How to Configure Keycloak as an OIDC Provider for Amazon EKS Using Terraform

·1 views

A developer has published a technical guide detailing the Terraform and OpenTofu configuration required to set up Keycloak as an OpenID Connect provider for Amazon EKS Kubernetes API authentication. The setup uses the official Keycloak Terraform provider, configured via environment variables pointing to a Keycloak realm and client credentials. A confidential Keycloak client is created with the Authorization Code Grant flow enabled, restricting token scope to client-specific roles only. Client roles are mapped to Keycloak groups, and users are then assigned to those groups to control access permissions within the cluster. The guide also notes that a separate article will cover JWT-federated client configuration for GitHub Actions runners.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Block Webhook Replay Attacks Using Node.js and PostgreSQL

Webhook replay attacks occur when a valid, signed payload is resent to a server, potentially allowing actions like duplicate balance credits to execute more than once. A multi-layer defense in Node.js and PostgreSQL can prevent this by combining timestamp freshness checks, HMAC signature validation, and database-level idempotency. Storing processed event IDs in PostgreSQL with a unique constraint ensures duplicates are rejected even under concurrent requests, unlike Redis which can lose state on cache flush or container restart. The approach uses a middleware function that rejects requests older than five minutes, verifies signatures using constant-time comparison to prevent timing attacks, and queries the database for duplicate event IDs. This setup guarantees each webhook payload is processed exactly once, providing reliable protection for payment and other sensitive event pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why ML Trading Systems Fail Before Training Even Starts

A developer building StratCraft, an ML-based trading system, found that a hidden data insufficiency caused Run 51 of a model sweep to fail before training could begin. Three separate components — the data puller, fold planner, and refusal checker — each held conflicting assumptions about how much historical data was required. The experience highlighted a broader pattern: in ML trading systems, the majority of meaningful work happens outside the model training step itself. Rather than predicting exact returns, the system focuses on ranking assets by signal scores and testing whether higher-ranked assets consistently outperform lower-ranked ones. The author argues that model.fit() is often the simplest line in such a project, while data integrity, label design, selection bias, and signal combination represent the real engineering challenges.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zippers Explained: Efficient Tree Navigation for Functional Programming

Navigating and modifying tree-structured data in functional languages like Haskell is non-trivial due to immutability, which rules out the parent-pointer approach common in imperative languages. A technique called a zipper addresses this by maintaining a focused node alongside a stack of breadcrumbs that record the path taken through the tree. This allows developers to move down, modify, and move back up a tree structure without rebuilding the entire tree on each operation. The zipper's modify operation runs in O(1) time, compared to the O(depth) cost of repeatedly traversing from the root. The concept is illustrated through a simple JSON query tool that supports relative path navigation using an 'at' block construct.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Practical DevOps Roadmap for Beginners Built Around Real-World Hiring Trends

A software engineering student roughly 16 months from graduation has shared a detailed DevOps learning roadmap developed over the past year. The guide is designed for beginners — including students, developers pivoting from pure software roles, and sysadmins — and was stress-tested against actual 2026 hiring demands. It emphasizes foundational skills like Linux, networking, Git, and scripting before advancing to cloud, Kubernetes, and Terraform. The roadmap highlights Platform Engineering as the fastest-growing DevOps specialization, focused on building internal developer platforms. A core principle throughout is balancing study with hands-on building, recommending one hour of practical work for every hour spent reading or watching tutorials.

0 comments Read more at DEV Community