services / Azure / Kubernetes admission initializer configurations (AKS)

Cluster-wide Kubernetes admission control objects (initializerconfigurations) on an AKS managed cluster that intercept API server requests and can gate or initialize objects before they are persisted.

Admission registration objects are the cluster's enforcement points for security policy; controlling them affects every workload cluster-wide. initializerconfigurations is a deprecated/removed alpha admission mechanism.

Microsoft.​ContainerService/​managedClusters/​admissionregistration.​k8s.​io/​initializerconfigurations/​delete

Deleting initializer configurations removes admission-time enforcement, disabling a cluster-wide defense and the access-control/policy gating applied at admission.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links