Annotation Label Namespace Abuse

Flag generic loops over obj.Annotations that copy, forward, or echo values — allow tenant injection into reserved kueue.x-k8s.io/ namespace.

kubernetes-sigs Updated

File contents

Skill: Annotation/Label Namespace Abuse

  • Generic loops over obj.Annotations that copy, forward, or echo values — these allow tenant injection into the reserved kueue.x-k8s.io/ namespace and leak operator-set values across boundaries. Forwarding between CRs must go through an explicit allowlist.

kubernetes-sigs/kueue/tree/main/cmd/experimental/skills/reviewer/security/annotation-label-namespace-abuse commit 7896968340

Frequently asked questions

npx skillmds@latest add kubernetes-sigs-kueue/annotation-label-namespace-abuse