services / Azure / AKS Kubernetes cluster roles

A Kubernetes ClusterRole defines a set of permissions over cluster-scoped and namespaced resources across the entire cluster. On AKS this is a data-plane RBAC permission definition.

Cluster roles define cluster-wide permission sets (up to cluster-admin); they are core cluster access-control policy objects.

Microsoft.​ContainerService/​managedClusters/​rbac.​authorization.​k8s.​io/​clusterroles/​write

Creating/updating a ClusterRole lets an attacker craft or expand a role's permission set, escalating the cluster-wide privileges of every subject already bound to that role (including controlled identities).

Risks

1. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links