Delen via

Ingebouwde Azure-rollen voor containers

  • Artikel

Dit artikel bevat de ingebouwde Azure-rollen in de categorie Containers.

AcrDelete

Verwijder opslagplaatsen, tags of manifesten uit een containerregister.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registries/artifacts/delete Artefact verwijderen in een containerregister.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr delete",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/artifacts/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrDelete",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrImageSigner

Push vertrouwde installatiekopieën naar of haal vertrouwde installatiekopieën op uit een containerregister dat is ingeschakeld voor inhoudsvertrouwen.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registries/sign/write Vertrouwensmetagegevens voor push-/pull-inhoud voor een containerregister.
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/trustedCollections/write Hiermee kunt u vertrouwde verzamelingen containerregisterinhoud pushen of publiceren. Dit is vergelijkbaar met de actie Microsoft.ContainerRegistry/registries/sign/write, behalve dat dit een gegevensactie is
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr image signer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",
  "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/sign/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrImageSigner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPull

Haal artefacten op uit een containerregister.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registries/pull/read Haal installatiekopieën op uit een containerregister of haal deze op.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr pull",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPull",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPush

Push artefacten naar of pull-artefacten uit een containerregister.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registries/pull/read Haal installatiekopieën op uit een containerregister of haal deze op.
Microsoft.ContainerRegistry/registries/push/write Push- of schrijf installatiekopieën naar een containerregister.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr push",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",
  "name": "8311e382-0749-4cb8-b61a-304f252e45ec",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.ContainerRegistry/registries/push/write"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPush",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineReader

Haal in quarantaine geplaatste installatiekopieën op uit een containerregister.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registers/quarantaine/lezen In quarantaine geplaatste installatiekopieën ophalen uit het containerregister
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read Hiermee kunt u de in quarantaine geplaatste artefacten ophalen of ophalen uit het containerregister. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/lezen, behalve dat het een gegevensactie is
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data reader",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",
  "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineReader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineWriter

Push in quarantaine geplaatste installatiekopieën naar of pull in quarantaine geplaatste installatiekopieën uit een containerregister.

Meer informatie

Acties Beschrijving
Microsoft.ContainerRegistry/registers/quarantaine/lezen In quarantaine geplaatste installatiekopieën ophalen uit het containerregister
Microsoft.ContainerRegistry/registers/quarantaine/schrijven Quarantainestatus van in quarantaine geplaatste installatiekopieën schrijven/wijzigen
NotActions
geen
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read Hiermee kunt u de in quarantaine geplaatste artefacten ophalen of ophalen uit het containerregister. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/lezen, behalve dat het een gegevensactie is
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write Hiermee staat u het schrijven of bijwerken van de quarantainestatus van in quarantaine geplaatste artefacten toe. Dit is vergelijkbaar met Microsoft.ContainerRegistry/registers/quarantaine/schrijfactie, behalve dat het een gegevensactie is
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data writer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read",
        "Microsoft.ContainerRegistry/registries/quarantine/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineWriter",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Gebruikersrol Kubernetes-cluster met Azure Arc

Actie voor clustergebruikersreferenties weergeven.

Acties Beschrijving
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action ClusterUser-referentie weergeven (preview)
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action ClusterUser-referentie vermelden
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credentials action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "permissions": [
    {
      "actions": [
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Support/*",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-beheerder

Hiermee kunt u alle resources beheren onder cluster/naamruimte, behalve resourcequota en naamruimten bijwerken of verwijderen.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write Schrijft localsubjectaccessreviews
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequota/read Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes-clusterbeheerder

Hiermee kunt u alle resources in het cluster beheren.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Viewer

Hiermee kunt u alle resources in cluster/naamruimte weergeven, behalve geheimen.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read Daemonsets lezen
Microsoft.Kubernetes/connectedClusters/apps/deployments/read Leesimplementaties
Microsoft.Kubernetes/connectedClusters/apps/replicasets/read Replicasets lezen
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read Statefulsets lezen
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read Leest horizontalepodautoscalers
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read Leest cronjobs
Microsoft.Kubernetes/connectedClusters/batch/jobs/read Leestaken
Microsoft.Kubernetes/connectedClusters/configmaps/read Configmaps lezen
Microsoft.Kubernetes/connectedClusters/endpoints/read Eindpunten lezen
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read Daemonsets lezen
Microsoft.Kubernetes/connectedClusters/extensions/deployments/read Leesimplementaties
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read Leessteuntjes
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read Netwerkbeleid lezen
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read Replicasets lezen
Microsoft.Kubernetes/connectedClusters/limitranges/read Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read Leessteuntjes
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read Netwerkbeleid lezen
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read Leest persistentvolumeclaims
Microsoft.Kubernetes/connectedClusters/pods/read Pods lezen
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read Gelezen poddisruptionbudgets
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read Replicatiecontrollers lezen
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read Replicatiecontrollers lezen
Microsoft.Kubernetes/connectedClusters/resourcequota/read Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/serviceaccounts/read Serviceaccounts lezen
Microsoft.Kubernetes/connectedClusters/services/read Leesservices
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you view all resources in cluster/namespace, except secrets.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",
  "name": "63f0a09d-1495-4db4-a681-037d84835eb4",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
        "Microsoft.Kubernetes/connectedClusters/pods/read",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
        "Microsoft.Kubernetes/connectedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Viewer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes Writer

Hiermee kunt u alles in cluster/naamruimte bijwerken, behalve (cluster)rollen en (cluster)rolbindingen.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/events/read Gebeurtenissen lezen
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read Limietbereiken voor lezen
Microsoft.Kubernetes/connectedClusters/namespaces/read Naamruimten lezen
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequota/read Resourcequota lezen
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",
  "name": "5b999177-9696-4545-85c7-50de3797e5a1",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Inzender voor Azure Container Storage

Installeer Azure Container Storage en beheer de bijbehorende opslagbronnen. Bevat een ABAC-voorwaarde om roltoewijzingen te beperken.

Acties Beschrijving
Microsoft.KubernetesConfiguration/extensions/write Hiermee maakt of werkt u extensieresources bij.
Microsoft.KubernetesConfiguration/extensions/read Hiermee haalt u de resource van het extensie-exemplaar op.
Microsoft.KubernetesConfiguration/extensions/delete Hiermee verwijdert u de resource van het extensie-exemplaar.
Microsoft.KubernetesConfiguration/extensions/operations/read Hiermee wordt de Asynchrone bewerkingsstatus ophaalt.
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Management/managementGroups/read Lijst met beheergroepen voor de geverifieerde gebruiker.
Microsoft.Resources/deployments/* Een implementatie maken en beheren
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
geen
NotDataActions
geen
Acties
Microsoft.Authorization/roleAssignments/write Maak een roltoewijzing op het opgegeven bereik.
Microsoft.Authorization/roleAssignments/delete Een roltoewijzing verwijderen in het opgegeven bereik.
NotActions
geen
DataActions
geen
NotDataActions
geen
Condition
((! (ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND (!( ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) Voeg roltoewijzingen toe of verwijder deze voor de volgende rollen:
Azure Container Storage-operator		 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and manage its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "name": "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "permissions": [
    {
      "actions": [
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Container Storage-operator

Schakel een beheerde identiteit in om Azure Container Storage-bewerkingen uit te voeren, zoals het beheren van virtuele machines en het beheren van virtuele netwerken.

Acties Beschrijving
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/asyncoperations/read Hiermee wordt de status van een asynchrone bewerking gepeild.
Microsoft.Network/routeTables/join/action Hiermee wordt een routetabel samengevoegd. Niet waarschuwbaar.
Microsoft.Network/networkSecurityGroups/join/action Hiermee wordt een netwerkbeveiligingsgroep samengevoegd. Niet waarschuwbaar.
Microsoft.Network/virtualNetworks/write Hiermee maakt u een virtueel netwerk of werkt u een bestaand virtueel netwerk bij
Microsoft.Network/virtualNetworks/delete Hiermee verwijdert u een virtueel netwerk
Microsoft.Network/virtualNetworks/join/action Hiermee wordt een virtueel netwerk samengevoegd. Niet waarschuwbaar.
Microsoft.Network/virtualNetworks/subnets/read Hiermee haalt u een subnetdefinitie voor een virtueel netwerk op
Microsoft.Network/virtualNetworks/subnetten/write Hiermee maakt u een subnet van een virtueel netwerk of werkt u een bestaand subnet van een virtueel netwerk bij
Microsoft.Compute/virtualMachines/read Get the properties of a virtual machine (De eigenschappen van een virtuele machine ophalen)
Microsoft.Compute/virtualMachines/write Hiermee maakt u een nieuwe virtuele machine of werkt u een bestaande virtuele machine bij
Microsoft.Compute/virtualMachineScaleSets/read De eigenschappen van een virtuele-machineschaalset ophalen
Microsoft.Compute/virtualMachineScaleSets/write Hiermee maakt u een nieuwe virtuele-machineschaalset of werkt u een bestaande schaalset bij
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write Hiermee worden de eigenschappen van een virtuele machine in een VM-schaalset bijgewerkt
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read Haalt de eigenschappen van een virtuele machine in een VM-schaalset op
Microsoft.Resources/subscriptions/providers/read Haalt resourceproviders op of vermeldt deze.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Network/virtualNetworks/read De definitie van het virtuele netwerk ophalen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Role required by a Managed Identity for Azure Container Storage operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "name": "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.Network/routeTables/join/action",
        "Microsoft.Network/networkSecurityGroups/join/action",
        "Microsoft.Network/virtualNetworks/write",
        "Microsoft.Network/virtualNetworks/delete",
        "Microsoft.Network/virtualNetworks/join/action",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/subnets/write",
        "Microsoft.Compute/virtualMachines/read",
        "Microsoft.Compute/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/read",
        "Microsoft.Compute/virtualMachineScaleSets/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
        "Microsoft.Resources/subscriptions/providers/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Network/virtualNetworks/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Container Storage Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Eigenaar van Azure Container Storage

Installeer Azure Container Storage, verken toegang tot de opslagbronnen en configureer Azure Elastic Storage Area Network (SAN). Bevat een ABAC-voorwaarde om roltoewijzingen te beperken.

Acties Beschrijving
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/*
Microsoft.ElasticSan/elasticSans/volumeGroups/*
Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*
Microsoft.ElasticSan/locations/asyncoperations/read Hiermee wordt de status van een asynchrone bewerking gepeild.
Microsoft.KubernetesConfiguration/extensions/write Hiermee maakt of werkt u extensieresources bij.
Microsoft.KubernetesConfiguration/extensions/read Hiermee haalt u de resource van het extensie-exemplaar op.
Microsoft.KubernetesConfiguration/extensions/delete Hiermee verwijdert u de resource van het extensie-exemplaar.
Microsoft.KubernetesConfiguration/extensions/operations/read Hiermee wordt de Asynchrone bewerkingsstatus ophaalt.
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Management/managementGroups/read Lijst met beheergroepen voor de geverifieerde gebruiker.
Microsoft.Resources/deployments/* Een implementatie maken en beheren
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
geen
NotDataActions
geen
Acties
Microsoft.Authorization/roleAssignments/write Maak een roltoewijzing op het opgegeven bereik.
Microsoft.Authorization/roleAssignments/delete Een roltoewijzing verwijderen in het opgegeven bereik.
NotActions
geen
DataActions
geen
NotDataActions
geen
Condition
((! (ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND (!( ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) Voeg roltoewijzingen toe of verwijder deze voor de volgende rollen:
Azure Container Storage-operator		 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and grants access to its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95de85bd-744d-4664-9dde-11430bc34793",
  "name": "95de85bd-744d-4664-9dde-11430bc34793",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Rol inzender voor Azure Kubernetes Fleet Manager

Verleent lees-/schrijftoegang tot Azure-resources die worden geleverd door Azure Kubernetes Fleet Manager, waaronder vlootleden, vlootupdatestrategieën, vlootupdateuitvoeringen, enzovoort.

Acties Beschrijving
Microsoft.ContainerService/fleets/*
Microsoft.Resources/deployments/* Een implementatie maken en beheren
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "name": "63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/fleets/*",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC-beheerder

Verleent lees-/schrijftoegang tot Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster: biedt schrijfmachtigingen voor de meeste objecten binnen een naamruimte, met uitzondering van het ResourceQuota-object en het naamruimteobject zelf. Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write Schrijft localsubjectaccessreviews
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read Resourcequota lezen
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "name": "434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC-clusterbeheerder

Verleent lees-/schrijftoegang tot alle Kubernetes-resources in het door de vloot beheerde hubcluster.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "name": "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC Reader

Verleent alleen-lezentoegang tot de meeste Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster. Het is niet toegestaan om rollen of rolbindingen weer te geven. Deze rol staat het weergeven van geheimen niet toe, omdat het lezen van de inhoud van Geheimen toegang biedt tot ServiceAccount-referenties in de naamruimte, waardoor API-toegang wordt toegestaan als een ServiceAccount in de naamruimte (een vorm van escalatie van bevoegdheden). Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/read Daemonsets lezen
Microsoft.ContainerService/fleets/apps/deployments/read Leesimplementaties
Microsoft.ContainerService/fleets/apps/statefulsets/read Statefulsets lezen
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read Leest horizontalepodautoscalers
Microsoft.ContainerService/fleets/batch/cronjobs/read Leest cronjobs
Microsoft.ContainerService/fleets/batch/jobs/read Leestaken
Microsoft.ContainerService/fleets/configmaps/read Configmaps lezen
Microsoft.ContainerService/fleets/endpoints/read Eindpunten lezen
Microsoft.ContainerService/fleets/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/read Daemonsets lezen
Microsoft.ContainerService/fleets/extensions/deployments/read Leesimplementaties
Microsoft.ContainerService/fleets/extensions/ingresses/read Leessteuntjes
Microsoft.ContainerService/fleets/extensions/networkpolicies/read Netwerkbeleid lezen
Microsoft.ContainerService/fleets/limitranges/read Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read Leessteuntjes
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read Netwerkbeleid lezen
Microsoft.ContainerService/fleets/persistentvolumeclaims/read Leest persistentvolumeclaims
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read Gelezen poddisruptionbudgets
Microsoft.ContainerService/fleets/replicationcontrollers/read Replicatiecontrollers lezen
Microsoft.ContainerService/fleets/replicationcontrollers/read Replicatiecontrollers lezen
Microsoft.ContainerService/fleets/resourcequotas/read Resourcequota lezen
Microsoft.ContainerService/fleets/serviceaccounts/read Serviceaccounts lezen
Microsoft.ContainerService/fleets/services/read Leesservices
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/30b27cfc-9c84-438e-b0ce-70e35255df80",
  "name": "30b27cfc-9c84-438e-b0ce-70e35255df80",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
        "Microsoft.ContainerService/fleets/apps/deployments/read",
        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
        "Microsoft.ContainerService/fleets/batch/jobs/read",
        "Microsoft.ContainerService/fleets/configmaps/read",
        "Microsoft.ContainerService/fleets/endpoints/read",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
        "Microsoft.ContainerService/fleets/extensions/deployments/read",
        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/serviceaccounts/read",
        "Microsoft.ContainerService/fleets/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager RBAC Writer

Verleent lees-/schrijftoegang tot de meeste Kubernetes-resources binnen een naamruimte in het door de vloot beheerde hubcluster. Deze rol staat het weergeven of wijzigen van rollen of rolbindingen niet toe. Deze rol biedt echter toegang tot geheimen als een ServiceAccount in de naamruimte, zodat deze kan worden gebruikt om de API-toegangsniveaus van een ServiceAccount in de naamruimte te verkrijgen.  Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/fleets/read Vloot ophalen
Microsoft.ContainerService/fleets/listCredentials/action Vlootreferenties vermelden
NotActions
geen
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/events/read Gebeurtenissen lezen
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read Limietbereiken voor lezen
Microsoft.ContainerService/fleets/namespaces/read Naamruimten lezen
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read Resourcequota lezen
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "name": "5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service Arc-clusterbeheerderrol

Actie voor clusterbeheerdersreferenties weergeven.

Meer informatie

Acties Beschrijving
Microsoft.HybridContainerService/provisionedClusterInstances/read Hiermee haalt u de ingerichte hybride AKS-clusterexemplaren op die zijn gekoppeld aan het verbonden cluster
Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action Geeft de beheerdersreferenties weer van een ingericht clusterexemplaren die alleen in de directe modus worden gebruikt.
Microsoft.Kubernetes/connectedClusters/Read Verbondenclusters lezen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster admin credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
  "name": "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
  "permissions": [
    {
      "actions": [
        "Microsoft.HybridContainerService/provisionedClusterInstances/read",
        "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
        "Microsoft.Kubernetes/connectedClusters/Read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Arc Cluster Admin Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Gebruikersrol Azure Kubernetes Service Arc-cluster

Actie voor clustergebruikersreferenties weergeven.

Meer informatie

Acties Beschrijving
Microsoft.HybridContainerService/provisionedClusterInstances/read Hiermee haalt u de ingerichte hybride AKS-clusterexemplaren op die zijn gekoppeld aan het verbonden cluster
Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action Geeft de AAD-gebruikersreferenties weer van een ingericht clusterexemplaren die alleen in de directe modus worden gebruikt.
Microsoft.Kubernetes/connectedClusters/Read Verbondenclusters lezen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/233ca253-b031-42ff-9fba-87ef12d6b55f",
  "name": "233ca253-b031-42ff-9fba-87ef12d6b55f",
  "permissions": [
    {
      "actions": [
        "Microsoft.HybridContainerService/provisionedClusterInstances/read",
        "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
        "Microsoft.Kubernetes/connectedClusters/Read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Arc Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Rol azure Kubernetes Service Arc-inzender

Verleent toegang tot hybride Azure Kubernetes Services-clusters voor lezen en schrijven

Meer informatie

Acties Beschrijving
Microsoft.HybridContainerService/Locations/operationStatuses/read read operationStatuses
Microsoft.HybridContainerService/Operations/read leesbewerkingen
Microsoft.HybridContainerService/kubernetesVersions/read Toont de ondersteunde Kubernetes-versies vanaf de onderliggende aangepaste locatie
Microsoft.HybridContainerService/kubernetesVersions/write Hiermee wordt het resourcetype kubernetes-versie geplaatst
Microsoft.HybridContainerService/kubernetesVersions/delete Het resourcetype kubernetes-versies verwijderen
Microsoft.HybridContainerService/provisionedClusterInstances/read Hiermee haalt u de ingerichte hybride AKS-clusterexemplaren op die zijn gekoppeld aan het verbonden cluster
Microsoft.HybridContainerService/provisionedClusterInstances/write Hiermee maakt u het ingerichte hybride AKS-clusterexemplaren
Microsoft.HybridContainerService/provisionedClusterInstances/delete Hiermee verwijdert u het ingerichte hybride AKS-clusterexemplaren
Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read Haalt de agentpools op in het hybride AKS-ingerichte clusterexemplaren
Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write Hiermee werkt u de agentgroep bij in het ingerichte hybride AKS-clusterexemplaren
Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete Hiermee verwijdert u de agentgroep in het ingerichte hybride AKS-clusterexemplaren
Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read upgradeProfiles lezen
Microsoft.HybridContainerService/skus/read Toont de ondersteunde VM-SKU's vanaf de onderliggende aangepaste locatie
Microsoft.HybridContainerService/skus/write Het resourcetype VM-SKU's instellen
Microsoft.HybridContainerService/skus/delete Hiermee verwijdert u het resourcetype vm-SKU
Microsoft.HybridContainerService/virtualNetworks/read Een overzicht van de virtuele AKS-netwerken per abonnement
Microsoft.HybridContainerService/virtualNetworks/write Patches voor het virtuele AKS-netwerk voor hybride AKS
Microsoft.HybridContainerService/virtualNetworks/delete Hiermee verwijdert u het virtuele AKS-netwerk voor hybride AKS
Microsoft.ExtendedLocation/customLocations/deploy/action Machtigingen implementeren voor een resource voor een aangepaste locatie
Microsoft.ExtendedLocation/customLocations/read Hiermee haalt u een resource voor een aangepaste locatie op
Microsoft.Kubernetes/connectedClusters/Read Verbondenclusters lezen
Microsoft.Kubernetes/connectedClusters/Write Hiermee schrijft u connectedClusters
Microsoft.Kubernetes/connectedClusters/Delete Hiermee verwijdert u connectedClusters
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action ClusterUser-referentie vermelden
Microsoft.AzureStackHCI/clusters/read Clusters ophaalt
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read and write Azure Kubernetes Services hybrid clusters",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5d3f1697-4507-4d08-bb4a-477695db5f82",
  "name": "5d3f1697-4507-4d08-bb4a-477695db5f82",
  "permissions": [
    {
      "actions": [
        "Microsoft.HybridContainerService/Locations/operationStatuses/read",
        "Microsoft.HybridContainerService/Operations/read",
        "Microsoft.HybridContainerService/kubernetesVersions/read",
        "Microsoft.HybridContainerService/kubernetesVersions/write",
        "Microsoft.HybridContainerService/kubernetesVersions/delete",
        "Microsoft.HybridContainerService/provisionedClusterInstances/read",
        "Microsoft.HybridContainerService/provisionedClusterInstances/write",
        "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
        "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
        "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
        "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
        "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
        "Microsoft.HybridContainerService/skus/read",
        "Microsoft.HybridContainerService/skus/write",
        "Microsoft.HybridContainerService/skus/delete",
        "Microsoft.HybridContainerService/virtualNetworks/read",
        "Microsoft.HybridContainerService/virtualNetworks/write",
        "Microsoft.HybridContainerService/virtualNetworks/delete",
        "Microsoft.ExtendedLocation/customLocations/deploy/action",
        "Microsoft.ExtendedLocation/customLocations/read",
        "Microsoft.Kubernetes/connectedClusters/Read",
        "Microsoft.Kubernetes/connectedClusters/Write",
        "Microsoft.Kubernetes/connectedClusters/Delete",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
        "Microsoft.AzureStackHCI/clusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Arc Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes-serviceclusterbeheerderrol

Actie voor clusterbeheerdersreferenties weergeven.

Meer informatie

Acties Beschrijving
Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action De clusterAdmin-referenties van een beheerd cluster weergeven
Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action Een beheerd clustertoegangsprofiel ophalen op rolnaam met behulp van lijstreferenties
Microsoft.ContainerService/managedClusters/read Een beheerd cluster ophalen
Microsoft.ContainerService/managedClusters/runcommand/action Voer de door de gebruiker uitgegeven opdracht uit op de beheerde kubernetes-server.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster admin credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "name": "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
        "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/runcommand/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Admin Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Bewakingsgebruiker voor Azure Kubernetes Service-cluster

Een actie voor clusterbewaking van gebruikersreferenties weergeven.

Acties Beschrijving
Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action De clusterMonitoringUser-referentie van een beheerd cluster weergeven
Microsoft.ContainerService/managedClusters/read Een beheerd cluster ophalen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster monitoring user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "name": "1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Monitoring User",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Gebruikersrol Azure Kubernetes Service-cluster

Actie voor clustergebruikersreferenties weergeven.

Meer informatie

Acties Beschrijving
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action De clusterUser-referentie van een beheerd cluster weergeven
Microsoft.ContainerService/managedClusters/read Een beheerd cluster ophalen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "name": "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Inzenderrol voor Azure Kubernetes Service

Verleent toegang tot Azure Kubernetes Service-clusters voor lezen en schrijven

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.ContainerService/locations/* Leeslocaties die beschikbaar zijn voor ContainerService-resources
Microsoft.ContainerService/managedClusters/* Een beheerd cluster maken en beheren
Microsoft.ContainerService/managedclustersnapshots/* Een momentopname van een beheerd cluster maken en beheren
Microsoft.ContainerService/snapshots/* Een momentopname maken en beheren
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/* Een implementatie maken en beheren
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read and write Azure Kubernetes Service clusters",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "name": "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.ContainerService/locations/*",
        "Microsoft.ContainerService/managedClusters/*",
        "Microsoft.ContainerService/managedclustersnapshots/*",
        "Microsoft.ContainerService/snapshots/*",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC-beheerder

Hiermee kunt u alle resources beheren onder cluster/naamruimte, behalve resourcequota en naamruimten bijwerken of verwijderen.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action De clusterUser-referentie van een beheerd cluster weergeven
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
Microsoft.ContainerService/managedClusters/resourcequota/write Resourcequota schrijven
Microsoft.ContainerService/managedClusters/resourcequota/delete Resourcequota verwijderen
Microsoft.ContainerService/managedClusters/namespaces/write Naamruimten schrijven
Microsoft.ContainerService/managedClusters/namespaces/delete Naamruimten verwijderen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/3498e952-d568-435e-9b2c-8d77e338d7f7",
  "name": "3498e952-d568-435e-9b2c-8d77e338d7f7",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": [
        "Microsoft.ContainerService/managedClusters/resourcequotas/write",
        "Microsoft.ContainerService/managedClusters/resourcequotas/delete",
        "Microsoft.ContainerService/managedClusters/namespaces/write",
        "Microsoft.ContainerService/managedClusters/namespaces/delete"
      ]
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC-clusterbeheerder

Hiermee kunt u alle resources in het cluster beheren.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action De clusterUser-referentie van een beheerd cluster weergeven
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "name": "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC Reader

Staat alleen-lezentoegang toe om de meeste objecten in een naamruimte te zien. Het is niet toegestaan om rollen of rolbindingen weer te geven. Deze rol staat het weergeven van geheimen niet toe, omdat het lezen van de inhoud van Geheimen toegang biedt tot ServiceAccount-referenties in de naamruimte, waardoor API-toegang wordt toegestaan als een ServiceAccount in de naamruimte (een vorm van escalatie van bevoegdheden). Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.ContainerService/managedClusters/apps/daemonsets/read Daemonsets lezen
Microsoft.ContainerService/managedClusters/apps/deployments/read Leesimplementaties
Microsoft.ContainerService/managedClusters/apps/replicasets/read Replicasets lezen
Microsoft.ContainerService/managedClusters/apps/statefulsets/read Statefulsets lezen
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read Leest horizontalepodautoscalers
Microsoft.ContainerService/managedClusters/batch/cronjobs/read Leest cronjobs
Microsoft.ContainerService/managedClusters/batch/jobs/read Leestaken
Microsoft.ContainerService/managedClusters/configmaps/read Configmaps lezen
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read Eindpunten lezen
Microsoft.ContainerService/managedClusters/endpoints/read Eindpunten lezen
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/events/read Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/extensions/daemonsets/read Daemonsets lezen
Microsoft.ContainerService/managedClusters/extensions/deployments/read Leesimplementaties
Microsoft.ContainerService/managedClusters/extensions/ingresses/read Leessteuntjes
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read Netwerkbeleid lezen
Microsoft.ContainerService/managedClusters/extensions/replicasets/read Replicasets lezen
Microsoft.ContainerService/managedClusters/limitranges/read Limietbereiken voor lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read Pods lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read Knooppunten lezen
Microsoft.ContainerService/managedClusters/namespaces/read Naamruimten lezen
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read Leessteuntjes
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read Netwerkbeleid lezen
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read Leest persistentvolumeclaims
Microsoft.ContainerService/managedClusters/pods/read Pods lezen
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read Gelezen poddisruptionbudgets
Microsoft.ContainerService/managedClusters/replicationcontrollers/read Replicatiecontrollers lezen
Microsoft.ContainerService/managedClusters/resourcequota/read Resourcequota lezen
Microsoft.ContainerService/managedClusters/serviceaccounts/read Serviceaccounts lezen
Microsoft.ContainerService/managedClusters/services/read Leesservices
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "name": "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
        "Microsoft.ContainerService/managedClusters/configmaps/read",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/endpoints/read",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/read",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
        "Microsoft.ContainerService/managedClusters/pods/read",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
        "Microsoft.ContainerService/managedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC Writer

Hiermee staat u lees-/schrijftoegang toe tot de meeste objecten in een naamruimte. Deze rol staat het weergeven of wijzigen van rollen of rolbindingen niet toe. Deze rol biedt echter toegang tot geheimen en het uitvoeren van pods als een ServiceAccount in de naamruimte, zodat deze kan worden gebruikt om de API-toegangsniveaus van een ServiceAccount in de naamruimte te verkrijgen. Als u deze rol toepast op clusterbereik, krijgt u toegang tot alle naamruimten.

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
NotActions
geen
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read Gelezen controllerrevisions
Microsoft.ContainerService/managedClusters/apps/daemonsets/*
Microsoft.ContainerService/managedClusters/apps/deployments/*
Microsoft.ContainerService/managedClusters/apps/replicasets/*
Microsoft.ContainerService/managedClusters/apps/statefulsets/*
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/managedClusters/batch/cronjobs/*
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read Leesleases
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write Leases schrijven
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete Leases verwijderen
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read Eindpunten lezen
Microsoft.ContainerService/managedClusters/batch/jobs/*
Microsoft.ContainerService/managedClusters/configmaps/*
Microsoft.ContainerService/managedClusters/endpoints/*
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read Gebeurtenissen lezen
Microsoft.ContainerService/managedClusters/events/*
Microsoft.ContainerService/managedClusters/extensions/daemonsets/*
Microsoft.ContainerService/managedClusters/extensions/deployments/*
Microsoft.ContainerService/managedClusters/extensions/ingresses/*
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*
Microsoft.ContainerService/managedClusters/extensions/replicasets/*
Microsoft.ContainerService/managedClusters/limitranges/read Limietbereiken voor lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read Pods lezen
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read Knooppunten lezen
Microsoft.ContainerService/managedClusters/namespaces/read Naamruimten lezen
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*
Microsoft.ContainerService/managedClusters/pods/*
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*
Microsoft.ContainerService/managedClusters/replicationcontrollers/*
Microsoft.ContainerService/managedClusters/resourcequota/read Resourcequota lezen
Microsoft.ContainerService/managedClusters/secrets/*
Microsoft.ContainerService/managedClusters/serviceaccounts/*
Microsoft.ContainerService/managedClusters/services/*
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "name": "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
        "Microsoft.ContainerService/managedClusters/configmaps/*",
        "Microsoft.ContainerService/managedClusters/endpoints/*",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/*",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
        "Microsoft.ContainerService/managedClusters/pods/*",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/secrets/*",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
        "Microsoft.ContainerService/managedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Managed Identity CheckAccess Reader voor verbonden clusters

Ingebouwde rol waarmee een beheerde identiteit van een verbonden cluster de checkAccess-API kan aanroepen

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Built-in role that allows a Connected Cluster managed identity to call the checkAccess API",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/65a14201-8f6c-4c28-bec4-12619c5a9aaa",
  "name": "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Connected Cluster Managed Identity CheckAccess Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Operator zonder kubernetes-agent

Verleent Microsoft Defender voor Cloud toegang tot Azure Kubernetes Services

Meer informatie

Acties Beschrijving
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write Rolbindingen voor vertrouwde toegang maken of bijwerken voor beheerd cluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read Vertrouwde toegangsrolbindingen ophalen voor beheerd cluster
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete Vertrouwde toegangsrolbindingen verwijderen voor beheerd cluster
Microsoft.ContainerService/managedClusters/read Een beheerd cluster ophalen
Microsoft.Features/features/read Hiermee haalt u de functies van een abonnement op.
Microsoft.Features/providers/features/read Hiermee haalt u de functie van een abonnement in een bepaalde resourceprovider op.
Microsoft.Features/providers/features/register/action Registreert de functie voor een abonnement in een bepaalde resourceprovider.
Microsoft.Security/pricings/securityoperators/read Haalt de beveiligingsoperators voor het bereik op
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "name": "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.Features/features/read",
        "Microsoft.Features/providers/features/read",
        "Microsoft.Features/providers/features/register/action",
        "Microsoft.Security/pricings/securityoperators/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Agentless Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes-cluster - Onboarding van Azure Arc

Roldefinitie voor het autoriseren van elke gebruiker/service voor het maken van een connectedClusters-resource

Meer informatie

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/write Hiermee maakt of werkt u een implementatie bij.
Microsoft.Resources/subscriptions/operationresults/read Haal de resultaten van de abonnementsbewerking op.
Microsoft.Resources/subscriptions/read Hiermee haalt u de lijst met abonnementen op.
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.Kubernetes/connectedClusters/Write Hiermee schrijft u connectedClusters
Microsoft.Kubernetes/connectedClusters/read Verbondenclusters lezen
Microsoft.Support/* Een ondersteuningsticket maken en bijwerken
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Role definition to authorize any user/service to create connectedClusters resource",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "name": "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/Write",
        "Microsoft.Kubernetes/connectedClusters/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Cluster - Azure Arc Onboarding",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Inzender voor Kubernetes-extensies

Kan Kubernetes-extensies maken, bijwerken, ophalen, weergeven en verwijderen en asynchrone extensiebewerkingen ophalen

Acties Beschrijving
Microsoft.Authorization/*/read Rollen en roltoewijzingen lezen
Microsoft.Insights/alertRules/* Een klassieke metrische waarschuwing maken en beheren
Microsoft.Resources/deployments/* Een implementatie maken en beheren
Microsoft.Resources/subscriptions/resourceGroups/read Hiermee haalt u resourcegroepen op of vermeldt u deze.
Microsoft.KubernetesConfiguration/extensions/write Hiermee maakt of werkt u extensieresources bij.
Microsoft.KubernetesConfiguration/extensions/read Hiermee haalt u de resource van het extensie-exemplaar op.
Microsoft.KubernetesConfiguration/extensions/delete Hiermee verwijdert u de resource van het extensie-exemplaar.
Microsoft.KubernetesConfiguration/extensions/operations/read Hiermee wordt de Asynchrone bewerkingsstatus ophaalt.
NotActions
geen
DataActions
geen
NotDataActions
geen 
{
  "assignableScopes": [
    "/"
  ],
  "description": "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/85cb6faf-e071-4c9b-8136-154b5a04f717",
  "name": "85cb6faf-e071-4c9b-8136-154b5a04f717",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Extension Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Volgende stappen