# Authn Authz Relaxation

> Flag AuthN/AuthZ relaxation — webhook token skipping, failurePolicy Ignore, missing SubjectAccessReview, wildcard RBAC, privileged pod specs (CWE-269, CWE-287, CWE-306, CWE-862, CWE-863).

- Skill: `kubernetes-sigs-kueue/authn-authz-relaxation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/authn-authz-relaxation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/authn-authz-relaxation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/authn-authz-relaxation

---


# Skill: AuthN / AuthZ Relaxation

- Webhook handlers that skip token validation or trust `X-Forwarded-For` /
  `X-Remote-User` (CWE-287, CWE-306).
- New admission webhooks registered with `failurePolicy: Ignore` without explicit,
  documented justification (CWE-352-class bypass).
- Privileged operations (cross-namespace reads, secret reads, impersonation) on a
  tenant's behalf without a preceding `SubjectAccessReview`.
- New ClusterRoles with wildcard verbs (`*`) or resources (`*`). New RBAC must use
  minimum verbs and prefer `RoleBinding` over `ClusterRoleBinding` where namespace
  scope suffices (CWE-269, CWE-862, CWE-863).
- `Secret` reads via a blanket cluster-wide verb instead of `resourceNames` scoping.
- Pod specs setting `HostPID`, `HostNetwork`, `HostIPC`, `privileged: true`,
  `allowPrivilegeEscalation: true`, mounting sensitive host paths
  (`/etc/kubernetes`, `/var/run/docker.sock`), or dropping `runAsNonRoot: true`.