適用於容器的 Azure 內建角色

發行項
05/11/2024

本文列出容器類別中的 Azure 內建角色。

AcrDelete

從容器登錄中刪除存放庫、標籤或資訊清單。

動作	描述
Microsoft.ContainerRegistry/registries/artifacts/delete	刪除容器登錄中的成品。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr delete",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/artifacts/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrDelete",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrImageSigner

將受信任的映像推送至或從已啟用內容信任的容器登錄提取信任的映像。

深入了解

動作	描述
Microsoft.ContainerRegistry/registries/sign/write	容器登錄的推送/提取內容信任元數據。
NotActions
none
DataActions
Microsoft.ContainerRegistry/registries/trustedCollections/write	允許推送或發佈容器登錄內容的信任集合。這類似於 Microsoft.ContainerRegistry/registries/sign/write 動作，不同之處在於這是數據動作
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr image signer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",
  "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/sign/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrImageSigner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPull

從容器登錄中提取成品。

深入了解

動作	描述
Microsoft.ContainerRegistry/registries/pull/read	從容器登錄提取或取得映像。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr pull",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPull",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrPush

將成品推送至容器登錄，或從容器登錄中提取成品。

深入了解

動作	描述
Microsoft.ContainerRegistry/registries/pull/read	從容器登錄提取或取得映像。
Microsoft.ContainerRegistry/registries/push/write	將映像推送或寫入容器登錄。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr push",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",
  "name": "8311e382-0749-4cb8-b61a-304f252e45ec",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.ContainerRegistry/registries/push/write"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "AcrPush",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineReader

從容器登錄提取隔離的映像。

深入了解

動作	描述
Microsoft.ContainerRegistry/registries/quarantine/read	從容器登錄提取或取得隔離的映像
NotActions
none
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	允許從容器登錄提取或取得隔離的成品。這類似於 Microsoft.ContainerRegistry/registries/quarantine/read，不同之處在於它是數據動作
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data reader",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",
  "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineReader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

AcrQuarantineWriter

將隔離的映像推送至容器登錄，或從容器登錄提取隔離的映像。

深入了解

動作	描述
Microsoft.ContainerRegistry/registries/quarantine/read	從容器登錄提取或取得隔離的映像
Microsoft.ContainerRegistry/registries/quarantine/write	寫入/修改隔離影像的隔離狀態
NotActions
none
DataActions
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read	允許從容器登錄提取或取得隔離的成品。這類似於 Microsoft.ContainerRegistry/registries/quarantine/read，不同之處在於它是數據動作
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write	允許寫入或更新隔離成品的隔離狀態。這類似於 Microsoft.ContainerRegistry/registries/quarantine/write 動作，不同之處在於它是數據動作
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "acr quarantine data writer",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerRegistry/registries/quarantine/read",
        "Microsoft.ContainerRegistry/registries/quarantine/write"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "AcrQuarantineWriter",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

已啟用 Azure Arc 的 Kubernetes 叢集使用者角色

列出叢集使用者認證動作。

動作	描述
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action	列出 clusterUser 認證（預覽）
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Support/*	建立及更新支援票證
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action	列出 clusterUser 認證
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credentials action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
  "permissions": [
    {
      "actions": [
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Support/*",
        "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes 系統管理員

可讓您管理叢集/命名空間下的所有資源，但更新或刪除資源配額和命名空間除外。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write	寫入 localsubjectaccessreviews
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	讀取 limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	讀取命名空間
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*
Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	讀取 resourcequotas
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes 叢集系統管理員

可讓您管理叢集中的所有資源。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
Microsoft.Kubernetes/connectedClusters/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes 檢視者

可讓您檢視叢集/命名空間中的所有資源，但秘密除外。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read	讀取精靈集
Microsoft.Kubernetes/connectedClusters/apps/deployments/read	讀取部署
Microsoft.Kubernetes/connectedClusters/apps/replicasets/read	讀取複本集
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read	讀取具狀態集
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read	讀取 horizontalpodautoscalers
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read	讀取 cronjobs
Microsoft.Kubernetes/connectedClusters/batch/jobs/read	讀取作業
Microsoft.Kubernetes/connectedClusters/configmaps/read	讀取 configmaps
Microsoft.Kubernetes/connectedClusters/endpoints/read	讀取端點
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read	讀取精靈集
Microsoft.Kubernetes/connectedClusters/extensions/deployments/read	讀取部署
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read	讀取輸入
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read	讀取網路原則
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read	讀取複本集
Microsoft.Kubernetes/connectedClusters/limitranges/read	讀取 limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	讀取命名空間
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read	讀取輸入
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read	讀取網路原則
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read	讀取persistentvolumeclaims
Microsoft.Kubernetes/connectedClusters/pods/read	讀取 Pod
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read	讀取 poddisruptionbudgets
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	讀取 replicationcontrollers
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read	讀取 replicationcontrollers
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	讀取 resourcequotas
Microsoft.Kubernetes/connectedClusters/serviceaccounts/read	Reads serviceaccounts
Microsoft.Kubernetes/connectedClusters/services/read	讀取服務
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you view all resources in cluster/namespace, except secrets.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",
  "name": "63f0a09d-1495-4db4-a681-037d84835eb4",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
        "Microsoft.Kubernetes/connectedClusters/pods/read",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
        "Microsoft.Kubernetes/connectedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Viewer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Arc Kubernetes 寫入者

可讓您更新叢集/命名空間中的所有項目，但 (叢集) 角色和 (叢集) 角色繫結除外。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*
Microsoft.Kubernetes/connectedClusters/apps/deployments/*
Microsoft.Kubernetes/connectedClusters/apps/replicasets/*
Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*
Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*
Microsoft.Kubernetes/connectedClusters/batch/jobs/*
Microsoft.Kubernetes/connectedClusters/configmaps/*
Microsoft.Kubernetes/connectedClusters/endpoints/*
Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/events/read	讀取事件
Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*
Microsoft.Kubernetes/connectedClusters/extensions/deployments/*
Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*
Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*
Microsoft.Kubernetes/connectedClusters/limitranges/read	讀取 limitranges
Microsoft.Kubernetes/connectedClusters/namespaces/read	讀取命名空間
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*
Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*
Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*
Microsoft.Kubernetes/connectedClusters/pods/*
Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*
Microsoft.Kubernetes/connectedClusters/resourcequotas/read	讀取 resourcequotas
Microsoft.Kubernetes/connectedClusters/secrets/*
Microsoft.Kubernetes/connectedClusters/serviceaccounts/*
Microsoft.Kubernetes/connectedClusters/services/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",
  "name": "5b999177-9696-4545-85c7-50de3797e5a1",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
        "Microsoft.Kubernetes/connectedClusters/events/read",
        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
        "Microsoft.Kubernetes/connectedClusters/pods/*",
        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
        "Microsoft.Kubernetes/connectedClusters/secrets/*",
        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
        "Microsoft.Kubernetes/connectedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Arc Kubernetes Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure 容器儲存體參與者

安裝 Azure Container 儲存體及管理其記憶體資源。包含用來限制角色指派的 ABAC 條件。

動作	描述
Microsoft.KubernetesConfiguration/extensions/write	建立或更新延伸模組資源。
Microsoft.KubernetesConfiguration/extensions/read	取得擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/delete	刪除擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/operations/read	取得異步操作狀態。
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Management/managementGroups/read	列出已驗證使用者的管理群組。
Microsoft.Resources/deployments/*	建立和管理部署
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
none
NotDataActions
none
動作
Microsoft.Authorization/roleAssignments/write	在指定的範圍建立角色指派。
Microsoft.Authorization/roleAssignments/delete	刪除指定範圍的角色指派。
NotActions
none
DataActions
none
NotDataActions
none
Condition
((!（ActionMatches{'Microsoft.Authorization/roleAssignments/write'}））OR （@Request[Microsoft.Authorization/roleAssignments：RoleDefinitionId] ForAnyOfAnyValues：GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}）AND （！！ActionMatches{'Microsoft.Authorization/roleAssignments/delete'}）OR （@Resource[Microsoft.Authorization/roleAssignments：RoleDefinitionId] ForAnyOfAnyValues：GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}））	新增或移除下列角色的角色指派： Azure 容器儲存體操作員

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and manage its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "name": "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
  "permissions": [
    {
      "actions": [
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Container 儲存體操作員

啟用受控識別來執行 Azure 容器儲存體作業，例如管理虛擬機和管理虛擬網路。

動作	描述
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/asyncoperations/read	輪詢異步操作的狀態。
Microsoft.Network/routeTables/join/action	聯結路由表。不可警示。
Microsoft.Network/networkSecurityGroups/join/action	加入網路安全組。不可警示。
Microsoft.Network/virtualNetworks/write	建立虛擬網路或更新現有的虛擬網路
Microsoft.Network/virtualNetworks/delete	刪除虛擬網路
Microsoft.Network/virtualNetworks/join/action	加入虛擬網路。不可警示。
Microsoft.Network/virtualNetworks/subnets/read	取得虛擬網路子網定義
Microsoft.Network/virtualNetworks/subnets/write	建立虛擬網路子網路，或更新現有的虛擬網路子網路
Microsoft.Compute/virtualMachines/read	取得虛擬機器的屬性
Microsoft.Compute/virtualMachines/write	建立新的虛擬機或更新現有的虛擬機
Microsoft.Compute/virtualMachineScaleSets/read	取得虛擬機擴展集的屬性
Microsoft.Compute/virtualMachineScaleSets/write	建立新的虛擬機擴展集或更新現有的虛擬機擴展集
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write	更新 VM 擴展集中虛擬機的屬性
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read	擷取 VM 擴展集中虛擬機的屬性
Microsoft.Resources/subscriptions/providers/read	取得或列出資源提供者。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Network/virtualNetworks/read	取得虛擬網路定義
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Role required by a Managed Identity for Azure Container Storage operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "name": "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.Network/routeTables/join/action",
        "Microsoft.Network/networkSecurityGroups/join/action",
        "Microsoft.Network/virtualNetworks/write",
        "Microsoft.Network/virtualNetworks/delete",
        "Microsoft.Network/virtualNetworks/join/action",
        "Microsoft.Network/virtualNetworks/subnets/read",
        "Microsoft.Network/virtualNetworks/subnets/write",
        "Microsoft.Compute/virtualMachines/read",
        "Microsoft.Compute/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/read",
        "Microsoft.Compute/virtualMachineScaleSets/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
        "Microsoft.Resources/subscriptions/providers/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Network/virtualNetworks/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Container Storage Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure 容器儲存體擁有者

安裝 Azure Container 儲存體、授與其記憶體資源的存取權，以及設定 Azure 彈性記憶體局域網路（SAN）。包含用來限制角色指派的 ABAC 條件。

動作	描述
Microsoft.ElasticSan/elasticSans/*
Microsoft.ElasticSan/locations/*
Microsoft.ElasticSan/elasticSans/volumeGroups/*
Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*
Microsoft.ElasticSan/locations/asyncoperations/read	輪詢異步操作的狀態。
Microsoft.KubernetesConfiguration/extensions/write	建立或更新延伸模組資源。
Microsoft.KubernetesConfiguration/extensions/read	取得擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/delete	刪除擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/operations/read	取得異步操作狀態。
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Management/managementGroups/read	列出已驗證使用者的管理群組。
Microsoft.Resources/deployments/*	建立和管理部署
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
none
NotDataActions
none
動作
Microsoft.Authorization/roleAssignments/write	在指定的範圍建立角色指派。
Microsoft.Authorization/roleAssignments/delete	刪除指定範圍的角色指派。
NotActions
none
DataActions
none
NotDataActions
none
Condition
((!（ActionMatches{'Microsoft.Authorization/roleAssignments/write'}））OR （@Request[Microsoft.Authorization/roleAssignments：RoleDefinitionId] ForAnyOfAnyValues：GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}）AND （！！ActionMatches{'Microsoft.Authorization/roleAssignments/delete'}）OR （@Resource[Microsoft.Authorization/roleAssignments：RoleDefinitionId] ForAnyOfAnyValues：GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}））	新增或移除下列角色的角色指派： Azure 容器儲存體操作員

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you install Azure Container Storage and grants access to its storage resources",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/95de85bd-744d-4664-9dde-11430bc34793",
  "name": "95de85bd-744d-4664-9dde-11430bc34793",
  "permissions": [
    {
      "actions": [
        "Microsoft.ElasticSan/elasticSans/*",
        "Microsoft.ElasticSan/locations/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
        "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
        "Microsoft.ElasticSan/locations/asyncoperations/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read",
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Management/managementGroups/read",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    },
    {
      "actions": [
        "Microsoft.Authorization/roleAssignments/write",
        "Microsoft.Authorization/roleAssignments/delete"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": [],
      "conditionVersion": "2.0",
      "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"
    }
  ],
  "roleName": "Azure Container Storage Owner",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Fleet Manager 參與者角色

授與 Azure Kubernetes Fleet Manager 所提供的 Azure 資源的讀取/寫入存取權，包括車隊、車隊成員、車隊更新策略、車隊更新執行等等。

動作	描述
Microsoft.ContainerService/fleets/*
Microsoft.Resources/deployments/*	建立和管理部署
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "name": "63bb64ad-9799-4770-b5c3-24ed299a07bf",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/fleets/*",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes 機群管理員 RBAC 系統管理員

授與在佇列管理中樞叢集中命名空間內 Kubernetes 資源的讀取/寫入存取權 - 提供命名空間內大部分物件的寫入許可權，但 ResourceQuota 物件和命名空間物件本身除外。將此角色套用至叢集範圍將會授與所有命名空間的存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/fleets/read	取得車隊
Microsoft.ContainerService/fleets/listCredentials/action	列出車隊認證
NotActions
none
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write	寫入 localsubjectaccessreviews
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	讀取事件
Microsoft.ContainerService/fleets/events/read	讀取事件
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	讀取 limitranges
Microsoft.ContainerService/fleets/namespaces/read	讀取命名空間
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*
Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	讀取 resourcequotas
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "name": "434fb43a-c01c-447e-9f67-c3ad923cfaba",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes 機群管理員 RBAC 叢集系統管理員

授與車隊管理中樞叢集中所有 Kubernetes 資源的讀取/寫入存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/fleets/read	取得車隊
Microsoft.ContainerService/fleets/listCredentials/action	列出車隊認證
NotActions
none
DataActions
Microsoft.ContainerService/fleets/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "name": "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes 機群管理員 RBAC 讀取者

授與佇列管理中樞叢集中命名空間內大部分 Kubernetes 資源的唯讀存取權。它不允許檢視角色或角色繫結。此角色不允許檢視秘密，因為讀取秘密的內容會允許對命名空間中的 ServiceAccount 認證的存取權，這會允許 API 存取作為命名空間中的任何 ServiceAccount (特殊權限提升形式)。將此角色套用至叢集範圍將會授與所有命名空間的存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/fleets/read	取得車隊
Microsoft.ContainerService/fleets/listCredentials/action	列出車隊認證
NotActions
none
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.ContainerService/fleets/apps/daemonsets/read	讀取精靈集
Microsoft.ContainerService/fleets/apps/deployments/read	讀取部署
Microsoft.ContainerService/fleets/apps/statefulsets/read	讀取具狀態集
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read	讀取 horizontalpodautoscalers
Microsoft.ContainerService/fleets/batch/cronjobs/read	讀取 cronjobs
Microsoft.ContainerService/fleets/batch/jobs/read	讀取作業
Microsoft.ContainerService/fleets/configmaps/read	讀取 configmaps
Microsoft.ContainerService/fleets/endpoints/read	讀取端點
Microsoft.ContainerService/fleets/events.k8s.io/events/read	讀取事件
Microsoft.ContainerService/fleets/events/read	讀取事件
Microsoft.ContainerService/fleets/extensions/daemonsets/read	讀取精靈集
Microsoft.ContainerService/fleets/extensions/deployments/read	讀取部署
Microsoft.ContainerService/fleets/extensions/ingresses/read	讀取輸入
Microsoft.ContainerService/fleets/extensions/networkpolicies/read	讀取網路原則
Microsoft.ContainerService/fleets/limitranges/read	讀取 limitranges
Microsoft.ContainerService/fleets/namespaces/read	讀取命名空間
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read	讀取輸入
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read	讀取網路原則
Microsoft.ContainerService/fleets/persistentvolumeclaims/read	讀取persistentvolumeclaims
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read	讀取 poddisruptionbudgets
Microsoft.ContainerService/fleets/replicationcontrollers/read	讀取 replicationcontrollers
Microsoft.ContainerService/fleets/replicationcontrollers/read	讀取 replicationcontrollers
Microsoft.ContainerService/fleets/resourcequotas/read	讀取 resourcequotas
Microsoft.ContainerService/fleets/serviceaccounts/read	Reads serviceaccounts
Microsoft.ContainerService/fleets/services/read	讀取服務
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/30b27cfc-9c84-438e-b0ce-70e35255df80",
  "name": "30b27cfc-9c84-438e-b0ce-70e35255df80",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
        "Microsoft.ContainerService/fleets/apps/deployments/read",
        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
        "Microsoft.ContainerService/fleets/batch/jobs/read",
        "Microsoft.ContainerService/fleets/configmaps/read",
        "Microsoft.ContainerService/fleets/endpoints/read",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
        "Microsoft.ContainerService/fleets/extensions/deployments/read",
        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/serviceaccounts/read",
        "Microsoft.ContainerService/fleets/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes 機群管理員 RBAC 寫入者

授與佇列管理中樞叢集中命名空間內大部分 Kubernetes 資源的讀取/寫入存取權。此角色不允許檢視或修改角色或角色繫結。不過，此角色允許以命名空間中的任何 ServiceAccount 身分存取秘密，因此它可用以取得命名空間中任何 ServiceAccount 的 API 存取層級。將此角色套用至叢集範圍將會授與所有命名空間的存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/fleets/read	取得車隊
Microsoft.ContainerService/fleets/listCredentials/action	列出車隊認證
NotActions
none
DataActions
Microsoft.ContainerService/fleets/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.ContainerService/fleets/apps/daemonsets/*
Microsoft.ContainerService/fleets/apps/deployments/*
Microsoft.ContainerService/fleets/apps/statefulsets/*
Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/fleets/batch/cronjobs/*
Microsoft.ContainerService/fleets/batch/jobs/*
Microsoft.ContainerService/fleets/configmaps/*
Microsoft.ContainerService/fleets/endpoints/*
Microsoft.ContainerService/fleets/events.k8s.io/events/read	讀取事件
Microsoft.ContainerService/fleets/events/read	讀取事件
Microsoft.ContainerService/fleets/extensions/daemonsets/*
Microsoft.ContainerService/fleets/extensions/deployments/*
Microsoft.ContainerService/fleets/extensions/ingresses/*
Microsoft.ContainerService/fleets/extensions/networkpolicies/*
Microsoft.ContainerService/fleets/limitranges/read	讀取 limitranges
Microsoft.ContainerService/fleets/namespaces/read	讀取命名空間
Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*
Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/fleets/persistentvolumeclaims/*
Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/replicationcontrollers/*
Microsoft.ContainerService/fleets/resourcequotas/read	讀取 resourcequotas
Microsoft.ContainerService/fleets/secrets/*
Microsoft.ContainerService/fleets/serviceaccounts/*
Microsoft.ContainerService/fleets/services/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "name": "5af6afb3-c06c-4fa4-8848-71a8aee05683",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/fleets/read",
        "Microsoft.ContainerService/fleets/listCredentials/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
        "Microsoft.ContainerService/fleets/apps/deployments/*",
        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
        "Microsoft.ContainerService/fleets/batch/jobs/*",
        "Microsoft.ContainerService/fleets/configmaps/*",
        "Microsoft.ContainerService/fleets/endpoints/*",
        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
        "Microsoft.ContainerService/fleets/events/read",
        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
        "Microsoft.ContainerService/fleets/extensions/deployments/*",
        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
        "Microsoft.ContainerService/fleets/limitranges/read",
        "Microsoft.ContainerService/fleets/namespaces/read",
        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
        "Microsoft.ContainerService/fleets/resourcequotas/read",
        "Microsoft.ContainerService/fleets/secrets/*",
        "Microsoft.ContainerService/fleets/serviceaccounts/*",
        "Microsoft.ContainerService/fleets/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Fleet Manager RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service 叢集管理員角色

列出叢集管理員認證動作。

深入了解

動作	描述
Microsoft.ContainerService/managedClusters/listCluster 管理員 Credential/action	列出受控叢集的叢集管理員認證
Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action	使用清單認證依角色名稱取得受控叢集存取配置檔
Microsoft.ContainerService/managedClusters/read	取得受控叢集
Microsoft.ContainerService/managedClusters/runcommand/action	對受控 Kubernetes 伺服器執行用戶發出的命令。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster admin credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "name": "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
        "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/runcommand/action"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Admin Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service 叢集監視使用者

列出叢集監視使用者認證動作。

動作	描述
Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action	列出受控叢集的 clusterMonitoringUser 認證
Microsoft.ContainerService/managedClusters/read	取得受控叢集
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster monitoring user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "name": "1afdec4b-e479-420e-99e7-f82237c7c5e6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster Monitoring User",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service 叢集使用者角色

列出叢集使用者認證動作。

深入了解

動作	描述
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	列出受控叢集的 clusterUser 認證
Microsoft.ContainerService/managedClusters/read	取得受控叢集
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "List cluster user credential action.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "name": "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
        "Microsoft.ContainerService/managedClusters/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Cluster User Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service 參與者角色

授與讀取和寫入 Azure Kubernetes Service 叢集的存取權

深入了解

動作	描述
Microsoft.ContainerService/managedClusters/read	取得受控叢集
Microsoft.ContainerService/managedClusters/write	建立新的受控叢集或更新現有的叢集
Microsoft.Resources/deployments/*	建立和管理部署
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants access to read and write Azure Kubernetes Service clusters",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "name": "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/write",
        "Microsoft.Resources/deployments/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service Contributor Role",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC 管理員

可讓您管理叢集/命名空間下的所有資源，但更新或刪除資源配額和命名空間除外。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	列出受控叢集的 clusterUser 認證
NotActions
none
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
Microsoft.ContainerService/managedClusters/resourcequotas/write	寫入 resourcequotas
Microsoft.ContainerService/managedClusters/resourcequotas/delete	刪除 resourcequotas
Microsoft.ContainerService/managedClusters/namespaces/write	寫入命名空間
Microsoft.ContainerService/managedClusters/namespaces/delete	刪除命名空間

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/3498e952-d568-435e-9b2c-8d77e338d7f7",
  "name": "3498e952-d568-435e-9b2c-8d77e338d7f7",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": [
        "Microsoft.ContainerService/managedClusters/resourcequotas/write",
        "Microsoft.ContainerService/managedClusters/resourcequotas/delete",
        "Microsoft.ContainerService/managedClusters/namespaces/write",
        "Microsoft.ContainerService/managedClusters/namespaces/delete"
      ]
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC 叢集管理員

可讓您管理叢集中的所有資源。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	列出受控叢集的 clusterUser 認證
NotActions
none
DataActions
Microsoft.ContainerService/managedClusters/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Lets you manage all resources in the cluster.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "name": "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Cluster Admin",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC 讀取者

允許唯讀存取來查看命名空間中的大部分物件。它不允許檢視角色或角色繫結。此角色不允許檢視秘密，因為讀取秘密的內容會允許對命名空間中的 ServiceAccount 認證的存取權，這會允許 API 存取作為命名空間中的任何 ServiceAccount (特殊權限提升形式)。將此角色套用至叢集範圍將會授與所有命名空間的存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
NotActions
none
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.ContainerService/managedClusters/apps/daemonsets/read	讀取精靈集
Microsoft.ContainerService/managedClusters/apps/deployments/read	讀取部署
Microsoft.ContainerService/managedClusters/apps/replicasets/read	讀取複本集
Microsoft.ContainerService/managedClusters/apps/statefulsets/read	讀取具狀態集
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read	讀取 horizontalpodautoscalers
Microsoft.ContainerService/managedClusters/batch/cronjobs/read	讀取 cronjobs
Microsoft.ContainerService/managedClusters/batch/jobs/read	讀取作業
Microsoft.ContainerService/managedClusters/configmaps/read	讀取 configmaps
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	讀取 endpointslices
Microsoft.ContainerService/managedClusters/endpoints/read	讀取端點
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	讀取事件
Microsoft.ContainerService/managedClusters/events/read	讀取事件
Microsoft.ContainerService/managedClusters/extensions/daemonsets/read	讀取精靈集
Microsoft.ContainerService/managedClusters/extensions/deployments/read	讀取部署
Microsoft.ContainerService/managedClusters/extensions/ingresses/read	讀取輸入
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read	讀取網路原則
Microsoft.ContainerService/managedClusters/extensions/replicasets/read	讀取複本集
Microsoft.ContainerService/managedClusters/limitranges/read	讀取 limitranges
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	讀取 Pod
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	讀取節點
Microsoft.ContainerService/managedClusters/namespaces/read	讀取命名空間
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read	讀取輸入
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read	讀取網路原則
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read	讀取persistentvolumeclaims
Microsoft.ContainerService/managedClusters/pods/read	讀取 Pod
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read	讀取 poddisruptionbudgets
Microsoft.ContainerService/managedClusters/replicationcontrollers/read	讀取 replicationcontrollers
Microsoft.ContainerService/managedClusters/resourcequotas/read	讀取 resourcequotas
Microsoft.ContainerService/managedClusters/serviceaccounts/read	Reads serviceaccounts
Microsoft.ContainerService/managedClusters/services/read	讀取服務
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "name": "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
        "Microsoft.ContainerService/managedClusters/configmaps/read",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/endpoints/read",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/read",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
        "Microsoft.ContainerService/managedClusters/pods/read",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
        "Microsoft.ContainerService/managedClusters/services/read"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Reader",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Azure Kubernetes Service RBAC 寫入者

允許命名空間中大部分物件的讀取/寫入存取權。此角色不允許檢視或修改角色或角色繫結。不過，此角色允許以命名空間中的任何 ServiceAccount 身分存取秘密並執行 Pod，因此它可用以取得命名空間中任何 ServiceAccount 的 API 存取層級。將此角色套用至叢集範圍將會授與所有命名空間的存取權。

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
NotActions
none
DataActions
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	讀取控制器重新佈建
Microsoft.ContainerService/managedClusters/apps/daemonsets/*
Microsoft.ContainerService/managedClusters/apps/deployments/*
Microsoft.ContainerService/managedClusters/apps/replicasets/*
Microsoft.ContainerService/managedClusters/apps/statefulsets/*
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*
Microsoft.ContainerService/managedClusters/batch/cronjobs/*
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read	讀取租用
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write	寫入租用
Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete	刪除租用
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	讀取 endpointslices
Microsoft.ContainerService/managedClusters/batch/jobs/*
Microsoft.ContainerService/managedClusters/configmaps/*
Microsoft.ContainerService/managedClusters/endpoints/*
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	讀取事件
Microsoft.ContainerService/managedClusters/events/*
Microsoft.ContainerService/managedClusters/extensions/daemonsets/*
Microsoft.ContainerService/managedClusters/extensions/deployments/*
Microsoft.ContainerService/managedClusters/extensions/ingresses/*
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*
Microsoft.ContainerService/managedClusters/extensions/replicasets/*
Microsoft.ContainerService/managedClusters/limitranges/read	讀取 limitranges
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	讀取 Pod
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	讀取節點
Microsoft.ContainerService/managedClusters/namespaces/read	讀取命名空間
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*
Microsoft.ContainerService/managedClusters/pods/*
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*
Microsoft.ContainerService/managedClusters/replicationcontrollers/*
Microsoft.ContainerService/managedClusters/resourcequotas/read	讀取 resourcequotas
Microsoft.ContainerService/managedClusters/secrets/*
Microsoft.ContainerService/managedClusters/serviceaccounts/*
Microsoft.ContainerService/managedClusters/services/*
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "name": "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
        "Microsoft.ContainerService/managedClusters/configmaps/*",
        "Microsoft.ContainerService/managedClusters/endpoints/*",
        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
        "Microsoft.ContainerService/managedClusters/events/*",
        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
        "Microsoft.ContainerService/managedClusters/limitranges/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
        "Microsoft.ContainerService/managedClusters/namespaces/read",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
        "Microsoft.ContainerService/managedClusters/pods/*",
        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
        "Microsoft.ContainerService/managedClusters/secrets/*",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
        "Microsoft.ContainerService/managedClusters/services/*"
      ],
      "notDataActions": []
    }
  ],
  "roleName": "Azure Kubernetes Service RBAC Writer",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes 無代理程式操作員

授與適用於雲端的 Microsoft Defender 對 Azure Kubernetes Services 的存取權

深入了解

動作	描述
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write	建立或更新受控叢集的受信任存取角色系結
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read	取得受控叢集的信任存取角色系結
Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete	刪除受控叢集的信任存取角色系結
Microsoft.ContainerService/managedClusters/read	取得受控叢集
Microsoft.Features/features/read	取得訂用帳戶的功能。
Microsoft.Features/providers/features/read	取得指定資源提供者中訂用帳戶的功能。
Microsoft.Features/providers/features/register/action	在指定的資源提供者中註冊訂用帳戶的功能。
Microsoft.Security/pricings/securityoperators/read	取得範圍的安全性運算元
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "name": "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
  "permissions": [
    {
      "actions": [
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
        "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.Features/features/read",
        "Microsoft.Features/providers/features/read",
        "Microsoft.Features/providers/features/register/action",
        "Microsoft.Security/pricings/securityoperators/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Agentless Operator",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes 叢集 - Azure Arc 上線

授權任何使用者/服務建立 connectedClusters 資源的角色定義

深入了解

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/write	建立或更新部署。
Microsoft.Resources/subscriptions/operationresults/read	取得訂用帳戶作業結果。
Microsoft.Resources/subscriptions/read	取得訂用帳戶的清單。
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.Kubernetes/connectedClusters/Write	寫入 connectedClusters
Microsoft.Kubernetes/connectedClusters/read	讀取 connectedClusters
Microsoft.Support/*	建立及更新支援票證
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Role definition to authorize any user/service to create connectedClusters resource",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "name": "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/write",
        "Microsoft.Resources/subscriptions/operationresults/read",
        "Microsoft.Resources/subscriptions/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Kubernetes/connectedClusters/Write",
        "Microsoft.Kubernetes/connectedClusters/read",
        "Microsoft.Support/*"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Cluster - Azure Arc Onboarding",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

Kubernetes 擴充功能參與者

可以建立、更新、取得、列出和刪除 Kubernetes 擴充功能並取得擴充功能異步操作

動作	描述
Microsoft.Authorization/*/read	讀取角色和角色指派
Microsoft.Insights/alertRules/*	建立和管理傳統計量警示
Microsoft.Resources/deployments/*	建立和管理部署
Microsoft.Resources/subscriptions/resourceGroups/read	取得或列出資源群組。
Microsoft.KubernetesConfiguration/extensions/write	建立或更新延伸模組資源。
Microsoft.KubernetesConfiguration/extensions/read	取得擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/delete	刪除擴充實例資源。
Microsoft.KubernetesConfiguration/extensions/operations/read	取得異步操作狀態。
NotActions
none
DataActions
none
NotDataActions
none

{
  "assignableScopes": [
    "/"
  ],
  "description": "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
  "id": "/providers/Microsoft.Authorization/roleDefinitions/85cb6faf-e071-4c9b-8136-154b5a04f717",
  "name": "85cb6faf-e071-4c9b-8136-154b5a04f717",
  "permissions": [
    {
      "actions": [
        "Microsoft.Authorization/*/read",
        "Microsoft.Insights/alertRules/*",
        "Microsoft.Resources/deployments/*",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.KubernetesConfiguration/extensions/write",
        "Microsoft.KubernetesConfiguration/extensions/read",
        "Microsoft.KubernetesConfiguration/extensions/delete",
        "Microsoft.KubernetesConfiguration/extensions/operations/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ],
  "roleName": "Kubernetes Extension Contributor",
  "roleType": "BuiltInRole",
  "type": "Microsoft.Authorization/roleDefinitions"
}

下一步

使用 Azure 入口網站指派 Azure 角色

Share via

適用於容器的 Azure 內建角色

AcrDelete

AcrImageSigner

AcrPull

AcrPush

AcrQuarantineReader

AcrQuarantineWriter

已啟用 Azure Arc 的 Kubernetes 叢集使用者角色

Azure Arc Kubernetes 系統管理員

Azure Arc Kubernetes 叢集系統管理員

Azure Arc Kubernetes 檢視者

Azure Arc Kubernetes 寫入者

Azure 容器儲存體參與者

Azure Container 儲存體操作員

Azure 容器儲存體擁有者

Azure Kubernetes Fleet Manager 參與者角色

Azure Kubernetes 機群管理員 RBAC 系統管理員

Azure Kubernetes 機群管理員 RBAC 叢集系統管理員

Azure Kubernetes 機群管理員 RBAC 讀取者

Azure Kubernetes 機群管理員 RBAC 寫入者

Azure Kubernetes Service 叢集管理員角色

Azure Kubernetes Service 叢集監視使用者

Azure Kubernetes Service 叢集使用者角色

Azure Kubernetes Service 參與者角色

Azure Kubernetes Service RBAC 管理員

Azure Kubernetes Service RBAC 叢集管理員

Azure Kubernetes Service RBAC 讀取者

Azure Kubernetes Service RBAC 寫入者

Kubernetes 無代理程式操作員

Kubernetes 叢集 - Azure Arc 上線

Kubernetes 擴充功能參與者

下一步

其他資源

Share via

適用於容器的 Azure 內建角色

AcrDelete

AcrImageSigner

AcrPull

AcrPush

AcrQuarantineReader

AcrQuarantineWriter

已啟用 Azure Arc 的 Kubernetes 叢集使用者角色

Azure Arc Kubernetes 系統管理員

Azure Arc Kubernetes 叢集系統管理員

Azure Arc Kubernetes 檢視者

Azure Arc Kubernetes 寫入者

Azure 容器 儲存體 參與者

Azure Container 儲存體 操作員

Azure 容器 儲存體 擁有者

Azure Kubernetes Fleet Manager 參與者角色

Azure Kubernetes 機群管理員 RBAC 系統管理員

Azure Kubernetes 機群管理員 RBAC 叢集系統管理員

Azure Kubernetes 機群管理員 RBAC 讀取者

Azure Kubernetes 機群管理員 RBAC 寫入者

Azure Kubernetes Service 叢集管理員角色

Azure Kubernetes Service 叢集監視使用者

Azure Kubernetes Service 叢集使用者角色

Azure Kubernetes Service 參與者角色

Azure Kubernetes Service RBAC 管理員

Azure Kubernetes Service RBAC 叢集管理員

Azure Kubernetes Service RBAC 讀取者

Azure Kubernetes Service RBAC 寫入者

Kubernetes 無代理程式操作員

Kubernetes 叢集 - Azure Arc 上線

Kubernetes 擴充功能參與者

下一步

其他資源

Azure 容器儲存體參與者

Azure Container 儲存體操作員

Azure 容器儲存體擁有者