services / Azure / Kubernetes cluster roles (AKS Fleet)

Kubernetes ClusterRole objects in an AKS Fleet cluster, defining cluster-wide RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via (Cluster)RoleBindings.

ClusterRoles are cluster-wide access-control definitions; control over them (and the ability to bind/escalate them) can lead to full cluster-admin, the canonical CRITICAL RBAC asset.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​clusterroles/​delete

Deleting ClusterRoles removes cluster-wide access-control policy, which both tears down RBAC controls and can revoke legitimate operators' authorized access (denial-of-access).

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links