services / Azure / Kubernetes PodSecurityPolicies (Fleet)

PodSecurityPolicies are cluster-level admission-control objects that constrain what pods may do (privileged mode, hostPath/hostNetwork/hostPID, capabilities, volume types), enforcing a pod-security defense across an AKS Fleet's member clusters.

A security defense mechanism; weakening or removing it permits privileged pods that can escalate to node/cluster control.

Microsoft.​ContainerService/​fleets/​policy/​podsecuritypolicies/​write

Writing a PSP can relax admission controls (allow privileged/hostPath/hostPID pods), disabling a defense and enabling deployment of privileged pods that escalate to the node/cluster.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links