services / Azure / Kubernetes secrets

Kubernetes Secret objects in an Azure Arc-connected cluster. Secrets store sensitive credential material such as service-account tokens, passwords, TLS private keys, registry credentials, and connection strings used by workloads.

Secret reads return raw credential material in cleartext, making this resource type a primary target for credential theft, identity takeover, and lateral movement.

Microsoft.​Kubernetes/​connectedClusters/​secrets/​delete

Deleting secrets destroys cryptographic/credential material (keys, tokens, certificates) and breaks the workloads that mount them, causing denial of service.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links