A controller or scheduled workload granted excessive scope may repeatedly create or restore unauthorized resources and configuration through its reconciliation loop. Manual remediation can then be overwritten, restoring unsafe cluster state that exposes workload data or interferes with service availability.
Controllers Reconcile Unauthorized Cluster State
CCC.K8S.TH13
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP06 | Declarative Workload Orchestration | The service automatically reconciles Kubernetes workload resources toward their user-declared state by scheduling, restarting, and replacing containers as needed. |
| CCC.K8S.CP14 | Managed Cluster Extensions | The service can manage the installation and lifecycle of supported extensions for networking, storage, policy, observability, and workload management. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN02 | Enforce Least-Privilege Cluster Authorization | Apply least privilege across cloud and Kubernetes authorization so identities receive only the permissions required for their cluster responsibilities. |
| CCC.K8S.CN11 | Protect Admission Control Enforcement | Apply mandatory cluster security policy to every workload path and prevent its scope or enforcement configuration from being bypassed or modified without authorization. |