services / Azure / Kubernetes cluster roles (AKS Fleet)

Kubernetes ClusterRole objects in an AKS Fleet cluster, defining cluster-wide RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via (Cluster)RoleBindings.

ClusterRoles are cluster-wide access-control definitions; control over them (and the ability to bind/escalate them) can lead to full cluster-admin, the canonical CRITICAL RBAC asset.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​clusterroles/​escalate/​action

The escalate verb explicitly bypasses Kubernetes privilege-escalation prevention, letting the holder grant a ClusterRole permissions exceeding their own up to cluster-admin.

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links