services / Azure / Kubernetes secrets (Fleet member)

Kubernetes Secret objects in a namespace of an AKS Fleet member cluster. They hold credential material such as service-account tokens, TLS private keys, image-pull credentials, passwords, and connection strings consumed by workloads.

Secrets are first-class credential stores; reading them yields directly usable identity material enabling lateral movement and takeover across the cluster and connected systems.

Microsoft.​ContainerService/​fleets/​members/​secrets/​delete

Deleting Secrets destroys cryptographic/credential material (keys, tokens, certs) that workloads depend on, irreversibly removing secret data and disrupting pods that fail to mount or authenticate.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links