services / Azure / AKS pod security policies

A PodSecurityPolicy is a cluster-wide Kubernetes admission-control object that constrains what pods may run (privileged mode, host namespaces, hostPath/hostNetwork, capabilities). On AKS this is a data-plane resource governing the cluster's pod-security defense posture.

PSPs are a security-enforcement defense mechanism: weakening or removing them lets privileged/host-mounting pods run, which is the standard path to container breakout and node/cluster compromise.

Microsoft.​ContainerService/​managedClusters/​policy/​podsecuritypolicies/​write

Creating/updating a PodSecurityPolicy lets an attacker weaken or replace the admission-control defense (permit privileged/hostPath/hostNetwork pods), disabling a security control and enabling privileged-workload deployment that escalates to node/cluster-admin.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links