services / Azure / Kubernetes validating webhook configurations (admission control)

Cluster-wide Kubernetes validatingWebhookConfiguration objects (admissionregistration.k8s.io) that register webhooks validating/admitting API requests (e.g. OPA Gatekeeper, Kyverno, Pod Security) across the entire AKS-managed cluster.

Validating admission webhooks are the cluster's primary policy guardrails; controlling them governs what workloads can be admitted, hence CRITICAL asset sensitivity.

Microsoft.​ContainerService/​aiManagers/​admissionregistration.​k8s.​io/​validatingwebhookconfigurations/​delete

Deleting validating webhook configurations removes cluster-wide admission policy validation (Gatekeeper/Pod Security), disabling a key defense so previously-denied privileged or non-compliant resources are admitted unchecked.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links