services / Azure / AKS Fleet member Kubernetes pods

Kubernetes Pods on a member cluster of an AKS Fleet, accessed through the Azure RBAC data plane. A Pod is the running unit of workload; its spec includes container images, command args, environment variables, and references to mounted secrets/configmaps and service-account tokens.

Pods are the production workload of a single cluster (one organizational function). Pod specs frequently embed sensitive configuration and reference credentials, and the cluster's service-account tokens grant in-cluster identity.

Microsoft.​ContainerService/​fleets/​members/​pods/​exec/​action

Exec yields an interactive shell inside a running container as the pod's identity, enabling arbitrary code execution, reading in-container data and the mounted service-account token for lateral movement, and tampering with the workload.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links