services / Azure / Kubernetes custom resources (fleet)

This data-plane permission covers reading arbitrary Kubernetes custom resources (CRD-backed objects) across the fleet's member clusters, which can hold operator/controller configuration, application state, policy, and frequently secret-adjacent or credential-bearing data.

A wildcard over custom resources spans whatever CRDs are installed; CR specs/status routinely embed connection details, configuration, and sensitive operational data, making the asset broadly sensitive across the fleet.

Microsoft.​ContainerService/​fleets/​customresources/​delete

Deleting arbitrary custom resources destroys operator/CRD-managed state across the fleet and disrupts the controllers and workloads that depend on those resources; deleting security-enforcing CRDs can also weaken defenses.

Risks

1. Data destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links