Inbyggda Azure-roller för containrar

I den här artikeln visas de inbyggda Azure-rollerna i kategorin Containrar.

AcrDelete

Ta bort lagringsplatser, taggar eller manifest från ett containerregister.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/artifacts/delete	Ta bort artefakt i ett containerregister.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr delete",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/artifacts/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrDelete",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrImageSigner

Skicka betrodda avbildningar till eller hämta betrodda avbildningar från ett containerregister som är aktiverat för innehållsförtroende.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/sign/write	Push/Pull-innehållsförtroendemetadata för ett containerregister.
NotActions
ingen
DataActions
Microsoft.ContainerRegistry/registries/trustedCollections/write	Tillåter push-överföring eller publicering av betrodda samlingar av containerregisterinnehåll. Detta liknar åtgärden Microsoft.ContainerRegistry/registries/sign/write förutom att det här är en dataåtgärd
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr image signer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",
  "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/sign/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrImageSigner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPull

Hämta artefakter från ett containerregister.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/pull/read	Hämta eller hämta avbildningar från ett containerregister.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr pull",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPull",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPush

Skicka artefakter till eller hämta artefakter från ett containerregister.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/pull/read	Hämta eller hämta avbildningar från ett containerregister.
Microsoft.ContainerRegistry/registries/push/write	Skicka eller skriv avbildningar till ett containerregister.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr push",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",
  "name": "8311e382-0749-4cb8-b61a-304f252e45ec",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.ContainerRegistry/registries/push/write"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPush",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineReader

Hämta avbildningar i karantän från ett containerregister.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/quarantine/read	Hämta eller hämta avbildningar i karantän från containerregistret
NotActions
ingen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	Tillåter hämtning eller hämtning av artefakter i karantän från containerregistret. Detta liknar Microsoft.ContainerRegistry/registries/quarantine/read förutom att det är en dataåtgärd
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data reader",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",
  "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineReader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineWriter

Skicka avbildningar i karantän till eller hämta avbildningar i karantän från ett containerregister.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerRegistry/registries/quarantine/read	Hämta eller hämta avbildningar i karantän från containerregistret
Microsoft.ContainerRegistry/registries/quarantine/write	Skriv/ändra karantäntillstånd för bilder i karantän
NotActions
ingen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	Tillåter hämtning eller hämtning av artefakter i karantän från containerregistret. Detta liknar Microsoft.ContainerRegistry/registries/quarantine/read förutom att det är en dataåtgärd
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write	Tillåter skrivning eller uppdatering av karantäntillståndet för artefakter i karantän. Detta liknar åtgärden Microsoft.ContainerRegistry/registries/quarantine/write, förutom att det är en dataåtgärd
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data writer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read",
        "Microsoft.ContainerRegistry/registries/quarantine/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineWriter",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Användarroll för Azure Arc-aktiverade Kubernetes-kluster

Visa en lista över autentiseringsuppgifter för klusteranvändare.

Åtgärder	beskrivning
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action	Lista clusterUser-autentiseringsuppgifter (förhandsversion)
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Support/*	Skapa och uppdatera ett supportärende
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action	Lista clusterUser-autentiseringsuppgifter
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credentials action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "permissions": [
    {
      "actions": [
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Support/*",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-administratör

Gör att du kan hantera alla resurser under kluster/namnområde, förutom uppdatera eller ta bort resurskvoter och namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write	Skriver localsubjectaccessreviews
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	Läser limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	Läser namnområden
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	Läser resourcequotas
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-klusteradministratör

Gör att du kan hantera alla resurser i klustret.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
Microsoft.Kubernetes/connectedClusters/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Viewer

Gör att du kan visa alla resurser i kluster/namnrymd, förutom hemligheter.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read	Läser daemonuppsättningar
Microsoft.Kubernetes/connectedClusters/apps/deployments/read	Läser distributioner
Microsoft.Kubernetes/connectedClusters/apps/replicasets/read	Läser replikeringsuppsättningar
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read	Läser tillståndskänsliga datamängder
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read	Läser horizontalpodautoscalers
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read	Läser cronjobs
Microsoft.Kubernetes/connectedClusters/batch/jobs/read	Läser jobb
Microsoft.Kubernetes/connectedClusters/configmaps/read	Läser konfigurationsmappar
Microsoft.Kubernetes/connectedClusters/endpoints/read	Läser slutpunkter
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read	Läser daemonuppsättningar
Microsoft.Kubernetes/connectedClusters/extensions/deployments/read	Läser distributioner
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read	Läser ingresser
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read	Läser nätverksprinciper
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read	Läser replikeringsuppsättningar
Microsoft.Kubernetes/connectedClusters/limitranges/read	Läser limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	Läser namnområden
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read	Läser ingresser
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read	Läser nätverksprinciper
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read	Läser persistentvolumeclaims
Microsoft.Kubernetes/connectedClusters/pods/read	Läser poddar
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read	Läser poddisruptionbudgetar
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	Läser replikeringskontroller
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	Läser replikeringskontroller
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	Läser resourcequotas
Microsoft.Kubernetes/connectedClusters/serviceaccounts/read	Läser serviceaccounts
Microsoft.Kubernetes/connectedClusters/services/read	Läser tjänster
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you view all resources in cluster/namespace, except secrets.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",
  "name": "63f0a09d-1495-4db4-a681-037d84835eb4",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
        "Microsoft.Kubernetes/connectedClusters/pods/read",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
        "Microsoft.Kubernetes/connectedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Viewer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Writer

Gör att du kan uppdatera allt i kluster/namnområde, förutom (kluster)roller och (kluster)rollbindningar.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/events/read	Läser händelser
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	Läser limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	Läser namnområden
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	Läser resourcequotas
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",
  "name": "5b999177-9696-4545-85c7-50de3797e5a1",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Container Storage-deltagare

Installera Azure Container Storage och hantera dess lagringsresurser. Innehåller ett ABAC-villkor för att begränsa rolltilldelningar.

Åtgärder	beskrivning
Microsoft.KubernetesConfiguration/extensions/write	Skapar eller uppdaterar tilläggsresursen.
Microsoft.KubernetesConfiguration/extensions/read	Hämtar tilläggsinstansresurs.
Microsoft.KubernetesConfiguration/extensions/delete	Tar bort tilläggsinstansresursen.
Microsoft.KubernetesConfiguration/extensions/operations/read	Hämtar status för asynkron åtgärd.
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Management/managementGroups/read	Lista hanteringsgrupper för den autentiserade användaren.
Microsoft.Resources/deployments/*	Skapa och hantera en distribution
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
ingen
NotDataActions
ingen
Åtgärder
Microsoft.Authorization/roleAssignments/write	Skapa en rolltilldelning i det angivna omfånget.
Microsoft.Authorization/roleAssignments/delete	Ta bort en rolltilldelning i det angivna omfånget.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen
Condition
((! (ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!( ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))	Lägg till eller ta bort rolltilldelningar för följande roller: Azure Container Storage-operatör

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and manage its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "name": "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "permissions": [
    {
      "actions": [
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Container Storage-operatör

Aktivera en hanterad identitet för att utföra Azure Container Storage-åtgärder, till exempel hantera virtuella datorer och hantera virtuella nätverk.

Åtgärder	beskrivning
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/asyncoperations/read	Avsöker status för en asynkron åtgärd.
Microsoft.Network/routeTables/join/action	Ansluter till en routningstabell. Inte aviseringsbar.
Microsoft.Network/networkSecurityGroups/join/action	Ansluter till en nätverkssäkerhetsgrupp. Inte aviseringsbar.
Microsoft.Network/virtualNetworks/write	Skapar ett virtuellt nätverk eller uppdaterar ett befintligt virtuellt nätverk
Microsoft.Network/virtualNetworks/delete	Tar bort ett virtuellt nätverk
Microsoft.Network/virtualNetworks/join/action	Ansluter till ett virtuellt nätverk. Inte aviseringsbar.
Microsoft.Network/virtualNetworks/subnets/read	Hämtar en undernätsdefinition för virtuellt nätverk
Microsoft.Network/virtualNetworks/subnets/write	Skapar ett virtuellt nätverksundernät eller uppdaterar ett befintligt virtuellt nätverksundernät
Microsoft.Compute/virtualMachines/read	Hämta egenskaperna för en virtuell dator
Microsoft.Compute/virtualMachines/write	Skapar en ny virtuell dator eller uppdaterar en befintlig virtuell dator
Microsoft.Compute/virtualMachineScaleSets/read	Hämta egenskaperna för en VM-skalningsuppsättning
Microsoft.Compute/virtualMachineScaleSets/write	Skapar en ny vm-skalningsuppsättning eller uppdaterar en befintlig
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write	Uppdateringar egenskaperna för en virtuell dator i en VM-skalningsuppsättning
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read	Hämtar egenskaperna för en virtuell dator i en VM-skalningsuppsättning
Microsoft.Resources/subscriptions/providers/read	Hämtar eller listar resursprovidrar.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Network/virtualNetworks/read	Hämta definitionen för virtuellt nätverk
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Role required by a Managed Identity for Azure Container Storage operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "name": "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.Network/routeTables/join/action",
        "Microsoft.Network/networkSecurityGroups/join/action",
        "Microsoft.Network/virtualNetworks/write",
        "Microsoft.Network/virtualNetworks/delete",
        "Microsoft.Network/virtualNetworks/join/action",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/subnets/write",
        "Microsoft.Compute/virtualMachines/read",
        "Microsoft.Compute/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/read",
        "Microsoft.Compute/virtualMachineScaleSets/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
        "Microsoft.Resources/subscriptions/providers/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Network/virtualNetworks/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Container Storage Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Container Storage-ägare

Installera Azure Container Storage, bevilja åtkomst till dess lagringsresurser och konfigurera Azure Elastic Storage Area Network (SAN). Innehåller ett ABAC-villkor för att begränsa rolltilldelningar.

Åtgärder	beskrivning
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/*
Microsoft.ElasticSan/elasticSans/volumeGroups/*
Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*
Microsoft.ElasticSan/locations/asyncoperations/read	Avsöker status för en asynkron åtgärd.
Microsoft.KubernetesConfiguration/extensions/write	Skapar eller uppdaterar tilläggsresursen.
Microsoft.KubernetesConfiguration/extensions/read	Hämtar tilläggsinstansresurs.
Microsoft.KubernetesConfiguration/extensions/delete	Tar bort tilläggsinstansresursen.
Microsoft.KubernetesConfiguration/extensions/operations/read	Hämtar status för asynkron åtgärd.
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Management/managementGroups/read	Lista hanteringsgrupper för den autentiserade användaren.
Microsoft.Resources/deployments/*	Skapa och hantera en distribution
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
ingen
NotDataActions
ingen
Åtgärder
Microsoft.Authorization/roleAssignments/write	Skapa en rolltilldelning i det angivna omfånget.
Microsoft.Authorization/roleAssignments/delete	Ta bort en rolltilldelning i det angivna omfånget.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen
Condition
((! (ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!( ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))	Lägg till eller ta bort rolltilldelningar för följande roller: Azure Container Storage-operatör

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and grants access to its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95de85bd-744d-4664-9dde-11430bc34793",
  "name": "95de85bd-744d-4664-9dde-11430bc34793",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager-deltagarroll

Ger läs-/skrivåtkomst till Azure-resurser som tillhandahålls av Azure Kubernetes Fleet Manager, inklusive flottor, medlemmar i flottan, uppdateringsstrategier för flottan, uppdateringskörningar för flottan osv.

Åtgärder	beskrivning
Microsoft.ContainerService/fleets/*
Microsoft.Resources/deployments/*	Skapa och hantera en distribution
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "name": "63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/fleets/*",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

RBAC-administratör för Azure Kubernetes Fleet Manager

Ger läs-/skrivåtkomst till Kubernetes-resurser i ett namnområde i det flotthanterade hubbklustret – ger skrivbehörigheter för de flesta objekt i ett namnområde, med undantag för ResourceQuota-objektet och själva namnområdesobjektet. Om du använder den här rollen i klusteromfånget får du åtkomst till alla namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/fleets/read	Hämta vagnpark
Microsoft.ContainerService/fleets/listCredentials/action	Lista autentiseringsuppgifter för flottan
NotActions
ingen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write	Skriver localsubjectaccessreviews
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Läser händelser
Microsoft.ContainerService/fleets/events/read	Läser händelser
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	Läser limitranges
Microsoft.ContainerService/fleets/namespaces/read	Läser namnområden
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	Läser resourcequotas
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "name": "434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC-klusteradministratör

Ger läs-/skrivåtkomst till alla Kubernetes-resurser i det vagnparkshanterade hubbklustret.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/fleets/read	Hämta vagnpark
Microsoft.ContainerService/fleets/listCredentials/action	Lista autentiseringsuppgifter för flottan
NotActions
ingen
DataActions
Microsoft.ContainerService/fleets/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "name": "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

RBAC-läsare för Azure Kubernetes Fleet Manager

Ger skrivskyddad åtkomst till de flesta Kubernetes-resurser i ett namnområde i det flotthanterade hubbklustret. Det tillåter inte visning av roller eller rollbindningar. Den här rollen tillåter inte visning av hemligheter eftersom läsning av innehållet i Hemligheter ger åtkomst till ServiceAccount-autentiseringsuppgifter i namnområdet, vilket skulle tillåta API-åtkomst som alla ServiceAccount i namnområdet (en form av eskalering av privilegier). Om du använder den här rollen i klusteromfånget får du åtkomst till alla namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/fleets/read	Hämta vagnpark
Microsoft.ContainerService/fleets/listCredentials/action	Lista autentiseringsuppgifter för flottan
NotActions
ingen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.ContainerService/fleets/apps/daemonsets/read	Läser daemonuppsättningar
Microsoft.ContainerService/fleets/apps/deployments/read	Läser distributioner
Microsoft.ContainerService/fleets/apps/statefulsets/read	Läser tillståndskänsliga datamängder
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read	Läser horizontalpodautoscalers
Microsoft.ContainerService/fleets/batch/cronjobs/read	Läser cronjobs
Microsoft.ContainerService/fleets/batch/jobs/read	Läser jobb
Microsoft.ContainerService/fleets/configmaps/read	Läser konfigurationsmappar
Microsoft.ContainerService/fleets/endpoints/read	Läser slutpunkter
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Läser händelser
Microsoft.ContainerService/fleets/events/read	Läser händelser
Microsoft.ContainerService/fleets/extensions/daemonsets/read	Läser daemonuppsättningar
Microsoft.ContainerService/fleets/extensions/deployments/read	Läser distributioner
Microsoft.ContainerService/fleets/extensions/ingresses/read	Läser ingresser
Microsoft.ContainerService/fleets/extensions/networkpolicies/read	Läser nätverksprinciper
Microsoft.ContainerService/fleets/limitranges/read	Läser limitranges
Microsoft.ContainerService/fleets/namespaces/read	Läser namnområden
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read	Läser ingresser
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read	Läser nätverksprinciper
Microsoft.ContainerService/fleets/persistentvolumeclaims/read	Läser persistentvolumeclaims
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read	Läser poddisruptionbudgetar
Microsoft.ContainerService/fleets/replicationcontrollers/read	Läser replikeringskontroller
Microsoft.ContainerService/fleets/replicationcontrollers/read	Läser replikeringskontroller
Microsoft.ContainerService/fleets/resourcequotas/read	Läser resourcequotas
Microsoft.ContainerService/fleets/serviceaccounts/read	Läser serviceaccounts
Microsoft.ContainerService/fleets/services/read	Läser tjänster
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/30b27cfc-9c84-438e-b0ce-70e35255df80",
  "name": "30b27cfc-9c84-438e-b0ce-70e35255df80",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
        "Microsoft.ContainerService/fleets/apps/deployments/read",
        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
        "Microsoft.ContainerService/fleets/batch/jobs/read",
        "Microsoft.ContainerService/fleets/configmaps/read",
        "Microsoft.ContainerService/fleets/endpoints/read",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
        "Microsoft.ContainerService/fleets/extensions/deployments/read",
        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/serviceaccounts/read",
        "Microsoft.ContainerService/fleets/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC Writer

Ger läs-/skrivåtkomst till de flesta Kubernetes-resurser i ett namnområde i det vagnparkshanterade hubbklustret. Den här rollen tillåter inte visning eller ändring av roller eller rollbindningar. Den här rollen tillåter dock åtkomst till hemligheter som alla ServiceAccount i namnområdet, så den kan användas för att få API-åtkomstnivåerna för alla ServiceAccount i namnområdet.  Om du använder den här rollen i klusteromfånget får du åtkomst till alla namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/fleets/read	Hämta vagnpark
Microsoft.ContainerService/fleets/listCredentials/action	Lista autentiseringsuppgifter för flottan
NotActions
ingen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	Läser händelser
Microsoft.ContainerService/fleets/events/read	Läser händelser
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	Läser limitranges
Microsoft.ContainerService/fleets/namespaces/read	Läser namnområden
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	Läser resourcequotas
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "name": "5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Administratörsroll för Azure Kubernetes-tjänstkluster

Visa en lista över åtgärden för klusteradministratörsautentiseringsuppgifter.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action	Lista klustretAdmin-autentiseringsuppgifter för ett hanterat kluster
Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action	Hämta en profil för hanterad klusteråtkomst efter rollnamn med hjälp av listautentiseringsuppgifter
Microsoft.ContainerService/managedClusters/read	Hämta ett hanterat kluster
Microsoft.ContainerService/managedClusters/runcommand/action	Kör användar utfärdat kommando mot hanterad kubernetes-server.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster admin credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "name": "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
        "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/runcommand/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Admin Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service-klusterövervakningsanvändare

Visa en lista över åtgärder för klusterövervakning av användarautentiseringsuppgifter.

Åtgärder	beskrivning
Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action	Lista klustretÖvervakaAnvändarautentiseringsuppgifter för ett hanterat kluster
Microsoft.ContainerService/managedClusters/read	Hämta ett hanterat kluster
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster monitoring user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "name": "1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Monitoring User",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Användarroll för Azure Kubernetes Service-kluster

Visa en lista över autentiseringsuppgifter för klusteranvändare.

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	Visa en lista över klusterAnvändarens autentiseringsuppgifter för ett hanterat kluster
Microsoft.ContainerService/managedClusters/read	Hämta ett hanterat kluster
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "name": "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes-tjänstens deltagarroll

Ger åtkomst till att läsa och skriva Azure Kubernetes Service-kluster

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerService/managedClusters/read	Hämta ett hanterat kluster
Microsoft.ContainerService/managedClusters/write	Skapar ett nytt hanterat kluster eller uppdaterar ett befintligt
Microsoft.Resources/deployments/*	Skapa och hantera en distribution
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read and write Azure Kubernetes Service clusters",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "name": "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/write",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

RBAC-administratör för Azure Kubernetes Service

Gör att du kan hantera alla resurser under kluster/namnområde, förutom uppdatera eller ta bort resurskvoter och namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	Visa en lista över klusterAnvändarens autentiseringsuppgifter för ett hanterat kluster
NotActions
ingen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
Microsoft.ContainerService/managedClusters/resourcequotas/write	Skriver resourcequotas
Microsoft.ContainerService/managedClusters/resourcequotas/delete	Tar bort resourcequotas
Microsoft.ContainerService/managedClusters/namespaces/write	Skriver namnområden
Microsoft.ContainerService/managedClusters/namespaces/delete	Tar bort namnområden

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/3498e952-d568-435e-9b2c-8d77e338d7f7",
  "name": "3498e952-d568-435e-9b2c-8d77e338d7f7",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": [
        "Microsoft.ContainerService/managedClusters/resourcequotas/write",
        "Microsoft.ContainerService/managedClusters/resourcequotas/delete",
        "Microsoft.ContainerService/managedClusters/namespaces/write",
        "Microsoft.ContainerService/managedClusters/namespaces/delete"
      ]
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

RBAC-klusteradministratör för Azure Kubernetes Service

Gör att du kan hantera alla resurser i klustret.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	Visa en lista över klusterAnvändarens autentiseringsuppgifter för ett hanterat kluster
NotActions
ingen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "name": "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

RBAC-läsare för Azure Kubernetes Service

Tillåter skrivskyddad åtkomst för att se de flesta objekt i ett namnområde. Det tillåter inte visning av roller eller rollbindningar. Den här rollen tillåter inte visning av hemligheter eftersom läsning av innehållet i Hemligheter ger åtkomst till ServiceAccount-autentiseringsuppgifter i namnområdet, vilket skulle tillåta API-åtkomst som alla ServiceAccount i namnområdet (en form av eskalering av privilegier). Om du använder den här rollen i klusteromfånget får du åtkomst till alla namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
NotActions
ingen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.ContainerService/managedClusters/apps/daemonsets/read	Läser daemonuppsättningar
Microsoft.ContainerService/managedClusters/apps/deployments/read	Läser distributioner
Microsoft.ContainerService/managedClusters/apps/replicasets/read	Läser replikeringsuppsättningar
Microsoft.ContainerService/managedClusters/apps/statefulsets/read	Läser tillståndskänsliga datamängder
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read	Läser horizontalpodautoscalers
Microsoft.ContainerService/managedClusters/batch/cronjobs/read	Läser cronjobs
Microsoft.ContainerService/managedClusters/batch/jobs/read	Läser jobb
Microsoft.ContainerService/managedClusters/configmaps/read	Läser konfigurationsmappar
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	Läser slutpunkter
Microsoft.ContainerService/managedClusters/endpoints/read	Läser slutpunkter
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	Läser händelser
Microsoft.ContainerService/managedClusters/events/read	Läser händelser
Microsoft.ContainerService/managedClusters/extensions/daemonsets/read	Läser daemonuppsättningar
Microsoft.ContainerService/managedClusters/extensions/deployments/read	Läser distributioner
Microsoft.ContainerService/managedClusters/extensions/ingresses/read	Läser ingresser
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read	Läser nätverksprinciper
Microsoft.ContainerService/managedClusters/extensions/replicasets/read	Läser replikeringsuppsättningar
Microsoft.ContainerService/managedClusters/limitranges/read	Läser limitranges
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	Läser poddar
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	Läser noder
Microsoft.ContainerService/managedClusters/namespaces/read	Läser namnområden
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read	Läser ingresser
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read	Läser nätverksprinciper
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read	Läser persistentvolumeclaims
Microsoft.ContainerService/managedClusters/pods/read	Läser poddar
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read	Läser poddisruptionbudgetar
Microsoft.ContainerService/managedClusters/replicationcontrollers/read	Läser replikeringskontroller
Microsoft.ContainerService/managedClusters/resourcequotas/read	Läser resourcequotas
Microsoft.ContainerService/managedClusters/serviceaccounts/read	Läser serviceaccounts
Microsoft.ContainerService/managedClusters/services/read	Läser tjänster
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "name": "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
        "Microsoft.ContainerService/managedClusters/configmaps/read",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/endpoints/read",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/read",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
        "Microsoft.ContainerService/managedClusters/pods/read",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
        "Microsoft.ContainerService/managedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC Writer

Tillåter läs-/skrivåtkomst till de flesta objekt i ett namnområde. Den här rollen tillåter inte visning eller ändring av roller eller rollbindningar. Den här rollen tillåter dock åtkomst till hemligheter och poddar som alla ServiceAccount i namnområdet, så den kan användas för att få API-åtkomstnivåerna för alla ServiceAccount i namnområdet. Om du använder den här rollen i klusteromfånget får du åtkomst till alla namnområden.

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
NotActions
ingen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	Läser kontrollantrevisioner
Microsoft.ContainerService/managedClusters/apps/daemonsets/*
Microsoft.ContainerService/managedClusters/apps/deployments/*
Microsoft.ContainerService/managedClusters/apps/replicasets/*
Microsoft.ContainerService/managedClusters/apps/statefulsets/*
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/managedClusters/batch/cronjobs/*
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read	Läser lån
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write	Skriver lån
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete	Tar bort lån
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	Läser slutpunkter
Microsoft.ContainerService/managedClusters/batch/jobs/*
Microsoft.ContainerService/managedClusters/configmaps/*
Microsoft.ContainerService/managedClusters/endpoints/*
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	Läser händelser
Microsoft.ContainerService/managedClusters/events/*
Microsoft.ContainerService/managedClusters/extensions/daemonsets/*
Microsoft.ContainerService/managedClusters/extensions/deployments/*
Microsoft.ContainerService/managedClusters/extensions/ingresses/*
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*
Microsoft.ContainerService/managedClusters/extensions/replicasets/*
Microsoft.ContainerService/managedClusters/limitranges/read	Läser limitranges
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	Läser poddar
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	Läser noder
Microsoft.ContainerService/managedClusters/namespaces/read	Läser namnområden
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*
Microsoft.ContainerService/managedClusters/pods/*
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*
Microsoft.ContainerService/managedClusters/replicationcontrollers/*
Microsoft.ContainerService/managedClusters/resourcequotas/read	Läser resourcequotas
Microsoft.ContainerService/managedClusters/secrets/*
Microsoft.ContainerService/managedClusters/serviceaccounts/*
Microsoft.ContainerService/managedClusters/services/*
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "name": "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
        "Microsoft.ContainerService/managedClusters/configmaps/*",
        "Microsoft.ContainerService/managedClusters/endpoints/*",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/*",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
        "Microsoft.ContainerService/managedClusters/pods/*",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/secrets/*",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
        "Microsoft.ContainerService/managedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes Agentless Operator

Beviljar Microsoft Defender för molnet åtkomst till Azure Kubernetes Services

Läs mer

Åtgärder	beskrivning
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write	Skapa eller uppdatera rollbindningar för betrodd åtkomst för hanterat kluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read	Hämta rollbindningar för betrodd åtkomst för hanterat kluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete	Ta bort rollbindningar för betrodd åtkomst för hanterat kluster
Microsoft.ContainerService/managedClusters/read	Hämta ett hanterat kluster
Microsoft.Features/features/read	Hämtar funktionerna i en prenumeration.
Microsoft.Features/providers/features/read	Hämtar funktionen för en prenumeration i en viss resursprovider.
Microsoft.Features/providers/features/register/action	Registrerar funktionen för en prenumeration i en viss resursprovider.
Microsoft.Security/pricings/securityoperators/read	Hämtar säkerhetsoperatorerna för omfånget
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "name": "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.Features/features/read",
        "Microsoft.Features/providers/features/read",
        "Microsoft.Features/providers/features/register/action",
        "Microsoft.Security/pricings/securityoperators/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Agentless Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes-kluster – Azure Arc-registrering

Rolldefinition för att auktorisera alla användare/tjänster för att skapa en anslutenKlusterresurs

Läs mer

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/write	Skapar eller uppdaterar en distribution.
Microsoft.Resources/subscriptions/operationresults/read	Hämta resultatet av prenumerationsåtgärden.
Microsoft.Resources/subscriptions/read	Hämtar listan över prenumerationer.
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.Kubernetes/connectedClusters/Write	Skriver connectedClusters
Microsoft.Kubernetes/connectedClusters/read	Läsa connectedClusters
Microsoft.Support/*	Skapa och uppdatera ett supportärende
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Role definition to authorize any user/service to create connectedClusters resource",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "name": "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/Write",
        "Microsoft.Kubernetes/connectedClusters/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Cluster - Azure Arc Onboarding",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes-tilläggsdeltagare

Kan skapa, uppdatera, hämta, lista och ta bort Kubernetes-tillägg och hämta asynkrona tilläggsåtgärder

Åtgärder	beskrivning
Microsoft.Authorization/*/read	Läsa roller och rolltilldelningar
Microsoft.Insights/alertRules/*	Skapa och hantera en klassisk måttavisering
Microsoft.Resources/deployments/*	Skapa och hantera en distribution
Microsoft.Resources/subscriptions/resourceGroups/read	Hämtar eller listar resursgrupper.
Microsoft.KubernetesConfiguration/extensions/write	Skapar eller uppdaterar tilläggsresursen.
Microsoft.KubernetesConfiguration/extensions/read	Hämtar tilläggsinstansresurs.
Microsoft.KubernetesConfiguration/extensions/delete	Tar bort tilläggsinstansresursen.
Microsoft.KubernetesConfiguration/extensions/operations/read	Hämtar status för asynkron åtgärd.
NotActions
ingen
DataActions
ingen
NotDataActions
ingen

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/85cb6faf-e071-4c9b-8136-154b5a04f717",
  "name": "85cb6faf-e071-4c9b-8136-154b5a04f717",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Extension Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Nästa steg

• Tilldela Azure-roller med hjälp av Azure-portalen