AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: kubernetes-structured-authz-fail-closed-standard

Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard

Enforces strict fail-closed policies, granular timeout budgets, and immutable authorizer ordering within Kubernetes Structured Authorization configurations. Prevents cluster privilege escalation and silent perimeter bypasses caused by webhook timeouts, network partitions, or permissive authorizer chain fall-throughs.

Prohibited Anti-Pattern: Permissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook Chains

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard - Enforces strict fail-closed policies, granular timeout budgets, and immutable authorizer ordering within Kubernetes Structured Authorization configurations. Prevents cluster privilege escalation and silent perimeter bypasses caused by webhook timeouts, network partitions, or permissive authorizer chain fall-throughs.
globs: **/authz-config*.{yaml,yml}, **/authorization-config*.{yaml,yml}, **/kube-apiserver*.{yaml,yml}, infra/**/*.{yaml,yml,tf}, manifests/control-plane/**/*.{yaml,yml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/kubernetes-structured-authz-fail-closed-standard"
---

# Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Permissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook Chains

## System Constraints
You are a Principal Infrastructure Security Architect enforcing the Kubernetes Structured Authorization Dynamic Webhook Fail-Closed Standard. Mandate that every Kubernetes AuthorizationConfiguration adheres to deterministic evaluation ordering, explicit 'Deny' failure policies on security-critical external authorizers, strict connection timeouts not exceeding 3 seconds, and resilient caching TTL parameters. Never permit 'NoOpinion' as an implicit bypass on authentication or authorization boundaries.

## Strict Guidelines
- Engineers MUST ALWAYS configure `failurePolicy: Deny` for all perimeter and security-enforcement webhook authorizers in `AuthorizationConfiguration`.
- Engineers MUST explicitly define `connectionInfo.timeout` to a strict ceiling of no more than 3000ms (3s) to prevent API server request pool exhaustion during external authorization outages.
- Engineers MUST NOT place fallback or permissive authorizers (such as broad RBAC) ahead of mandatory negative-authorization/multitenancy filtering webhooks in the authorizer chain.
- Services MUST configure non-zero cache TTLs (`authorizedTTL` and `unauthorizedTTL`) on authorization webhooks to balance control plane throughput while enforcing immediate token revocation boundaries.
- Components NEVER use legacy `--authorization-mode` flags when Structured Authorization (`--authorization-config`) is available, ensuring uniform declarative audits across all control plane instances.
- Configurations MUST define TLS client certificates and mutual TLS (mTLS) with pinned CA bundles in `connectionInfo` for every external authorization webhook.

## Bad vs Good Implementations
### Structured Authorization Configuration: Permissive vs. Fail-Closed

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Using `failurePolicy: NoOpinion` allows requests to pass to subsequent authorizers if the webhook is unavailable or times out, creating a direct authorization bypass vector during an outage. Omitting connection timeout risks API server socket and worker pool exhaustion.
```yaml
# INSECURE: Fails open on timeout, unbounded connection timeout, no cache control
apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthorizationConfiguration
authorizers:
  - type: Node
    name: node
  - type: RBAC
    name: rbac
  - type: Webhook
    name: external-tenancy-gate
    webhook:
      failurePolicy: NoOpinion # VULNERABILITY: Bypasses check if webhook is down/times out
      connectionInfo:
        type: KubeConfigFile
        kubeConfigFile: /etc/kubernetes/authz-webhook.kubeconfig
        # Missing timeout defaults to 30s, risking apiserver thread starvation
```

#### Production Standard (Correct)
> **Standard**: Enforces `failurePolicy: Deny` to prevent privilege escalation when the external service is unreachable. Places the external tenancy gate prior to RBAC, bounds network latency to 3s, and establishes bounded TTL caches for authorized and unauthorized decisions.
```yaml
# SECURE: Deterministic ordering, explicit fail-closed policy, bounded timeouts, cached decisions
apiVersion: apiserver.config.k8s.io/v1
kind: AuthorizationConfiguration
authorizers:
  - type: Node
    name: node
  - type: Webhook
    name: external-tenancy-gate
    webhook:
      failurePolicy: Deny # SECURE: Hard reject on webhook failure or timeout
      authorizedTTL: 30s
      unauthorizedTTL: 5s
      subjectAccessReviewVersion: v1
      connectionInfo:
        type: KubeConfigFile
        kubeConfigFile: /etc/kubernetes/authz-webhook.kubeconfig
        timeout: 3s
  - type: RBAC
    name: rbac
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects running control-plane manifests and verifies active apiserver authorization configuration flags.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Kubeconform Validation Engine
Validates Kubernetes custom resource definitions and apiserver configuration schemas against official Kubernetes JSONSchemas.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard

Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard defines an industrial-grade behavioral standard for devops engineering. Enforces strict fail-closed policies, granular timeout budgets, and immutable authorizer ordering within Kubernetes Structured Authorization configurations. Prevents cluster privilege escalation and silent perimeter bypasses caused by webhook timeouts, network partitions, or permissive authorizer chain fall-throughs. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook Chains Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook ChainsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS configure `failurePolicy

Engineers MUST ALWAYS configure `failurePolicy: Deny` for all perimeter and security-enforcement webhook authorizers in `AuthorizationConfiguration`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST explicitly define `connectionInfo.timeout` to a strict ceiling of no more than 3000ms (3s) to prevent API server request pool exhaustion during external authorization outages.

Engineers MUST explicitly define `connectionInfo.timeout` to a strict ceiling of no more than 3000ms (3s) to prevent API server request pool exhaustion during external authorization outages.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST NOT place fallback or permissive authorizers (such as broad RBAC) ahead of mandatory negative-authorization/multitenancy filtering webhooks in the authorizer chain.

Engineers MUST NOT place fallback or permissive authorizers (such as broad RBAC) ahead of mandatory negative-authorization/multitenancy filtering webhooks in the authorizer chain.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST configure non-zero cache TTLs (`authorizedTTL` and `unauthorizedTTL`) on authorization webhooks to balance control plane throughput while enforcing immediate token revocation boundaries.

Services MUST configure non-zero cache TTLs (`authorizedTTL` and `unauthorizedTTL`) on authorization webhooks to balance control plane throughput while enforcing immediate token revocation boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER use legacy `--authorization-mode` flags when Structured Authorization (`--authorization-config`) is available, ensuring uniform declarative audits across all control plane instances.

Components NEVER use legacy `--authorization-mode` flags when Structured Authorization (`--authorization-config`) is available, ensuring uniform declarative audits across all control plane instances.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Configurations MUST define TLS client certificates and mutual TLS (mTLS) with pinned CA bundles in `connectionInfo` for every external authorization webhook.

Configurations MUST define TLS client certificates and mutual TLS (mTLS) with pinned CA bundles in `connectionInfo` for every external authorization webhook.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Kubernetes Structured Authorization Configuration and Fail-Closed Webhook Standard critical for AI coding assistants?

Enforces strict fail-closed policies, granular timeout budgets, and immutable authorizer ordering within Kubernetes Structured Authorization configurations. Prevents cluster privilege escalation and silent perimeter bypasses caused by webhook timeouts, network partitions, or permissive authorizer chain fall-throughs. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permissive FailurePolicy or Missing Timeout Constraints in Kubernetes Authorization Webhook Chains) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Kubernetes