services / Azure / AKS cluster custom resources

Arbitrary Kubernetes custom resources (CRD-backed objects) inside an AKS managed cluster, accessed via the AKS data plane. These objects hold operator state, application configuration, and CRDs that can wrap secret-like or sensitive operational data.

Data-plane access to in-cluster objects for a single cluster function; sensitivity depends on what CRDs the cluster hosts.

Microsoft.​ContainerService/​managedClusters/​customresources/​write

Creating/updating arbitrary custom resources lets an attacker alter operational cluster state and drive controllers/operators that act on those objects.

Risks

1. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links