services / Azure / Kubernetes CertificateSigningRequests

Kubernetes CertificateSigningRequest objects in an AKS fleet, which request and (once approved/signed) carry issued client certificates used to authenticate identities to the cluster API.

CSRs are PKI/credential material: an approved CSR's status field contains a signed client certificate usable to authenticate as an arbitrary subject, including cluster-admin groups.

Microsoft.​ContainerService/​fleets/​certificates.​k8s.​io/​certificatesigningrequests/​delete

Deleting CSRs destroys pending/issued certificate-signing material and can block legitimate principals from obtaining the certificates they are awaiting, denying authorized access provisioning.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links