services / Azure / Kubernetes Roles

Kubernetes Roles in an AKS-managed aiManagers cluster, which define sets of RBAC permission rules (verbs over resources) that are granted to subjects via bindings.

Role definitions are core cluster access-control policy; manipulating them governs the permission surface up to cluster-admin.

Microsoft.​ContainerService/​aiManagers/​rbac.​authorization.​k8s.​io/​roles/​escalate/​action

The Kubernetes 'escalate' verb explicitly bypasses the privilege-escalation prevention guard, allowing the holder to grant permissions exceeding their own, up to cluster-admin.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links