services / Azure / Kubernetes PodSecurityPolicies (Fleet)

PodSecurityPolicies are cluster-level admission-control objects that constrain what pods may do (privileged mode, hostPath/hostNetwork/hostPID, capabilities, volume types), enforcing a pod-security defense across an AKS Fleet's member clusters.

A security defense mechanism; weakening or removing it permits privileged pods that can escalate to node/cluster control.

Microsoft.​ContainerService/​fleets/​policy/​podsecuritypolicies/​use/​action

The 'use' verb authorizes a subject to create pods bound to a (potentially permissive) PSP; using a privileged policy lets a controlled workload run with elevated capabilities, escalating to the node.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links