How to Create Kubernetes Service Accounts and Assign RBAC Permissions

·1 views

Kubernetes ServiceAccounts provide a secure identity for applications running inside a cluster, allowing pods to authenticate with the Kubernetes API without relying on user accounts. Unlike broad cluster-admin access, Role-Based Access Control (RBAC) lets developers assign only the specific permissions an application needs, following the Principle of Least Privilege. A ServiceAccount is created via a YAML manifest and referenced in pod or deployment specs using the serviceAccountName field. Permissions are then granted by defining a Role or ClusterRole and binding it to the ServiceAccount through a RoleBinding or ClusterRoleBinding. This approach limits the blast radius of any compromised workload and is especially important for tools like the Agentic CLI when operating in cluster mode on AKS.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hugging Face silent rate-limiting mimics frozen downloads for anonymous users

Developers downloading large models from Hugging Face without authentication can experience downloads that appear to hang at 0 B/s, but are actually being silently rate-limited. Anonymous users share a quota of 3,000 requests per 5-minute window per IP address, meaning shared networks like office NATs or university connections deplete the limit faster. When the quota is exceeded, the Hub responds with a 429 status and a reset timer, while the huggingface_hub client quietly waits out the penalty without displaying any notification. The telltale sign is a fast initial burst followed by a consistent stall at the same point every retry — a pattern that signals a policy limit rather than a network failure. Setting a HF_TOKEN environment variable grants authenticated users higher rate limits and avoids the issue entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Fault-Tolerant Rotating Proxy Pool in Python

Web scraping at scale requires more than a single proxy, as IPs can be rate-limited, banned, or timed out by target sites. A robust solution involves building a proxy pool in Python that rotates IPs on every request attempt and retries failed requests using a fresh IP. The approach treats HTTP status codes like 429 and 5xx as retryable errors and applies exponential backoff to avoid overwhelming struggling targets. For multi-step workflows such as logins or cart sessions, sticky sessions allow a fixed IP to persist by pinning a session ID in the proxy credentials. Switching between rotating and sticky modes covers most real-world scraping scenarios without requiring separate infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why API Design Demands More Care Than Most Engineers Give It

A well-designed API functions as a binding promise to its consumers, making thoughtful upfront design critical to long-term system health. Every field or optional parameter added to an API increases complexity and the potential for bugs, meaning restraint is one of the most valuable qualities a designer can exercise. Consistency in naming, error formats, and pagination reduces hidden integration costs, while versioning is less about URL structure and more about clear change management and deprecation communication. APIs should also anticipate failure by providing meaningful error messages, correct status codes, and idempotent operations to improve resilience. When designed well, APIs enable teams to work independently; when designed poorly, they create tight coupling masked as a service.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Contract Clauses That Cost Freelancers Money and How to Fight Back

Freelancers often lose income not through poor work but by overlooking harmful contract language before signing. Five common problem clauses include unlimited revision obligations, immediate IP transfer without payment, no cancellation or kill-fee terms, Net-60 payment windows, and broad non-compete restrictions spanning entire industries. Each clause can expose a freelancer to unpaid labor, loss of leverage, or being locked out of their primary market for up to two years. Experts recommend countering these with specific alternative language, such as capping revisions at two rounds, tying IP transfer to final payment, and limiting non-competes to named direct competitors for six months. Carefully reading every contract before signing remains one of the most valuable habits a freelancer can develop.

0 comments Read more at DEV Community