services / Azure / AKS Kubernetes cluster roles

A Kubernetes ClusterRole defines a set of permissions over cluster-scoped and namespaced resources across the entire cluster. On AKS this is a data-plane RBAC permission definition.

Cluster roles define cluster-wide permission sets (up to cluster-admin); they are core cluster access-control policy objects.

Microsoft.​ContainerService/​managedClusters/​rbac.​authorization.​k8s.​io/​clusterroles/​delete

Deleting a ClusterRole destroys a cluster-wide access-control policy definition and breaks every binding referencing it, revoking the permissions of all bound subjects and denying authorized operational access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links