services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects (certificates.k8s.io) used to request and issue X.509 client/serving certificates that authenticate identities to the cluster API server.

An approved CSR's status.certificate field contains a signed client certificate that is a usable cluster credential; CSRs are a well-known Kubernetes privilege-escalation and credential-minting vector, making this a CRITICAL identity/credential asset.

Microsoft.​ContainerService/​aiManagers/​certificates.​k8s.​io/​certificatesigningrequests/​delete

Deleting CSRs removes pending/issued certificate-signing requests and their associated signed-certificate material, destroying cryptographic identity artifacts and disrupting certificate provisioning.

Risks

1. Cryptographic destruction (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links