# Authn Authz Relaxation

> Authn Authz Relaxation is an Agent Skill for devops & security published in the kubernetes-sigs/kueue repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

- Skill name: `authn-authz-relaxation`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/kubernetes-sigs/kueue/blob/HEAD/cmd/experimental/skills/reviewer/security/authn-authz-relaxation/SKILL.md
- Repository: kubernetes-sigs/kueue (2,719 GitHub stars when collected)

## SKILL.md

# Skill: AuthN / AuthZ Relaxation

- Webhook handlers that skip token validation or trust `X-Forwarded-For` /
  `X-Remote-User` (CWE-287, CWE-306).
- New admission webhooks registered with `failurePolicy: Ignore` without explicit,
  documented justification (CWE-352-class bypass).
- Privileged operations (cross-namespace reads, secret reads, impersonation) on a
  tenant's behalf without a preceding `SubjectAccessReview`.
- New ClusterRoles with wildcard verbs (`*`) or resources (`*`). New RBAC must use
  minimum verbs and prefer `RoleBinding` over `ClusterRoleBinding` where namespace
  scope suffices (CWE-269, CWE-862, CWE-863).
- `Secret` reads via a blanket cluster-wide verb instead of `resourceNames` scoping.
- Pod specs setting `HostPID`, `HostNetwork`, `HostIPC`, `privileged: true`,
  `allowPrivilegeEscalation: true`, mounting sensitive host paths
  (`/etc/kubernetes`, `/var/run/docker.sock`), or dropping `runAsNonRoot: true`.

---

Source: https://www.openparable.com/skill/devops-security/authn-authz-relaxation (OpenParable). Cite the canonical URL above.