원클릭으로 Manus에서 모든 스킬 실행

authn-authz-relaxation

스타2,737

포크699

업데이트2026년 6월 1일 15:28

Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

kubernetes-sigs

kubernetes-sigs/kueue

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Skill: AuthN / AuthZ Relaxation

Webhook handlers that skip token validation or trust X-Forwarded-For / X-Remote-User (CWE-287, CWE-306).
New admission webhooks registered with failurePolicy: Ignore without explicit, documented justification (CWE-352-class bypass).
Privileged operations (cross-namespace reads, secret reads, impersonation) on a tenant's behalf without a preceding SubjectAccessReview.
New ClusterRoles with wildcard verbs (*) or resources (*). New RBAC must use minimum verbs and prefer RoleBinding over ClusterRoleBinding where namespace scope suffices (CWE-269, CWE-862, CWE-863).
Secret reads via a blanket cluster-wide verb instead of resourceNames scoping.
Pod specs setting HostPID, HostNetwork, HostIPC, privileged: true, allowPrivilegeEscalation: true, mounting sensitive host paths (/etc/kubernetes, /var/run/docker.sock), or dropping runAsNonRoot: true.

이 저장소의 다른 Skills

같은 저장소

was-cluster

kubernetes-sigs/kueue

Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.

2026-07-102.7k

avoidable-complexity

kubernetes-sigs/kueue

Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.

2026-06-012.7k

duplicated-logic

kubernetes-sigs/kueue

Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.

2026-06-012.7k

illogical-structure

kubernetes-sigs/kueue

Flag code organization that a future maintainer will struggle to follow, modify, or extend.

2026-06-012.7k

misplaced-logic

kubernetes-sigs/kueue

Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.

2026-06-012.7k

nonsensical-decisions

kubernetes-sigs/kueue

Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.

2026-06-012.7k

name	authn-authz-relaxation
description	Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: AuthN / AuthZ Relaxation

Webhook handlers that skip token validation or trust X-Forwarded-For / X-Remote-User (CWE-287, CWE-306).
New admission webhooks registered with failurePolicy: Ignore without explicit, documented justification (CWE-352-class bypass).
Privileged operations (cross-namespace reads, secret reads, impersonation) on a tenant's behalf without a preceding SubjectAccessReview.
New ClusterRoles with wildcard verbs (*) or resources (*). New RBAC must use minimum verbs and prefer RoleBinding over ClusterRoleBinding where namespace scope suffices (CWE-269, CWE-862, CWE-863).
Secret reads via a blanket cluster-wide verb instead of resourceNames scoping.
Pod specs setting HostPID, HostNetwork, HostIPC, privileged: true, allowPrivilegeEscalation: true, mounting sensitive host paths (/etc/kubernetes, /var/run/docker.sock), or dropping runAsNonRoot: true.