CRD stands for Custom Resource Definition. In Kubernetes, a CRD extends the API by adding a new resource type that behaves like a built-in object, such as Pods or Services. Operators and controllers use CRDs to model application-specific state, then watch and reconcile those objects automatically.
CRDs matter in security because they increase the amount of API surface a controller can touch. If a controller is granted overly broad RBAC permissions on CRDs or the workloads they drive, it may read sensitive data, create new Pods, or influence cluster behavior beyond its intended job. Defenders should scope access narrowly, separate responsibilities by namespace or role, and review whether a controller truly needs read, write, or watch permissions for each resource type.