authn-authz-relaxation

Étoiles2 737

Forks699

Mis à jour1 juin 2026 à 15:28

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

kubernetes-sigs

kubernetes-sigs/kueue

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	authn-authz-relaxation
description	Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: AuthN / AuthZ Relaxation

Webhook handlers that skip token validation or trust X-Forwarded-For / X-Remote-User (CWE-287, CWE-306).
New admission webhooks registered with failurePolicy: Ignore without explicit, documented justification (CWE-352-class bypass).
Privileged operations (cross-namespace reads, secret reads, impersonation) on a tenant's behalf without a preceding SubjectAccessReview.
New ClusterRoles with wildcard verbs (*) or resources (*). New RBAC must use minimum verbs and prefer RoleBinding over ClusterRoleBinding where namespace scope suffices (CWE-269, CWE-862, CWE-863).
Secret reads via a blanket cluster-wide verb instead of resourceNames scoping.
Pod specs setting HostPID, HostNetwork, HostIPC, privileged: true, allowPrivilegeEscalation: true, mounting sensitive host paths (/etc/kubernetes, /var/run/docker.sock), or dropping runAsNonRoot: true.

Plus depuis ce dépôt

même dépôt

was-cluster

kubernetes-sigs/kueue

Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.

2026-07-102.7k

avoidable-complexity

kubernetes-sigs/kueue

Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.

2026-06-012.7k

duplicated-logic

kubernetes-sigs/kueue

Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.

2026-06-012.7k

illogical-structure

kubernetes-sigs/kueue

Flag code organization that a future maintainer will struggle to follow, modify, or extend.

2026-06-012.7k

misplaced-logic

kubernetes-sigs/kueue

Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.

2026-06-012.7k

nonsensical-decisions

kubernetes-sigs/kueue

Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.

2026-06-012.7k

name	authn-authz-relaxation
description	Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: AuthN / AuthZ Relaxation

Webhook handlers that skip token validation or trust X-Forwarded-For / X-Remote-User (CWE-287, CWE-306).
New admission webhooks registered with failurePolicy: Ignore without explicit, documented justification (CWE-352-class bypass).
Privileged operations (cross-namespace reads, secret reads, impersonation) on a tenant's behalf without a preceding SubjectAccessReview.
New ClusterRoles with wildcard verbs (*) or resources (*). New RBAC must use minimum verbs and prefer RoleBinding over ClusterRoleBinding where namespace scope suffices (CWE-269, CWE-862, CWE-863).
Secret reads via a blanket cluster-wide verb instead of resourceNames scoping.
Pod specs setting HostPID, HostNetwork, HostIPC, privileged: true, allowPrivilegeEscalation: true, mounting sensitive host paths (/etc/kubernetes, /var/run/docker.sock), or dropping runAsNonRoot: true.