services / Azure / AKS cluster custom resources

Arbitrary Kubernetes custom resources (CRD-backed objects) inside an AKS managed cluster, accessed via the AKS data plane. These objects hold operator state, application configuration, and CRDs that can wrap secret-like or sensitive operational data.

Data-plane access to in-cluster objects for a single cluster function; sensitivity depends on what CRDs the cluster hosts.

Microsoft.​ContainerService/​managedClusters/​customresources/​delete

Deleting custom resources destroys in-cluster data/configuration objects and the controller state managed via CRDs.

Risks

1. Data destruction (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links