I have first hand knowledge with large consultant companies, they are largely sales teams with minimal IT knowledge. I had to help a one of their overseas "senior cloud professional" that had issues even understanding how to navigate the cloud UI.
DSC has a really really wide variety of windows modules and unfortunately there isn't really anything comparable, Puppet and Ansible do have interfaces to DSC modules but it's kind of janky compared to just using DSC.
Canada has very lax crime punishment, which is sad for the victims. There's been cases where people have killed others after 3-x crimes and released with future court dates.
So HAProxy has a bit of a love/hate relationship in Kubernetes, the problem really being UDP and the mess(?) that is proxying stateless traffic. The Gateway API kind of expecting UDP proxying support doesn't help.
I expect this to rise dramatically in Canada, Canadian tech salaries are a race to the bottom due to companies exploiting students for PR where they can advertise barely livable wages for something in the states that would get $150-250k.
If you look at COL and pay Vancouver regularly offers 40-60k CAD salary ($29k USD) where rent for a bedroom is $1.5-2k/mo
This is the difference between Rust and C like languages, one optimizes for the usual case and has a simple implementation and the other goes to great lengths to be correct in corner cases at the cost of a lot of complexity.
I would go with managed bare-metal, it's a step up from unmanaged bare metal cost wise but saves you on headaches from memory, storage, network, etc issues.
Just wondering have you worked on any large DCs or large NAS or SAN systems? Drive failures are a daily occurrence in places with a lot of spinning metal, having things fail to boot by default would be a nightmare.
Ideally you decouple this and store the creds in a key vault or whatever, this way you have to explicitly grant access to the service principal to access the kv secret. Decoupling usually fixes other issues as well such as expiring creds from service a to service b will then get coded into terraform to refresh.
For this to be true IPC would have to have stagnated for 10 years which is not the case. Look at Agner's instruction tables for different uarchs and compare.