services / Azure / Fleet Work

A Kubernetes Fleet Manager Work resource is the envelope that carries the concrete, rendered set of Kubernetes manifests the fleet agent reconciles onto a specific member cluster; it is the unit of actual manifest application.

Because Work objects embed the full manifest payload deployed to member clusters, they can contain inline configuration and secret-bearing objects, and writing them directly controls what runs on member clusters.

Microsoft.​ContainerService/​fleets/​placement.​kubernetes-​fleet.​io/​works/​read

Reading a Work object enumerates the deployed workload topology and exposes the full content of the propagated manifests, which can include inline Secret/ConfigMap objects and other sensitive workload configuration.

Risks

1. Data exfiltration (CRITICAL)
2. Infrastructure discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links