Recipes
Step-by-step solutions for real development tasks.
699 published
Page 7 of 20
Guard Cluster Scale-Down from Disruption
Protect workloads from node removal with pod disruption budgets, annotate safe-to-evict, and let the autoscaler scale down only nodes it is sure are idle.
Propagate a Correlation ID Across Services
Generate a request identifier at the edge, forward it in headers and logs, and return it to the client so a single trace can be reconstructed later.
Rebuild Read Models by Replaying Events
Keep a projection version, consume events into a read model, and be able to replay from zero or from a checkpoint to rebuild after a bug.
Prevent Overlapping Cron Runs
Guard a scheduled job with a lock or a run-state check so a slow run cannot overlap the next tick and double-process the same window.
Enable Cross-Origin Isolation Safely
Set COOP and COEP to unlock powerful APIs like SharedArrayBuffer, then handle the resource-loading consequences so the app still works.
Harden Content Security Policy with Nonces
Drop unsafe-inline, generate a per-response nonce for legitimate scripts, and report violations so a CSP actually blocks injected scripts.
Keep Docker Build Context Small
Add a .dockerignore that excludes node_modules, build output, VCS data, and secrets so the context is small and no secret can be copied accidentally.
Configure Envoy Retries with a Budget
Enable Envoy retries with a retry budget and per-try timeout so transient failures recover without amplifying load on a struggling upstream.
Support Global Logout with Token Revocation
Track token families or a per-user token version, revoke on logout-everywhere and password change, and validate the version on every request.
Configure GraphQL Client Cache Policies
Set per-field cache and fetch policies so lists refresh when needed, single entities stay cache-first, and mutations update the cache without a refetch.
Limit GraphQL Query Complexity
Compute a cost for each query from field weights and list multipliers, reject queries above a budget, and return a clear error before execution.
Use Conditional Requests to Save Bandwidth
Store the ETag or Last-Modified value, send it back with If-None-Match, and handle the 304 so unchanged resources cost almost nothing.
Add Keyset Pagination to a SQL Endpoint
Page by a stable ordered key instead of OFFSET so deep pages stay fast and rows are neither skipped nor duplicated as data changes.
Use a Makefile as the Task Runner
Define phony targets for build, test, lint, and deploy, mark them .PHONY, and keep the Makefile as the discoverable entry point for the project.
Refresh a Materialized View without Blocking Reads
Build a materialized view for an expensive aggregate, refresh it concurrently, and manage the unique index that concurrent refresh requires.
Require mTLS for Service-to-Service Calls
Issue client certificates, configure the server to require and verify them, and validate the chain and identity so only trusted services can connect.
Guard MySQL Online DDL Changes
Check whether an ALTER can use INPLACE or INSTANT, set lock and timeout limits, and use a shadow-table tool for changes that would otherwise block writes.
Apply Default-Deny Network Policies
Deny all pod traffic by default, then allow only the flows each workload needs, so a compromised pod cannot reach unrelated services.
Add OAuth Device Authorization for CLI Clients
Use the device authorization grant so a command-line tool can authenticate through the browser without a local callback and without embedding secrets.
Generate a CSR and Key with OpenSSL
Create a private key, generate a CSR with the correct subject and SANs, verify it, and keep the key protected so a certificate can be issued cleanly.
Register a Passkey with WebAuthn
Offer a WebAuthn registration ceremony, store the credential public key and counter, and verify assertions on login without ever storing a shared secret.
Spread Critical Pods with Anti-Affinity
Use pod anti-affinity or topology spread so replicas of a critical service never land on the same node or zone, surviving a single failure.
Run a Nearby Query with PostGIS
Store locations as geography points, build a GiST index, and query with ST_DWithin so radius searches use the index and return in meters.
Mask Sensitive Columns with a View
Expose masked columns through a view for support and analytics roles, grant access to the view instead of the table, and keep the raw table restricted.
Keep Formatting Deterministic with Prettier
Run Prettier as the single formatting authority, add ignore files for generated output, and enforce it in CI so diffs never mix formatting with logic.
Enforce Protobuf Field Compatibility in CI
Catch wire-incompatible schema changes by comparing the new descriptor against the released one and failing the build on removed or renumbered fields.
Add a Read-Through Result Cache
Cache expensive query results keyed by a normalized query plus tenant, invalidate on writes, and set a TTL so stale data cannot persist after a missed invalidation.
Adopt Quorum Queues for Durable Messaging
Replace classic mirrored queues with quorum queues to get raft-based replication, safer failover, and predictable behavior under broker restarts.
Use a Distributed Lock with Fencing
Acquire a lock with a token, renew it with a watchdog, and guard the critical section with a fencing token so a delayed holder cannot corrupt shared state.
Propagate Request Deadlines Downstream
Pass an absolute deadline to every downstream call, budget the time between hops, and cancel work when the deadline passes instead of waiting indefinitely.
Enforce Row-Level Security in Postgres
Enable row-level security, write policies that filter by the current tenant, and force policies even for the table owner so isolation is enforced by the database.
Coordinate a Saga with Compensating Actions
Break a multi-service operation into local steps, define a compensation for each step, and run compensations in reverse order when a later step fails.
Refresh SAML Metadata Automatically
Store the identity provider metadata, rotate signing certificates before they expire, and validate assertion signatures against the current and next keys.
Serve an Offline Page with a Service Worker
Precache a shell and a fallback page, use a network-first strategy for navigation, and clean up old caches so users see a clear offline experience.
Add a Restore Path for Soft Deletes
Mark rows deleted instead of removing them, filter them from normal queries, and expose restore and purge endpoints with clear retention rules.
Pin CDN Assets with Subresource Integrity
Add SRI hashes to third-party scripts and styles, use crossorigin correctly, and regenerate hashes when the asset version changes so a hijacked CDN cannot inject code.