services / Azure / Kubernetes PodSecurityPolicies (Fleet)

PodSecurityPolicies are cluster-level admission-control objects that constrain what pods may do (privileged mode, hostPath/hostNetwork/hostPID, capabilities, volume types), enforcing a pod-security defense across an AKS Fleet's member clusters.

A security defense mechanism; weakening or removing it permits privileged pods that can escalate to node/cluster control.

Microsoft.​ContainerService/​fleets/​policy/​podsecuritypolicies/​delete

Deleting a PSP removes the admission-control enforcement that restricts pod privileges, disabling a defense so otherwise-restricted privileged pods can run.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links