Skip to content

Commit c1751da

Browse files
leslielin-5leslielin-5
authored
Update containers.md
add three built-in roles for Azure Kubernetes Service Arc
1 parent c5edbba commit c1751da

File tree

1 file changed

+180
-1
lines changed

1 file changed

+180
-1
lines changed

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 180 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1893,6 +1893,185 @@ Allows read/write access to most objects in a namespace. This role does not allo
18931893
}
18941894
```
18951895

1896+
## Azure Kubernetes Service Arc Cluster Admin Role
1897+
1898+
List cluster admin credential action
1899+
1900+
> [!div class="mx-tableFixed"]
1901+
> | Actions | Description |
1902+
> | --- | --- |
1903+
> | Microsoft.HybridContainerService/provisionedClusterInstances/read | Gets the Hybrid AKS provisioned cluster instance and instances associated with the connected cluster |
1904+
> | Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action | Lists the admin credentials of a provisioned cluster instance used only in direct mode. |
1905+
> | Microsoft.Kubernetes/connectedClusters/Read | Read connectedClusters |
1906+
> | **NotActions** | |
1907+
> | *none* | |
1908+
> | **DataActions** | |
1909+
> | *none* | |
1910+
> | **NotDataActions** | |
1911+
> | *none* | |
1912+
1913+
```json
1914+
{
1915+
"assignableScopes": [
1916+
"/"
1917+
],
1918+
"description": "List cluster admin credential action.",
1919+
"id": "/subscriptions/586c20df-c465-4f10-8673-65aa4859e7ca/providers/Microsoft.Authorization/roleDefinitions/b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
1920+
"name": "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
1921+
"permissions": [
1922+
{
1923+
"actions": [
1924+
"Microsoft.HybridContainerService/provisionedClusterInstances/read",
1925+
"Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
1926+
"Microsoft.Kubernetes/connectedClusters/Read"
1927+
],
1928+
"condition": null,
1929+
"conditionVersion": null,
1930+
"dataActions": [],
1931+
"notActions": [],
1932+
"notDataActions": []
1933+
}
1934+
],
1935+
"roleName": "Azure Kubernetes Service Arc Cluster Admin Role",
1936+
"roleType": "BuiltInRole",
1937+
"type": "Microsoft.Authorization/roleDefinitions"
1938+
}
1939+
```
1940+
1941+
## Azure Kubernetes Service Arc Cluster User Role
1942+
1943+
List cluster user credential action.
1944+
1945+
> [!div class="mx-tableFixed"]
1946+
> | Actions | Description |
1947+
> | --- | --- |
1948+
> | Microsoft.HybridContainerService/provisionedClusterInstances/read | Gets the Hybrid AKS provisioned cluster instance and instances associated with the connected cluster |
1949+
> | Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action | Lists the AAD user credentials of a provisioned cluster instance used only in direct mode. |
1950+
> | Microsoft.Kubernetes/connectedClusters/Read | Read connectedClusters |
1951+
> | **NotActions** | |
1952+
> | *none* | |
1953+
> | **DataActions** | |
1954+
> | *none* | |
1955+
> | **NotDataActions** | |
1956+
> | *none* | |
1957+
1958+
```json
1959+
{
1960+
"assignableScopes": [
1961+
"/"
1962+
],
1963+
"description": "List cluster user credential action.",
1964+
"id": "/subscriptions/586c20df-c465-4f10-8673-65aa4859e7ca/providers/Microsoft.Authorization/roleDefinitions/233ca253-b031-42ff-9fba-87ef12d6b55f",
1965+
"name": "233ca253-b031-42ff-9fba-87ef12d6b55f",
1966+
"permissions": [
1967+
{
1968+
"actions": [
1969+
"Microsoft.HybridContainerService/provisionedClusterInstances/read",
1970+
"Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
1971+
"Microsoft.Kubernetes/connectedClusters/Read"
1972+
],
1973+
"condition": null,
1974+
"conditionVersion": null,
1975+
"dataActions": [],
1976+
"notActions": [],
1977+
"notDataActions": []
1978+
}
1979+
],
1980+
"roleName": "Azure Kubernetes Service Arc Cluster User Role",
1981+
"roleType": "BuiltInRole",
1982+
"type": "Microsoft.Authorization/roleDefinitions"
1983+
}
1984+
```
1985+
1986+
## Azure Kubernetes Service Arc Contributor Role
1987+
1988+
Grants access to read and write Azure Kubernetes Services Arc clusters
1989+
1990+
> [!div class="mx-tableFixed"]
1991+
> | Actions | Description |
1992+
> | --- | --- |
1993+
> | Microsoft.HybridContainerService/Locations/operationStatuses/read | Read operationStatuses |
1994+
> | Microsoft.HybridContainerService/Operations/read | Read Operations |
1995+
> | Microsoft.HybridContainerService/kubernetesVersions/read | Get the supported kubernetes versions from the underlying custom location |
1996+
> | Microsoft.HybridContainerService/kubernetesVersions/write | Put the kubernetes version resource type |
1997+
> | Microsoft.HybridContainerService/kubernetesVersions/delete | Delete the kubernetes versions resource type |
1998+
> | Microsoft.HybridContainerService/provisionedClusterInstances/read | Get the Hybrid AKS provisioned cluster instance and instances associated with the connected cluster |
1999+
> | Microsoft.HybridContainerService/provisionedClusterInstances/write | Create the Hybrid AKS provisioned cluster instance |
2000+
> | Microsoft.HybridContainerService/provisionedClusterInstances/delete | Delete the Hybrid AKS provisioned cluster instance |
2001+
> | Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read | Get the agent pools in the Hybrid AKS provisioned cluster instance |
2002+
> | Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write | Create and update the agent pool in the Hybrid AKS provisioned cluster instance |
2003+
> | Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete | Delete the agent pool in the Hybrid AKS provisioned cluster instance |
2004+
> | Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read | read operationStatuses |
2005+
> | Microsoft.HybridContainerService/skus/read | Get the supported VM skus from the underlying custom location |
2006+
> | Microsoft.HybridContainerService/skus/write | Puts the VM SKUs resource type |
2007+
> | Microsoft.HybridContainerService/skus/delete | Deletes the Vm Sku resource type |
2008+
> | Microsoft.HybridContainerService/virtualNetworks/read | List the Hybrid AKS virtual networks by resource group and subscription |
2009+
> | Microsoft.HybridContainerService/virtualNetworks/write | Put and patch the Hybrid AKS virtual network |
2010+
> | Microsoft.HybridContainerService/virtualNetworks/delete | Deletes the Hybrid AKS virtual network |
2011+
> | Microsoft.ExtendedLocation/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
2012+
> | Microsoft.ExtendedLocation/customLocations/read | Gets an Custom Location resource |
2013+
> | Microsoft.Kubernetes/connectedClusters/Read | Read connectedClusters |
2014+
> | Microsoft.Kubernetes/connectedClusters/Write | Writes connectedClusters |
2015+
> | Microsoft.Kubernetes/connectedClusters/Delete | Deletes connectedClusters |
2016+
> | Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action | List clusterUser credential |
2017+
> | Microsoft.AzureStackHCI/clusters/read | Gets clusters |
2018+
> | **NotActions** | |
2019+
> | *none* | |
2020+
> | **DataActions** | |
2021+
> | *none* | |
2022+
> | **NotDataActions** | |
2023+
> | *none* | |
2024+
2025+
```json
2026+
{
2027+
"assignableScopes": [
2028+
"/"
2029+
],
2030+
"description": "Grants access to read and write Azure Kubernetes Services Arc clusters",
2031+
"id": "/subscriptions/586c20df-c465-4f10-8673-65aa4859e7ca/providers/Microsoft.Authorization/roleDefinitions/5d3f1697-4507-4d08-bb4a-477695db5f82",
2032+
"name": "5d3f1697-4507-4d08-bb4a-477695db5f82",
2033+
"permissions": [
2034+
{
2035+
"actions": [
2036+
"Microsoft.HybridContainerService/Locations/operationStatuses/read",
2037+
"Microsoft.HybridContainerService/Operations/read",
2038+
"Microsoft.HybridContainerService/kubernetesVersions/read",
2039+
"Microsoft.HybridContainerService/kubernetesVersions/write",
2040+
"Microsoft.HybridContainerService/kubernetesVersions/delete",
2041+
"Microsoft.HybridContainerService/provisionedClusterInstances/read",
2042+
"Microsoft.HybridContainerService/provisionedClusterInstances/write",
2043+
"Microsoft.HybridContainerService/provisionedClusterInstances/delete",
2044+
"Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
2045+
"Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
2046+
"Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
2047+
"Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
2048+
"Microsoft.HybridContainerService/skus/read",
2049+
"Microsoft.HybridContainerService/skus/write",
2050+
"Microsoft.HybridContainerService/skus/delete",
2051+
"Microsoft.HybridContainerService/virtualNetworks/read",
2052+
"Microsoft.HybridContainerService/virtualNetworks/write",
2053+
"Microsoft.HybridContainerService/virtualNetworks/delete",
2054+
"Microsoft.ExtendedLocation/customLocations/deploy/action",
2055+
"Microsoft.ExtendedLocation/customLocations/read",
2056+
"Microsoft.Kubernetes/connectedClusters/Read",
2057+
"Microsoft.Kubernetes/connectedClusters/Write",
2058+
"Microsoft.Kubernetes/connectedClusters/Delete",
2059+
"Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
2060+
"Microsoft.AzureStackHCI/clusters/read"
2061+
],
2062+
"condition": null,
2063+
"conditionVersion": null,
2064+
"dataActions": [],
2065+
"notActions": [],
2066+
"notDataActions": []
2067+
}
2068+
],
2069+
"roleName": "Azure Kubernetes Service Arc Contributor Role",
2070+
"roleType": "BuiltInRole",
2071+
"type": "Microsoft.Authorization/roleDefinitions",
2072+
}
2073+
```
2074+
18962075
## Kubernetes Agentless Operator
18972076

18982077
Grants Microsoft Defender for Cloud access to Azure Kubernetes Services
@@ -2060,4 +2239,4 @@ Can create, update, get, list and delete Kubernetes Extensions, and get extensio
20602239

20612240
## Next steps
20622241

2063-
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)
2242+
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)

0 commit comments

Comments
 (0)