services / Azure / Kubernetes roles (AKS Fleet)

Kubernetes Role objects in an AKS Fleet cluster, defining namespaced RBAC permission rules (verbs on resources) that grant authorization when bound to subjects via RoleBindings.

Roles are namespaced access-control definitions; combined with bind/escalate they enable privilege escalation, so the RBAC asset class is treated as CRITICAL.

Microsoft.​ContainerService/​fleets/​rbac.​authorization.​k8s.​io/​roles/​delete

Deleting namespaced Roles removes access-control policy, tearing down RBAC controls and potentially revoking legitimate principals' access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links