services / Azure / AKS Kubernetes PodSecurityPolicies

In-cluster Kubernetes PodSecurityPolicy admission-control objects that constrain what pods may do (privileged mode, hostPath/hostNetwork, capabilities) in an AKS managed cluster's data plane.

PSPs are an admission-time security/access-control defense gating workload privileges; weakening them enables container-escape and node/cluster compromise for a single cluster (organizational function).

Microsoft.​ContainerService/​managedClusters/​extensions/​podsecuritypolicies/​write

Creating/updating PodSecurityPolicies lets an attacker relax admission constraints to permit privileged/hostPath/hostNetwork pods, disabling a defense and enabling node/cluster privilege escalation via container escape.

Risks

1. Privilege escalation (CRITICAL)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links