services / Azure / AKS Fleet member Kubernetes custom resources

Arbitrary Kubernetes custom resources (CRD instances) on a member cluster of an AKS Fleet, accessed through the Azure RBAC data plane. Custom resources back operators and controllers (e.g. cert-manager, external-secrets, ingress, service mesh) and often store credentials, certificates, and operational configuration.

This permission spans ALL custom resource types in the cluster, so its blast radius depends on which operators are installed; many CRDs hold or reference sensitive material.

Microsoft.​ContainerService/​fleets/​members/​customresources/​write

Writing arbitrary custom resources alters operator/controller-managed state and can drive controllers to provision workloads or grant identities/access, enabling tampering and lateral movement.

Risks

1. Data manipulation (HIGH)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links