Ingebouwde Azure-rollen voor containers

Dit artikel bevat de ingebouwde Azure-rollen in de categorie Containers.

AcrDelete

Verwijder opslagplaatsen, tags of manifesten uit een containerregister.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registries/artifacts/delete	Artefact verwijderen in een containerregister.
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr delete",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/artifacts/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrDelete",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrImageSigner

Push vertrouwde installatiekopieën naar of haal vertrouwde installatiekopieën op uit een containerregister dat is ingeschakeld voor inhoudsvertrouwen.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registries/sign/write	Vertrouwensmetagegevens voor push-/pull-inhoud voor een containerregister.
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/trustedCollections/write	Hiermee kunt u vertrouwde verzamelingen containerregisterinhoud pushen of publiceren. Dit is vergelijkbaar met de actie Microsoft.ContainerRegistry/registries/sign/write, behalve dat dit een gegevensactie is
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr image signer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",
  "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/sign/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrImageSigner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPull

Haal artefacten op uit een containerregister.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registries/pull/read	Haal installatiekopieën op uit een containerregister of haal deze op.
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr pull",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPull",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPush

Push artefacten naar of pull-artefacten uit een containerregister.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registries/pull/read	Haal installatiekopieën op uit een containerregister of haal deze op.
Microsoft.ContainerRegistry/registries/push/write	Push- of schrijf installatiekopieën naar een containerregister.
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr push",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",
  "name": "8311e382-0749-4cb8-b61a-304f252e45ec",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.ContainerRegistry/registries/push/write"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPush",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineReader

Haal in quarantaine geplaatste installatiekopieën op uit een containerregister.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registers/quarantaine/lezen	In quarantaine geplaatste installatiekopieën ophalen uit het containerregister
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	Hiermee kunt u de in quarantaine geplaatste artefacten ophalen of ophalen uit het containerregister. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/lezen, behalve dat het een gegevensactie is
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data reader",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",
  "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineReader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineWriter

Push in quarantaine geplaatste installatiekopieën naar of pull in quarantaine geplaatste installatiekopieën uit een containerregister.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerRegistry/registers/quarantaine/lezen	In quarantaine geplaatste installatiekopieën ophalen uit het containerregister
Microsoft.ContainerRegistry/registers/quarantaine/schrijven	Quarantainestatus van in quarantaine geplaatste installatiekopieën schrijven/wijzigen
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	Hiermee kunt u de in quarantaine geplaatste artefacten ophalen of ophalen uit het containerregister. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/lezen, behalve dat het een gegevensactie is
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write	Hiermee staat u het schrijven of bijwerken van de quarantainestatus van in quarantaine geplaatste artefacten toe. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/schrijfactie, behalve dat het een gegevensactie is
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data writer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read",
        "Microsoft.ContainerRegistry/registries/quarantine/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineWriter",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Gebruikersrol Kubernetes-cluster met Azure Arc

Actie voor clustergebruikersreferenties weergeven.

Acties	Beschrijving
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action	ClusterUser-referentie weergeven (preview)
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action	ClusterUser-referentie vermelden
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credentials action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "permissions": [
    {
      "actions": [
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Support/*",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-Beheer

Hiermee kunt u alle resources beheren onder cluster/naamruimte, behalve resourcequota en naamruimten bijwerken of verwijderen.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write	Schrijft localsubjectaccessreviews
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read	Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequota/read	Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-cluster Beheer

Hiermee kunt u alle resources in het cluster beheren.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Viewer

Hiermee kunt u alle resources in cluster/naamruimte weergeven, behalve geheimen.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read	Daemonsets lezen
Microsoft.Kubernetes/connectedClusters/apps/deployments/read	Leesimplementaties
Microsoft.Kubernetes/connectedClusters/apps/replicasets/read	Replicasets lezen
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read	Statefulsets lezen
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read	Leest horizontalepodautoscalers
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read	Leest cronjobs
Microsoft.Kubernetes/connectedClusters/batch/jobs/read	Leestaken
Microsoft.Kubernetes/connectedClusters/configmaps/read	Configmaps lezen
Microsoft.Kubernetes/connectedClusters/endpoints/read	Eindpunten lezen
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read	Daemonsets lezen
Microsoft.Kubernetes/connectedClusters/extensions/deployments/read	Leesimplementaties
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read	Leessteuntjes
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read	Netwerkbeleid lezen
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read	Replicasets lezen
Microsoft.Kubernetes/connectedClusters/limitranges/read	Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read	Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read	Leessteuntjes
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read	Netwerkbeleid lezen
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read	Leest persistentvolumeclaims
Microsoft.Kubernetes/connectedClusters/pods/read	Pods lezen
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read	Gelezen poddisruptionbudgets
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	Replicatiecontrollers lezen
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	Replicatiecontrollers lezen
Microsoft.Kubernetes/connectedClusters/resourcequota/read	Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/serviceaccounts/read	Serviceaccounts lezen
Microsoft.Kubernetes/connectedClusters/services/read	Leesservices
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you view all resources in cluster/namespace, except secrets.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",
  "name": "63f0a09d-1495-4db4-a681-037d84835eb4",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
        "Microsoft.Kubernetes/connectedClusters/pods/read",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
        "Microsoft.Kubernetes/connectedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Viewer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Writer

Hiermee kunt u alles in cluster/naamruimte bijwerken, behalve (cluster)rollen en (cluster)rolbindingen.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read	Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read	Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequota/read	Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",
  "name": "5b999177-9696-4545-85c7-50de3797e5a1",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Rol inzender voor Azure Kubernetes Fleet Manager

Verleent lees-/schrijftoegang tot Azure-resources die worden geleverd door Azure Kubernetes Fleet Manager, waaronder vlootleden, vlootupdatestrategieën, vlootupdateuitvoeringen, enzovoort.

Acties	Beschrijving
Microsoft.ContainerService/fleets/*
Microsoft.Resources/deployments/*	Een implementatie maken en beheren
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "name": "63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/fleets/*",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC-Beheer

Verleent lees-/schrijftoegang tot Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster: biedt schrijfmachtigingen voor de meeste objecten binnen een naamruimte, met uitzondering van het ResourceQuota-object en het naamruimteobject zelf. Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read	Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action	Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write	Schrijft localsubjectaccessreviews
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read	Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	Resourcequota lezen
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "name": "434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC-cluster Beheer

Verleent lees-/schrijftoegang tot alle Kubernetes-resources in het door de vloot beheerde hubcluster.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read	Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action	Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "name": "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC Reader

Verleent alleen-lezentoegang tot de meeste Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster. Het is niet toegestaan om rollen of rolbindingen weer te geven. Deze rol staat het weergeven van geheimen niet toe, omdat het lezen van de inhoud van Geheimen toegang biedt tot ServiceAccount-referenties in de naamruimte, waardoor API-toegang wordt toegestaan als een ServiceAccount in de naamruimte (een vorm van escalatie van bevoegdheden). Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read	Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action	Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/read	Daemonsets lezen
Microsoft.ContainerService/fleets/apps/deployments/read	Leesimplementaties
Microsoft.ContainerService/fleets/apps/statefulsets/read	Statefulsets lezen
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read	Leest horizontalepodautoscalers
Microsoft.ContainerService/fleets/batch/cronjobs/read	Leest cronjobs
Microsoft.ContainerService/fleets/batch/jobs/read	Leestaken
Microsoft.ContainerService/fleets/configmaps/read	Configmaps lezen
Microsoft.ContainerService/fleets/endpoints/read	Eindpunten lezen
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/read	Daemonsets lezen
Microsoft.ContainerService/fleets/extensions/deployments/read	Leesimplementaties
Microsoft.ContainerService/fleets/extensions/ingresses/read	Leessteuntjes
Microsoft.ContainerService/fleets/extensions/networkpolicies/read	Netwerkbeleid lezen
Microsoft.ContainerService/fleets/limitranges/read	Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read	Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read	Leessteuntjes
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read	Netwerkbeleid lezen
Microsoft.ContainerService/fleets/persistentvolumeclaims/read	Leest persistentvolumeclaims
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read	Gelezen poddisruptionbudgets
Microsoft.ContainerService/fleets/replicationcontrollers/read	Replicatiecontrollers lezen
Microsoft.ContainerService/fleets/replicationcontrollers/read	Replicatiecontrollers lezen
Microsoft.ContainerService/fleets/resourcequotas/read	Resourcequota lezen
Microsoft.ContainerService/fleets/serviceaccounts/read	Serviceaccounts lezen
Microsoft.ContainerService/fleets/services/read	Leesservices
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/30b27cfc-9c84-438e-b0ce-70e35255df80",
  "name": "30b27cfc-9c84-438e-b0ce-70e35255df80",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
        "Microsoft.ContainerService/fleets/apps/deployments/read",
        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
        "Microsoft.ContainerService/fleets/batch/jobs/read",
        "Microsoft.ContainerService/fleets/configmaps/read",
        "Microsoft.ContainerService/fleets/endpoints/read",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
        "Microsoft.ContainerService/fleets/extensions/deployments/read",
        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/serviceaccounts/read",
        "Microsoft.ContainerService/fleets/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC Writer

Verleent lees-/schrijftoegang tot de meeste Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster. Deze rol staat het weergeven of wijzigen van rollen of rolbindingen niet toe. Deze rol biedt echter toegang tot geheimen als een ServiceAccount in de naamruimte, zodat deze kan worden gebruikt om de API-toegangsniveaus van een ServiceAccount in de naamruimte te verkrijgen.  Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read	Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action	Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read	Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	Resourcequota lezen
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "name": "5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service Cluster Beheer-rol

Actie voor clusterbeheerdersreferenties weergeven.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerService/managedClusters/listCluster Beheer Credential/action	Geef het cluster weer Beheer referentie van een beheerd cluster
Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action	Een beheerd clustertoegangsprofiel ophalen op rolnaam met behulp van lijstreferenties
Microsoft.ContainerService/managedClusters/read	Een beheerd cluster ophalen
Microsoft.ContainerService/managedClusters/runcommand/action	Voer de door de gebruiker uitgegeven opdracht uit op de beheerde kubernetes-server.
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster admin credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "name": "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
        "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/runcommand/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Admin Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Bewakingsgebruiker voor Azure Kubernetes Service-cluster

Een actie voor clusterbewaking van gebruikersreferenties weergeven.

Acties	Beschrijving
Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action	De clusterMonitoringUser-referentie van een beheerd cluster weergeven
Microsoft.ContainerService/managedClusters/read	Een beheerd cluster ophalen
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster monitoring user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "name": "1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Monitoring User",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Gebruikersrol Azure Kubernetes Service-cluster

Actie voor clustergebruikersreferenties weergeven.

Meer informatie

Acties	Beschrijving
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	De clusterUser-referentie van een beheerd cluster weergeven
Microsoft.ContainerService/managedClusters/read	Een beheerd cluster ophalen
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "name": "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Inzenderrol voor Azure Kubernetes Service

Verleent toegang tot Azure Kubernetes Service-clusters voor lezen en schrijven

Meer informatie

Acties	Beschrijving
Microsoft.ContainerService/managedClusters/read	Een beheerd cluster ophalen
Microsoft.ContainerService/managedClusters/write	Hiermee maakt u een nieuw beheerd cluster of werkt u een bestaand cluster bij
Microsoft.Resources/deployments/*	Een implementatie maken en beheren
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read and write Azure Kubernetes Service clusters",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "name": "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/write",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC-Beheer

Hiermee kunt u alle resources beheren onder cluster/naamruimte, behalve resourcequota en naamruimten bijwerken of verwijderen.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	De clusterUser-referentie van een beheerd cluster weergeven
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
Microsoft.ContainerService/managedClusters/resourcequota/write	Resourcequota schrijven
Microsoft.ContainerService/managedClusters/resourcequota/delete	Resourcequota verwijderen
Microsoft.ContainerService/managedClusters/namespaces/write	Naamruimten schrijven
Microsoft.ContainerService/managedClusters/namespaces/delete	Naamruimten verwijderen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/3498e952-d568-435e-9b2c-8d77e338d7f7",
  "name": "3498e952-d568-435e-9b2c-8d77e338d7f7",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": [
        "Microsoft.ContainerService/managedClusters/resourcequotas/write",
        "Microsoft.ContainerService/managedClusters/resourcequotas/delete",
        "Microsoft.ContainerService/managedClusters/namespaces/write",
        "Microsoft.ContainerService/managedClusters/namespaces/delete"
      ]
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC-cluster Beheer

Hiermee kunt u alle resources in het cluster beheren.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	De clusterUser-referentie van een beheerd cluster weergeven
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "name": "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC Reader

Staat alleen-lezentoegang toe om de meeste objecten in een naamruimte te zien. Het is niet toegestaan om rollen of rolbindingen weer te geven. Deze rol staat het weergeven van geheimen niet toe, omdat het lezen van de inhoud van Geheimen toegang biedt tot ServiceAccount-referenties in de naamruimte, waardoor API-toegang wordt toegestaan als een ServiceAccount in de naamruimte (een vorm van escalatie van bevoegdheden). Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.ContainerService/managedClusters/apps/daemonsets/read	Daemonsets lezen
Microsoft.ContainerService/managedClusters/apps/deployments/read	Leesimplementaties
Microsoft.ContainerService/managedClusters/apps/replicasets/read	Replicasets lezen
Microsoft.ContainerService/managedClusters/apps/statefulsets/read	Statefulsets lezen
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read	Leest horizontalepodautoscalers
Microsoft.ContainerService/managedClusters/batch/cronjobs/read	Leest cronjobs
Microsoft.ContainerService/managedClusters/batch/jobs/read	Leestaken
Microsoft.ContainerService/managedClusters/configmaps/read	Configmaps lezen
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	Eindpunten lezen
Microsoft.ContainerService/managedClusters/endpoints/read	Eindpunten lezen
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/extensions/daemonsets/read	Daemonsets lezen
Microsoft.ContainerService/managedClusters/extensions/deployments/read	Leesimplementaties
Microsoft.ContainerService/managedClusters/extensions/ingresses/read	Leessteuntjes
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read	Netwerkbeleid lezen
Microsoft.ContainerService/managedClusters/extensions/replicasets/read	Replicasets lezen
Microsoft.ContainerService/managedClusters/limitranges/read	Limietbereiken voor lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	Pods lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	Knooppunten lezen
Microsoft.ContainerService/managedClusters/namespaces/read	Naamruimten lezen
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read	Leessteuntjes
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read	Netwerkbeleid lezen
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read	Leest persistentvolumeclaims
Microsoft.ContainerService/managedClusters/pods/read	Pods lezen
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read	Gelezen poddisruptionbudgets
Microsoft.ContainerService/managedClusters/replicationcontrollers/read	Replicatiecontrollers lezen
Microsoft.ContainerService/managedClusters/resourcequota/read	Resourcequota lezen
Microsoft.ContainerService/managedClusters/serviceaccounts/read	Serviceaccounts lezen
Microsoft.ContainerService/managedClusters/services/read	Leesservices
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "name": "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
        "Microsoft.ContainerService/managedClusters/configmaps/read",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/endpoints/read",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/read",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
        "Microsoft.ContainerService/managedClusters/pods/read",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
        "Microsoft.ContainerService/managedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC Writer

Hiermee staat u lees-/schrijftoegang toe tot de meeste objecten in een naamruimte. Deze rol staat het weergeven of wijzigen van rollen of rolbindingen niet toe. Deze rol biedt echter toegang tot geheimen en het uitvoeren van pods als een ServiceAccount in de naamruimte, zodat deze kan worden gebruikt om de API-toegangsniveaus van een ServiceAccount in de naamruimte te verkrijgen. Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	Gelezen controllerrevisions
Microsoft.ContainerService/managedClusters/apps/daemonsets/*
Microsoft.ContainerService/managedClusters/apps/deployments/*
Microsoft.ContainerService/managedClusters/apps/replicasets/*
Microsoft.ContainerService/managedClusters/apps/statefulsets/*
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/managedClusters/batch/cronjobs/*
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read	Leesleases
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write	Leases schrijven
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete	Leases verwijderen
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	Eindpunten lezen
Microsoft.ContainerService/managedClusters/batch/jobs/*
Microsoft.ContainerService/managedClusters/configmaps/*
Microsoft.ContainerService/managedClusters/endpoints/*
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/events/*
Microsoft.ContainerService/managedClusters/extensions/daemonsets/*
Microsoft.ContainerService/managedClusters/extensions/deployments/*
Microsoft.ContainerService/managedClusters/extensions/ingresses/*
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*
Microsoft.ContainerService/managedClusters/extensions/replicasets/*
Microsoft.ContainerService/managedClusters/limitranges/read	Limietbereiken voor lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	Pods lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	Knooppunten lezen
Microsoft.ContainerService/managedClusters/namespaces/read	Naamruimten lezen
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*
Microsoft.ContainerService/managedClusters/pods/*
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*
Microsoft.ContainerService/managedClusters/replicationcontrollers/*
Microsoft.ContainerService/managedClusters/resourcequota/read	Resourcequota lezen
Microsoft.ContainerService/managedClusters/secrets/*
Microsoft.ContainerService/managedClusters/serviceaccounts/*
Microsoft.ContainerService/managedClusters/services/*
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "name": "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
        "Microsoft.ContainerService/managedClusters/configmaps/*",
        "Microsoft.ContainerService/managedClusters/endpoints/*",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/*",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
        "Microsoft.ContainerService/managedClusters/pods/*",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/secrets/*",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
        "Microsoft.ContainerService/managedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Operator zonder kubernetes-agent

Verleent Microsoft Defender voor Cloud toegang tot Azure Kubernetes Services

Meer informatie

Acties	Beschrijving
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write	Rolbindingen voor vertrouwde toegang maken of bijwerken voor beheerd cluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read	Vertrouwde toegangsrolbindingen ophalen voor beheerd cluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete	Vertrouwde toegangsrolbindingen verwijderen voor beheerd cluster
Microsoft.ContainerService/managedClusters/read	Een beheerd cluster ophalen
Microsoft.Features/features/read	Hiermee haalt u de functies van een abonnement op.
Microsoft.Features/providers/features/read	Hiermee haalt u de functie van een abonnement in een bepaalde resourceprovider op.
Microsoft.Features/providers/features/register/action	Registreert de functie voor een abonnement in een bepaalde resourceprovider.
Microsoft.Security/pricings/securityoperators/read	Haalt de beveiligingsoperators voor het bereik op
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "name": "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.Features/features/read",
        "Microsoft.Features/providers/features/read",
        "Microsoft.Features/providers/features/register/action",
        "Microsoft.Security/pricings/securityoperators/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Agentless Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes-cluster - Onboarding van Azure Arc

Roldefinitie voor het autoriseren van elke gebruiker/service voor het maken van een connectedClusters-resource

Meer informatie

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write	Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read	Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read	Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Kubernetes/connectedClusters/Write	Hiermee schrijft u connectedClusters
Microsoft.Kubernetes/connectedClusters/read	Verbondenclusters lezen
Microsoft.Support/*	Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Role definition to authorize any user/service to create connectedClusters resource",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "name": "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/Write",
        "Microsoft.Kubernetes/connectedClusters/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Cluster - Azure Arc Onboarding",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Inzender voor Kubernetes-extensies

Kan Kubernetes-extensies maken, bijwerken, ophalen, weergeven en verwijderen en asynchrone extensiebewerkingen ophalen

Acties	Beschrijving
Microsoft.Authorization/*/read	Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/*	Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/*	Een implementatie maken en beheren
Microsoft.Resources/subscriptions/resourceGroups/read	Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.KubernetesConfiguration/extensions/write	Hiermee maakt of werkt u extensieresources bij.
Microsoft.KubernetesConfiguration/extensions/read	Hiermee haalt u de resource van het extensie-exemplaar op.
Microsoft.KubernetesConfiguration/extensions/delete	Hiermee verwijdert u de resource van het extensie-exemplaar.
Microsoft.KubernetesConfiguration/extensions/operations/read	Hiermee wordt de Asynchrone bewerkingsstatus ophaalt.
NotActions
geen
DataActions
geen
NotDataActions
geen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/85cb6faf-e071-4c9b-8136-154b5a04f717",
  "name": "85cb6faf-e071-4c9b-8136-154b5a04f717",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Extension Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Volgende stappen

• Azure-rollen toewijzen met behulp van het Azure Portal