Role-based access control for Service Fabric clients
Article
Azure Service Fabric supports two different access control types for clients that are connected to a Service Fabric cluster: administrator and user. Access control allows the cluster administrator to limit access to certain cluster operations for different groups of users, making the cluster more secure.
Administrators have full access to management capabilities (including read/write capabilities). By default, users only have read access to management capabilities (for example, query capabilities), and the ability to resolve applications and services.
You specify the two client roles (administrator and client) at the time of cluster creation by providing separate certificates for each. See Service Fabric cluster security for details on setting up a secure Service Fabric cluster.
Default access control settings
The administrator access control type has full access to all the FabricClient APIs. It can perform any reads and writes on the Service Fabric cluster, including the following operations:
Application and service operations
CreateService: service creation
CreateServiceFromTemplate: service creation from template
UpdateService: service updates
DeleteService: service deletion
ProvisionApplicationType: application type provisioning
CreateApplication: application creation
DeleteApplication: application deletion
UpgradeApplication: starting or interrupting application upgrades
UnprovisionApplicationType: application type unprovisioning
MoveNextUpgradeDomain: resuming application upgrades with an explicit update domain
ReportUpgradeHealth: resuming application upgrades with the current upgrade progress
ReportHealth: reporting health
PredeployPackageToNode: predeployment API
CodePackageControl: restarting code packages
RecoverPartition: recovering a partition
RecoverPartitions: recovering partitions
RecoverServicePartitions: recovering service partitions
RecoverSystemPartitions: recovering system service partitions
ResetPartitionLoad: resetting load for a failover unit
ToggleVerboseServicePlacementHealthReporting: toggling verbose service placement health reporting
The admin access control also has access to the preceding operations.
Changing default settings for client roles
In the cluster manifest file, you can provide admin capabilities to the client if needed. You can change the defaults by going to the Fabric Settings option during cluster creation, and providing the preceding settings in the name, admin, user, and value fields.
Explore how to use built-in Azure roles, managed identities, and RBAC-policy to control access to Azure resources. Identity is the key to secure solutions.
Learn how to set up a secure Service Fabric cluster in Azure using Azure Resource Manager. You can create a cluster using a default template or using your own cluster template.