services / Azure / Kubernetes initializer configurations (admission control)

Cluster-wide Kubernetes initializerConfiguration objects (admissionregistration.k8s.io) that register admission-control initializers intercepting and gating object creation across the entire AKS-managed cluster.

Admission-control objects are cluster-wide security enforcement points; controlling them is effectively cluster-admin over policy enforcement, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​initializerconfigurations/​write

Creating/updating cluster-wide initializer configurations lets an attacker intercept and mutate every object creation, injecting privileged config into incoming resources while disabling existing admission-based security enforcement.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links