OpenParable
Skip to content
← Back to skills

Authn Authz Relaxation

DevOps & Security
authn-authz-relaxation

Authn Authz Relaxation is an Agent Skill for devops & security published in the kubernetes-sigs/kueue repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/kubernetes-sigs/kueue/blob/HEAD/cmd/experimental/skills/reviewer/security/authn-authz-relaxation/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/authn-authz-relaxation, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Skill: AuthN / AuthZ Relaxation

  • Webhook handlers that skip token validation or trust X-Forwarded-For / X-Remote-User (CWE-287, CWE-306).
  • New admission webhooks registered with failurePolicy: Ignore without explicit, documented justification (CWE-352-class bypass).
  • Privileged operations (cross-namespace reads, secret reads, impersonation) on a tenant's behalf without a preceding SubjectAccessReview.
  • New ClusterRoles with wildcard verbs (*) or resources (*). New RBAC must use minimum verbs and prefer RoleBinding over ClusterRoleBinding where namespace scope suffices (CWE-269, CWE-862, CWE-863).
  • Secret reads via a blanket cluster-wide verb instead of resourceNames scoping.
  • Pod specs setting HostPID, HostNetwork, HostIPC, privileged: true, allowPrivilegeEscalation: true, mounting sensitive host paths (/etc/kubernetes, /var/run/docker.sock), or dropping runAsNonRoot: true.