services / Azure / AKS Kubernetes PodSecurityPolicies

In-cluster Kubernetes PodSecurityPolicy admission-control objects that constrain what pods may do (privileged mode, hostPath/hostNetwork, capabilities) in an AKS managed cluster's data plane.

PSPs are an admission-time security/access-control defense gating workload privileges; weakening them enables container-escape and node/cluster compromise for a single cluster (organizational function).

Microsoft.​ContainerService/​managedClusters/​extensions/​podsecuritypolicies/​delete

Deleting PodSecurityPolicies removes the admission-control security policy that restricts privileged workloads, disabling a defense, destroying access-control policy, and permitting privileged pods that escalate to the node/host.

Risks

1. Policy destruction (CRITICAL)
2. Privilege escalation (CRITICAL)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links