Kubernetes Secrets Distribute Credentials but Do Not Provide Key Custody

·8 views

A Kubernetes Secret is well suited to delivering sensitive configuration to workloads, but it is not designed to answer security questions such as identity, authorization, or key custody. Problems arise when one Secret ends up representing identity, enrollment state, rotation, and tenant context all at once, making failures hard to diagnose. The article argues for separating distribution, private-key custody, workload identity, and authorization, so that a private key is never exported to the caller. It also describes a candidate enrollment contract that requires enrolled workload credentials to live in encrypted, CRD-backed custody with a non-exporting signing interface, while forbidding Secret volumes and similar injection methods. The author notes that this contract is not yet qualified and that migration work remains open.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DotNetPip Brings Python Dependency Management into .NET MSBuild Pipelines

A developer has released DotNetPip, an open-source MSBuild integration that manages Python dependencies directly within C# build pipelines. The tool addresses the tedium of setting up CPython runtimes, restoring pip packages and virtual environments, and handling module search paths and native binaries when calling Python from C#. Developers declare required Python packages in their .csproj file instead of relying on external setup scripts. Running dotnet build triggers custom MSBuild tasks that resolve these dependencies automatically, after the DotNetPip package is added from NuGet. The project is hosted on GitHub, and its author invites feedback, edge-case reports, and contributions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Checklist for Sideloading Android Apps: Permissions, Signing and Version History

Installing Android apps from outside the Play Store can help with regional availability or older devices, but it removes the store's safety checks and shifts responsibility to the user. The article advises questioning each permission request and asking whether the app's core function truly requires it, especially for sensitive access like contacts, SMS, or device administration. It recommends confirming that a new version is signed with the same key as the installed app and that the app has a clear source for future security updates. Users should also review version history and changelogs for gaps, sudden jumps, or missing fixes, and check the target Android version and package name against the official release. The piece concludes that careful checks can reduce risk while keeping the flexibility of installing apps outside the store.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Exposed windows_exporter endpoints call for a host inventory and tighter access controls

The Windows exporter publishes host metrics for Prometheus and commonly listens on port 9182. A reachable endpoint can reveal operating-system details, service states, process names, and resource usage, so it should be treated as internal telemetry rather than a public page. Search results from November 5, 2026 showed six port matches and twenty body matches, but the article stresses these are different observations and do not confirm a population of exposed hosts. Recommended safeguards include limiting enabled collectors, restricting textfile collector directories, binding the listener to monitoring interfaces, and allowing only the Prometheus server through the firewall. Defenders are advised to maintain an inventory of owned hosts running the exporter, including their host roles and configuration details.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Third-party Claude API proxies may fake prompt caching savings, study warns

A developer who audited more than a dozen third-party API relays reports that many advertise Claude prompt caching but fail to deliver it. Some proxies rotate requests across keys without session affinity, so cache writes repeat and users pay higher rates. Others strip cache control blocks and bill standard rates, or inject fake cache-read numbers into usage data. Even small changes to the system prompt can invalidate caches, and the article notes caching loses money if hit rates fall below about 22%. The author recommends a simple two-request test script and demanding per-request transparency from providers, and discloses that they run a competing routing gateway.

0 comments Read more at DEV Community