services / Azure / Fleet hub Kubernetes initializer configurations

Initializer configurations are cluster-scoped Kubernetes admission-control objects on the Fleet Manager hub cluster that register interceptors which can gate or mutate objects during admission to the API server.

Admission-control configuration is a cluster-admin-tier security primitive; controlling it can influence every object created cluster-wide.

Microsoft.​ContainerService/​fleets/​admissionregistration.​k8s.​io/​initializerconfigurations/​delete

Deleting initializer configurations removes admission-control enforcement that may act as a security guardrail, disabling an admission-time defense for the cluster.

Risks

1. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links