services / Azure / Kubernetes validating webhook configurations (Fleet)

ValidatingWebhookConfigurations are cluster-scoped Kubernetes admission-control objects that register external/in-cluster webhooks invoked to validate (admit or reject) API requests. In a Fleet they govern admission enforcement across member clusters.

These objects are the cluster's policy-enforcement defense layer (e.g. Pod Security, OPA/Gatekeeper, Kyverno). Controlling them is effectively controlling whether security policy is enforced.

Microsoft.​ContainerService/​fleets/​admissionregistration.​k8s.​io/​validatingwebhookconfigurations/​delete

Deleting webhook configurations removes admission-control enforcement cluster/fleet-wide, disabling the security defense so otherwise-blocked malicious or privileged workloads can be admitted.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links