level virtualization. • Efficiency: Containers share the Host Kernel. They isolate processes but don't duplicate the OS. • Use Case: Ideal for Microservices, CI/CD, and maximizing resource efficiency. ​The Verdict? If you need speed and scalability, Containerization is the king. If you need strict hardware isolation and multi-OS capabilities, Virtualization still holds the crown. ​Which one are you using more in production today? 👇 ​#DevOps #CloudComputing #Docker #Kubernetes #Virtualization #TechArchitecture #SystemDesign #Linux

91

6 kommentarer

🚀 Understanding the 7 Rs of Cloud Migration 🚀 Migrating workloads to the cloud requires a well-thought-out strategy. AWS defines seven migration strategies, known as the 7 Rs: Retire – Decommission outdated or unused applications. Retain – Keep applications on-premises for now. Rehost – Lift-and-shift applications to the cloud. Relocate – Move applications without re-architecting. Repurchase – Move to a new cloud-native product or SaaS solution. Replatform – Make minimal changes to optimize for the cloud. Refactor/Re-architect – Redesign applications to fully leverage cloud capabilities. For large-scale migrations, the most common approaches are rehost, replatform, relocate, and retire. While refactoring modernizes applications during migration, it can be complex and is typically recommended after the initial migration. Selecting the right migration strategy early—during the mobilize phase or initial portfolio assessment—is critical for a smooth cloud journey. 💡 Tip: Start with simpler strategies like rehost or replatform, and modernize over time for efficiency and scalability. #AWS #CloudMigration #CloudStrategy #7Rs #DigitalTransformation

80

1 kommentar

Kubernetes Troubleshooting: A Step-by-Step Guide In the modern era of the software industry, microservice architecture and Kubernetes have become the globally adopted solution, for organizations looking for scalability and operational efficiency. At one end where these cutting-edge technologies help organizations operate at scale, navigating through their complexities can be challenging, where you are bound to face the errors and misconfigurations that will hinder your pace of getting to production servers. This blog post will discuss the most common Kubernetes errors and solutions for them. #kubernetes #sre #troubleshoot #cncf https://lnkd.in/dUf6NiEh

24

1 kommentar

DevOps Lead Interview at Netflix Round 1 – Systems at Scale, K8s, Cloud & Linux • How would you implement fine-grained service discovery across 1000+ microservices using Envoy or Istio? • Explain how you’d leverage eBPF + Cilium to enforce network security policies at runtime, and what the advantages are over traditional CNIs? • Netflix runs multi-cloud. Describe your approach to cross-cloud routing, IAM, and secret syncing. • What happens when systemd units fail intermittently on EKS nodes? How do you detect and heal? • Your app teams demand custom AMIs. What’s your pre-prod vetting strategy at kernel and runtime? • Walk through advanced kube-probe configurations to detect business logic failures, not just HTTP 200. • How do you handle DNS-level outages inside a service mesh without a full app redeploy? • Terraform remote_state backend suddenly times out. What’s your recovery and damage containment strategy? Round 2 – RCA, Fire Drills, and Netflix-Scale Chaos • A new Envoy config rollout silently broke mTLS between edge and mesh. What’s your RCA trace? • HPA refuses to scale even though Prometheus shows CPU > 80%. Diagnose with cloud + K8s metrics. • You introduced a sidecar-based caching layer. Suddenly, tail latency spikes. What’s your debug path? • 504 errors on the playback service. Cloud LB shows healthy, mesh sidecars pass, but users can’t stream. Triage? • You notice surging NAT costs. No infra changes this week. What could silently trigger that? Round 3 – Leadership, Chaos Culture & Engineering Influence • How do you build an engineering culture where SLOs are owned, not ignored? • You’re asked to ship a multi-region failover in 3 weeks, no DNS layer allowed. Your plan? • Describe how you’d test infra chaos and graceful degradation for a Netflix Originals release. • How do you prove the ROI of infra modernization to non-technical execs? 💡 TL;DR: If you haven’t: 1. Used eBPF to trace a TCP reset at runtime 2. Investigated TLS outages across sidecars 3. Debugged Redis inconsistency under pressure 4. Simulated a kubelet crash mid-streaming session Then Netflix interviews won’t just test you; they’ll expose the cracks in your production mindset. But what if you could train on this before getting grilled? That’s what InfraThrone was built for: RCA drills, Fire room simulations, Real infra chaos 🎯 Next Batch: Nov 01st 2025 🔗 https://lnkd.in/edx2YiAn #DevOps #NetflixScale #SRE #ChaosEngineering #Kubernetes #Linux #Cloud #PlatformEngineering #Observability #InfraThrone #RCADrills

41

Having struggles maintaining multi-scope RBAC assignments in Bicep? There's now one module to rule them all, developed in the AVM repository. I took a quick look at how it works and wrote about it: https://lnkd.in/ehzMWe8z #bicep #azure #avm #rbac

32

Hybrid IT network architecture diagram Cloud Environment Layer Components: AD / Office 365:Provides cloud-based authentication and identity management. Users can log in to SaaS apps like Office 365. SSO / App Proxy:Enables secure access to internal applications from outside the corporate network.Acts as a bridge between cloud and on-prem apps. AWS / Azure Cloud Compute & Monitoring: Used for hosting workloads, monitoring, and AI/observability (AIOps). Backup & Storage (Cloud): Cloud-based storage for off-site backups and DR. AD Connect Sync: Synchronizes on-prem AD users/groups with Azure AD for hybrid identity. Connections / Flow: AD Connect syncs on-prem AD with AZ AD. SSO/App Proxy connects users to both cloud and on-prem apps through a secure tunnel. Cloud monitoring collects metrics from on-prem servers over VPN/MPLS. Backup systems replicate critical data to the cloud. Network Layer (VPN/MPLS) Purpose: Provides secure communication between on-premises data centers and the cloud environment. Ensures that monitoring, backups, & AD sync can happen over encrypted channels. Key Notes: All cross-site and cloud traffic passes through this secure network. Critical for hybrid authentication and replication. On-Premises Data Centers (Two Sites: A & B) A. ADDC Components: ADDC Site A & Site B: Provide authentication, policy management, & replication between sites. Monitoring & Alerts: Collect logs & health metrics from AD DCs. Connections: Replication arrows between DCs ensure high availability and data consistency. DCs communicate with monitoring tools to alert on failures or security issues. B. VMware / VxRail Cluster Components: ESXi Hosts+vSAN Storage: Hosts virtual machines with clustered storage for high availability. VMs: Windows & Linux Servers: Run prod workloads, web servers, DB, or internal apps. Monitoring Tools: Collect performance metrics, logs, and health status from VMs and hosts. Connections: Monitoring tools link both sites to central dashboards. Replication/failover ensures VMs can move between sites during an outage. Purpose: A virtualized compute environment provides flexibility, HA, & DR C. Network Infrastructure Components: Network Switches: Connect servers, storage, & end devices within the site. Replication & Failover Links: Ensure VMs & storage can synchronize between Site A and Site B. Connections: Orange/green lines (as per diagram) indicate replication paths and monitoring data flows. Ensures network traffic is properly segmented and highly available. D. Backup Systems / Storage Components On-prem backup servers replicate critical VM and AD data. Connects to both local and cloud storage for DR. Purpose Ensures business continuity in case of server failure, site outage, or data corruption. End Devices Layer Components Laptops & Devices Connections Admin Layer (PowerShell & Automation) Components: Admin Console / Scripts Purpose Data Flow Summary User Authentication VM Operations Replication & Backup Monitoring Automation

9

Blog Post: https://bit.ly/4pm31um I just published a deep dive on how Microsoft Connected Cache (MCC) can make or break your Windows Autopilot and Windows 11 migration projects. If you’re rolling out Autopilot or planning for Windows 11 upgrades, MCC is essential to avoid WAN bottlenecks and speed up device provisioning. In my blog, I cover how MCC works, real-world scenarios, and best practices for setup. Now’s the time to make MCC part of your core IT infrastructure. Read more for practical insights. #Autopilot #Windows11 #ITinfrastructure

195

5 kommentarer

🚀 Integrating OpenShift into Every Training Use Case: A Complete Roadmap In this session, I’ve shared a comprehensive training journey with OpenShift, covering key courses like DO180 (Foundations of OpenShift), DO280 (Administration), and DO380 (Scaling Deployments in the Enterprise). Along with this, we also dive into DO370 (OpenShift Data Foundation) to explore both ODF and non-ODF use cases for managing data at scale. This roadmap is designed to help learners, educators, and organizations understand: 🔹 How OpenShift fits into every stage of the training lifecycle 🔹 The role of KubeVirt and virtualization in modern workloads 🔹 Why ODF is critical for building scalable and reliable data platforms 🔹 Practical adoption strategies for real-world enterprise environments Whether you’re starting your OpenShift journey or looking to advance into specialized tracks, this session provides clear direction for building cloud-native, virtualization-ready, and future-proof skills. Book Your Free Demo Here - https://lnkd.in/g7QSNA7V #OpenShift #KubeVirt #Kubernetes #Virtualization #ODF #CloudNative #HybridCloud #DevOps #EnterpriseTraining #OpenShiftDataFoundation

98

17 kommentarer

Node Management in OpenShift: Building the Invisible Backbone of Enterprise Agility When we talk about containers, cloud-native workloads, and Kubernetes, the conversation often revolves around applications, developers, and CI/CD pipelines. But beneath this exciting surface lies an unsung hero—the node. In OpenShift, node management is not just about keeping machines alive; it is about orchestrating an invisible backbone that determines how resilient, performant, and future-ready your enterprise truly is. Think of nodes as the highways of a digital city. Applications are the vehicles, APIs are the traffic lights, and governance is the traffic law. Without well-maintained roads, the smartest vehicles stall. This is why solution architects and platform teams must elevate node management from an operational afterthought to a strategic capability. The Discipline of Node Management In OpenShift, nodes come in many roles—control plane, worker, and infra nodes. Managing them goes beyond "up or down" checks. It requires continuous monitoring, intelligent workload placement, graceful maintenance, and lifecycle automation. Cordon & Drain ensure that workloads are shifted safely before upgrades, like diverting traffic before road repair. Labels and Taints act as zoning rules, dictating which workloads belong where. Machine Config Operator ensures every node has consistent OS, security, and kubelet configurations, removing drift before it causes chaos. Scaling with Precision Business demand is never constant. A holiday sale, a global product launch, or even a surge in AI workloads can push clusters to their limits. OpenShift’s MachineSets and Cluster Autoscaler act as digital elasticity, scaling worker nodes up or down based on real-time demand. This isn’t just efficiency—it’s about delivering customer experience at speed without overspending on idle infrastructure. Operational Resilience Downtime is expensive, but planned downtime without disruption is leadership. With OpenShift, teams can drain nodes, patch operating systems, and roll out upgrades without impacting application availability. This transforms platform operations from firefighting to proactive reliability engineering. Why This Matters for Enterprise Leaders Node management may feel technical, but its outcomes are deeply business-centric: Cost Optimization: Scale when needed, save when idle. Risk Mitigation: Security patches and compliance enforcement flow seamlessly across the fleet. Agility: Developers focus on innovation, while operators guarantee stability. Final Thought In a world chasing AI, hybrid cloud, and edge computing, node management in OpenShift is the unglamorous, yet critical art that ensures the foundation never cracks while skyscrapers are being built. As solution architects, our role is to translate this invisible operational discipline into visible business value—ensuring that the enterprise is not only cloud-native, but also cloud-resilient.

18

2 kommentarer

Real customers. Real constraints. Real IGA decisions --When NOT to choose each IGA tool❌ 🚫 When NOT to choose SailPoint IdentityNow 🤞If your needs are small or mid-scale only 🤞If your environment is heavily on-prem /legacy-centric 🤞If budget is extremely constraint ✔️Message: SailPoint shines at scale — it’s overkill for lightweight needs. 🚫 When NOT to choose Saviynt 🤞If you want pure IGA only (no PAM or risk convergence) 🤞If you need a simpler, faster-to-operate governance model 🤞If machine/service identities are not in scope ✔️Message: Saviynt is powerful, but complexity comes with convergence. 🚫 When NOT to choose One Identity Manager 🤞If your strategy is cloud-first / SaaS-only 🤞If advanced risk scoring, SoD analytics are top priorities 🤞If machine identity governance is critical ✔️Message: One Identity excels in hybrid depth, not cloud-native scale. 🚨 The IGA tool didn’t fail. The context was ignored. I’ve seen some of the best IGA platforms struggle — not because they were weak, but because they were wrong for the organization. Too often, identity governance decisions start with: 👉 “Which tool is the market leader?” instead of: 👉 “Which tool fits our maturity, scale, and operating model?” 💡 Hard truth: Most IGA failures aren’t technical. They’re selection failures.

23

🚀 Day 16 — Operational Excellence: Monitoring, Alerting & Automation In the Azure Well-Architected Framework, Operational Excellence isn’t about firefighting when things go wrong — it’s about designing for reliability, visibility, and agility so issues are prevented, detected early, and resolved quickly. ✨ Here’s how to build it into your cloud operations: 🔹 Structured Observability — Enable diagnostics, telemetry, and logging across your Azure resources with Azure Monitor, Log Analytics, and Application Insights. This gives you the data you need for availability, performance, and user experience. 🔹 Meaningful Alerts — Avoid alert fatigue. Use dynamic thresholds, integrate with ITSM tools, and make sure every alert has a clear action path and owner. 🔹 Service Level Objectives (SLOs) — Define them with business stakeholders. Pair them with health models (healthy, degraded, unhealthy) to prioritize responses. 🔹 Incident Response — Document escalation paths, roles, and severity definitions. Run drills and post-mortems to keep improving. 🔹 Automation as a First-Class Citizen — Automate provisioning, deployments, governance enforcement, and patching with Infrastructure as Code, CI/CD pipelines, and Azure Automation. Treat automation with the same rigor as application code. 🔹 Continuous Feedback Loop — Regularly review incidents, dashboards, and playbooks. Refine thresholds, improve automations, and foster a culture of learning. 💡 Takeaway: Operational Excellence requires investment in people, processes, and tools. Start small — optimize one area (alerting, automation, or dashboards) — then expand iteratively. The payoff is less downtime, faster recovery, and smoother day-to-day operations. #Azure #WellArchitected #CloudOps #AzureMonitor #OperationalExcellence #AzureTips #MicrosoftAzure #AzureCloud #MicrosoftCloud #MVPBuzz

56

1 kommentar

🚀 Major Identity launch ! 🚀 Today we launched a feature of IAM access analyzer, the "internal access analyzer". This feature used automated reasoning to evaluate the relevant AWS policies to tell you which IAM principals have access to your S3 buckets, DynamoDB tables, and RDS databases - the resources that hold your data! This feature is awesome because it's looking at policy types that grant permissions, like identity policy and resource policies, and the guardrail policy types like SCP and RCP which may restrict the access that looks like it's granted elsewhere. We're so stoked to bring this to you! If you're on-site at re:inforce you definitely want to check out Meg P. and Alex Waddell's session, IAM341, which uses this feature and Amazon Neptune to visualize the findings! https://lnkd.in/gJs2yVtx

278

8 kommentarer