delete customresourcedefinitions
Deleting a CustomResourceDefinition garbage-collects every custom resource of that type, so an operator or policy controller loses both its API and its stored configuration at once.
Whether it then fails open or refuses to admit anything is implementation-specific, so treat this as destruction of a control rather than a dependable way to disable enforcement.
- API Group
- apiextensions.k8s.io
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
Delete the CRD that a security controller or operator reconciles.
Deleting a CRD garbage-collects every custom resource of that type, so the controller's policy objects go with it.
Whether the controller then fails open or fails closed is implementation-specific.
Losing its input can equally stop it admitting anything.
Treat this as loss of a control and of its configuration, not as a reliable route to a privileged workload.
Additional rights needed: