Kubernetes Token Rotation Leaves Old Tokens Valid; Bound Marker Secrets Offer a Fix

·7 views

A common assumption is that rotating a Kubernetes service account token invalidates the previous one, but TokenRequest-issued tokens remain valid until their expiry claim. The author, who works on the zenxPAM access platform, describes a fix using the boundObjectRef feature, which ties a token to an object so it stops working when that object is deleted. Because no Pod exists for external workloads, they use a dedicated marker Secret as the anchor. In lab tests on a single-node k3s cluster, revoked tokens were refused roughly 9 to 11 seconds after deletion, reflecting the API server's authentication cache. The design adds two alternating marker slots per identity, a verification step using SelfSubjectReview before switching, and compensating rollback on failure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kids Are Getting Around Social Media Bans, and MIT Review Argues That May Not Be a Problem

An article in MIT Technology Review argues that children finding ways around social media bans should not necessarily be treated as a problem requiring a fix. The piece challenges the assumption that every workaround signals a failure of policy enforcement. It frames young people's circumvention as a predictable response to restrictions rather than a crisis in itself. The discussion was shared on Hacker News, where it drew a small amount of engagement. The available source material provides only the article link and basic metadata, so the full argument is not detailed here.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Claude Code Fixes Four Shell Variable Cases That Bypassed Its Permission Checks

Between October 3 and 9, Claude Code's official changelog recorded four fixes for cases where shell variables let commands slip past its permission rules. In two cases, deny or ask rules failed to catch the command, particularly under sandbox auto-allow mode. In the other two, the auto-approval check permitted commands that should have prompted the user. The changelog does not explain who discovered the issues or how the checker failed internally. The article notes that the underlying problem is that text-based rule matching must predict how the shell will expand variables and split words before execution.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ColumnCheck: Local CSV Review Tool with Human Overrides for Freelancers

ColumnCheck is a small offline command-line tool that helps freelancers review messy CSV exports, such as invoices, before importing them elsewhere. It suggests column types from headers using a scikit-learn classifier and applies fixed validators for emails, ISO dates, decimal amounts, and whole-number quantities. Users can override suggestions through a JSON mapping, and reports preserve the original model output while flagging the override. The tool produces JSON and HTML reports without modifying the source file or making network calls. The developer notes it is a functional prototype and that its business demand and performance advantage over simple rules remain unvalidated.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Anthropic publishes research on how employment is changing at the company

Anthropic has released a research report examining how employment within the company is evolving. The piece is hosted on the company's website and was shared on Hacker News, where it drew a small amount of early attention. The source material provided includes only the link and basic engagement metrics, so specific findings and figures cannot be confirmed from this item alone. Readers interested in the details are directed to the original report on Anthropic's site.

0 comments Read more at Hacker News