Keep etcd peer and client certificate trust separate before scaling a cluster

·14 views

etcd is a durable control store used by many Kubernetes and platform deployments, and its peer and client connections access the same state. Because a certificate authenticating a cluster member can act with more authority than an ordinary client certificate, treating them as one broad TLS population weakens the cluster boundary. The guidance recommends separating them through distinct certificate profiles, subject alternative names, issuance policies, and allowed peer names, even when a single CA is used. Operators should verify TLS in both directions on every member, map each client certificate to a specific workload with least-privilege access, and test that peer and client certificates are rejected at the wrong endpoints.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why two browser tabs silently overwrote each other, and how version columns and ETags fix it

A developer testing an admin panel found that editing the same product in two tabs caused one change to vanish with no error or log entry. The cause is a lost update: each form saved every field, including stale values, through the ORM's default last-write-wins behavior. Database transactions cannot prevent this when the read and the save happen in separate HTTP requests, since each transaction is individually valid. The proposed fix is optimistic concurrency control, using an integer version column checked in the UPDATE's WHERE clause and exposed to clients through ETag and If-Match headers. A mismatch returns a 412 or 428 response, letting the user review changes and decide whether to reload or overwrite. Counters and inventory can skip this approach by doing atomic arithmetic in SQL.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Now Start Over 40% of GitHub Pull Requests, Octoverse 2026 Finds

GitHub's Octoverse 2026 report, released October 28, says more than 40% of pull requests in September 2026 began with a first draft from a coding agent, up from 17% in March. That amounts to about 110 million agent-started PRs in a single month. Agent-involved PRs merged within two weeks at a 90% rate in September, compared with about 86% for those without detected agent involvement. The report measured merges rather than code correctness, so it offers no data on bugs, security issues, or reverts. GitHub also notes the figure is a floor, since it only counts agent use it can detect, and that it refers to pull requests rather than total lines of code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Server-Driven Data Tables in Laravel, Inertia and React with URL-Based State

The article presents a pattern for building data tables in Laravel, Inertia and React where the server handles filtering, sorting and pagination. It explains that client-side tables struggle with large datasets, non-shareable state, and conflicting sources of truth. The proposed approach treats the URL query string as the table's single source of truth, with Inertia updating URL and page props together. A sample controller validates all query parameters, restricts sortable columns to a fixed whitelist, and adds a tie-breaker to keep pagination stable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React PWA Install Prompt for Chrome, Edge and iPhone

A React progressive web app needs two install paths because the browsers differ. In Chrome, Edge and Samsung Internet, a client component can capture the beforeinstallprompt event, hold it, and trigger the browser's install dialog from a custom button. iPhone and iPad browsers never fire that event, so the app should instead show users how to use Share and then Add to Home Screen. The guidance advises asking only after users get value, never inside an installed app, an in-app browser, or a sign-up flow, and respecting a dismissal for a couple of weeks. The article also notes that installability criteria such as the manifest, HTTPS and user engagement determine whether the prompt appears at all.

0 comments Read more at DEV Community