services / Azure / Kubernetes pod security policies (Arc-connected cluster)

PodSecurityPolicies are Kubernetes admission-control objects in an Azure Arc-connected cluster that constrain the security context of pods (e.g. privileged mode, hostPath, host namespaces, runAsRoot), acting as a cluster security/defense mechanism.

PSPs are a defensive admission control; their configuration reveals where privileged-pod restrictions are weak.

Microsoft.​Kubernetes/​connectedClusters/​policy/​podsecuritypolicies/​use/​action

The 'use' verb authorizes a subject to admit pods under a given PSP; targeting a permissive policy lets an attacker launch privileged/host-access containers to escalate from container to node/cluster control and run arbitrary workloads.

Risks

1. Privilege escalation (CRITICAL)
2. Resource hijacking (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links