services / Azure / Kubernetes PodSecurityPolicies (AKS Fleet member)

Kubernetes PodSecurityPolicy objects on a member cluster of an AKS Fleet. PSPs are admission-control rules that constrain which pod security capabilities (privileged, hostPath/hostNetwork mounts, runAsRoot, capabilities) workloads may request.

PSPs are a cluster security-enforcement defense gating container-to-node escape; loosening or removing them enables privileged workloads.

Microsoft.​ContainerService/​fleets/​members/​policy/​podsecuritypolicies/​use/​action

The PSP 'use' verb authorizes a workload to be admitted under a given (potentially permissive) policy, letting an attacker launch privileged/host-mounting pods that would otherwise be restricted, enabling node escape and host-level escalation.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links