services / Azure / Fleet TrafficManagerProfile resource

A Kubernetes Fleet networking CRD (TrafficManagerProfile) that defines the Azure Traffic Manager DNS-based global routing configuration (routing method, domain, endpoint list) for fleet services.

Data-plane (isDataAction) resource controlling public DNS-based traffic routing of a domain to fleet service endpoints.

Microsoft.​ContainerService/​managedClusters/​networking.​fleet.​azure.​com/​trafficManagerProfiles/​write

Creating/updating rewrites DNS-based routing and endpoints for the profile's domain, letting an attacker redirect public domain traffic to attacker-controlled targets, alter routing, and extend network reach.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links