services / Azure / Kubernetes initializer configurations (admission control)

Cluster-wide Kubernetes initializerConfiguration objects (admissionregistration.k8s.io) that register admission-control initializers intercepting and gating object creation across the entire AKS-managed cluster.

Admission-control objects are cluster-wide security enforcement points; controlling them is effectively cluster-admin over policy enforcement, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​initializerconfigurations/​delete

Deleting initializer configurations removes cluster-wide admission enforcement, disabling a security defense and the policy it imposes so previously-constrained malicious object creation proceeds unchecked.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links