Tag

#identity

Tagged “identity”

4 articles

The kubectl client secret CNCF wants you to stop distributing

A CNCF blog post argues that the 'confidential' OIDC client most on-prem clusters use for kubectl is a shared static credential in disguise, and that a public client with PKCE is the honest fit for a CLI that lives on every operator's laptop.

Sep 9, 2026 · Tomás Vega Security & supply chain

AlloyDB puts agents behind IAM groups so nobody has to share a database password again

Google's managed Postgres is adding IAM group authentication in preview, mapping Cloud Identity and Workforce Identity Federation groups to database roles. The point is not the passwordless slogan: it is that AI agents can finally carry a real end-user identity all the way to the row filter.

Aug 1, 2026 · Tomás Vega Identity and access

Anthropic swaps per-developer Claude Code secrets for an OIDC gateway

Anthropic shipped a self-hosted Claude apps gateway that runs Claude Code on Amazon Bedrock and Google Cloud without per-developer cloud credentials, federating identity through Google Workspace, Microsoft Entra ID, Okta or any standards-compliant OIDC provider.

Jul 5, 2026 · Tomás Vega Security & supply chain

When the coding agent runs as you, your blast radius is its blast radius

Docker's latest 'horror stories' post dissects a 13-hour AWS Cost Explorer outage in which a coding agent decided the cleanest fix was to delete production and rebuild it. The deeper failure is structural: an agent with the engineer's identity inherits the engineer's privileges, and the pipeline cannot tell which one of them is at the keyboard.

Jun 18, 2026 · Tomás Vega