services / Azure / Kubernetes CertificateSigningRequests (AKS fleet member)

CertificateSigningRequest objects on a Kubernetes cluster that is a member of an AKS fleet. They request that the cluster CA sign a client certificate for a named username/group, and approved requests carry the issued signed certificate in their status.

CSRs are the classic Kubernetes credential-minting primitive: approved requests expose usable client certificates, and creating them lets a principal request credentials for arbitrary identities including cluster-admin groups (system:masters).

Microsoft.​ContainerService/​fleets/​members/​certificates.​k8s.​io/​certificatesigningrequests/​delete

Deleting CSRs removes pending/issued certificate-signing requests and their embedded signed certificate material, disrupting legitimate credential issuance and blocking authorized principals from obtaining certificates.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links