services / Azure / Kubernetes PodSecurityPolicies

PodSecurityPolicies are cluster-scoped Kubernetes admission-control objects that constrain which pod security attributes (privileged mode, host namespaces, hostPath volumes, capabilities, runAsRoot) are permitted when workloads are admitted to the cluster.

These are cluster-wide security-enforcement guardrails; weakening or bypassing them enables container breakout to node and cluster-admin level compromise.

Microsoft.​ContainerService/​aiManagers/​policy/​podsecuritypolicies/​write

Creating or updating a PodSecurityPolicy lets an attacker weaken or replace the admission-control defense to permit privileged/hostPath/host-namespace pods, disabling a security control and enabling pod-breakout privilege escalation to node/cluster-admin.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links