Skip to content

Commit f0d5c91

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #298910 from MicrosoftDocs/main
Merged by Learn.Build PR Management system
2 parents e186af5 + 978159f commit f0d5c91

9 files changed

+225
-16
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,12 @@ The following table provides a brief description of each built-in role. Click th
221221
> | <a name='azure-red-hat-openshift-network-operator'></a>[Azure Red Hat OpenShift Network Operator](./built-in-roles/containers.md#azure-red-hat-openshift-network-operator) | Install and upgrade the networking components on an OpenShift cluster. | be7a6435-15ae-4171-8f30-4a343eff9e8f |
222222
> | <a name='azure-red-hat-openshift-service-operator'></a>[Azure Red Hat OpenShift Service Operator](./built-in-roles/containers.md#azure-red-hat-openshift-service-operator) | Maintain machine health, network configuration, monitoring, and other features that are specific to an OpenShift cluster's continued functionality as a managed service. | 4436bae4-7702-4c84-919b-c4069ff25ee2 |
223223
> | <a name='connected-cluster-managed-identity-checkaccess-reader'></a>[Connected Cluster Managed Identity CheckAccess Reader](./built-in-roles/containers.md#connected-cluster-managed-identity-checkaccess-reader) | Built-in role that allows a Connected Cluster managed identity to call the checkAccess API | 65a14201-8f6c-4c28-bec4-12619c5a9aaa |
224+
> | <a name='container-registry-cache-rule-administrator'></a>[Container Registry Cache Rule Administrator](./built-in-roles/containers.md#container-registry-cache-rule-administrator) | Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets. | df87f177-bb12-4db1-9793-a413691eff94 |
225+
> | <a name='container-registry-cache-rule-reader'></a>[Container Registry Cache Rule Reader](./built-in-roles/containers.md#container-registry-cache-rule-reader) | Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets. | c357b964-0002-4b64-a50d-7a28f02edc52 |
224226
> | <a name='container-registry-configuration-reader-and-data-access-configuration-reader'></a>[Container Registry Configuration Reader and Data Access Configuration Reader](./built-in-roles/containers.md#container-registry-configuration-reader-and-data-access-configuration-reader) | Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks. | 69b07be0-09bf-439a-b9a6-e73de851bd59 |
225227
> | <a name='container-registry-contributor-and-data-access-configuration-administrator'></a>[Container Registry Contributor and Data Access Configuration Administrator](./built-in-roles/containers.md#container-registry-contributor-and-data-access-configuration-administrator) | Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks. | 3bc748fc-213d-45c1-8d91-9da5725539b9 |
228+
> | <a name='container-registry-credential-set-administrator'></a>[Container Registry Credential Set Administrator](./built-in-roles/containers.md#container-registry-credential-set-administrator) | Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules. | f094fb07-0703-4400-ad6a-e16dd8000e14 |
229+
> | <a name='container-registry-credential-set-reader'></a>[Container Registry Credential Set Reader](./built-in-roles/containers.md#container-registry-credential-set-reader) | Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules. | 29093635-9924-4f2c-913b-650a12949526 |
226230
> | <a name='container-registry-data-importer-and-data-reader'></a>[Container Registry Data Importer and Data Reader](./built-in-roles/containers.md#container-registry-data-importer-and-data-reader) | Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules. | 577a9874-89fd-4f24-9dbd-b5034d0ad23a |
227231
> | <a name='container-registry-repository-catalog-lister'></a>[Container Registry Repository Catalog Lister](./built-in-roles/containers.md#container-registry-repository-catalog-lister) | Allows for listing all repositories in an Azure Container Registry. This role is in preview and subject to change. | bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7 |
228232
> | <a name='container-registry-repository-contributor'></a>[Container Registry Repository Contributor](./built-in-roles/containers.md#container-registry-repository-contributor) | Allows for read, write, and delete access to Azure Container Registry repositories, but excluding catalog listing. This role is in preview and subject to change. | 2efddaa5-3f1f-4df3-97df-af3f13818f4c |

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 184 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ This article lists the Azure built-in roles in the Containers category.
2020

2121
Delete repositories, tags, or manifests from a container registry.
2222

23-
[Learn more](/azure/container-registry/container-registry-roles)
23+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
2424

2525
> [!div class="mx-tableFixed"]
2626
> | Actions | Description |
@@ -61,7 +61,7 @@ Delete repositories, tags, or manifests from a container registry.
6161

6262
Push trusted images to or pull trusted images from a container registry enabled for content trust.
6363

64-
[Learn more](/azure/container-registry/container-registry-roles)
64+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
6565

6666
> [!div class="mx-tableFixed"]
6767
> | Actions | Description |
@@ -104,7 +104,7 @@ Push trusted images to or pull trusted images from a container registry enabled
104104

105105
Pull artifacts from a container registry.
106106

107-
[Learn more](/azure/container-registry/container-registry-roles)
107+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
108108

109109
> [!div class="mx-tableFixed"]
110110
> | Actions | Description |
@@ -145,7 +145,7 @@ Pull artifacts from a container registry.
145145

146146
Push artifacts to or pull artifacts from a container registry.
147147

148-
[Learn more](/azure/container-registry/container-registry-roles)
148+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
149149

150150
> [!div class="mx-tableFixed"]
151151
> | Actions | Description |
@@ -188,7 +188,7 @@ Push artifacts to or pull artifacts from a container registry.
188188

189189
Pull quarantined images from a container registry.
190190

191-
[Learn more](/azure/container-registry/container-registry-roles)
191+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
192192

193193
> [!div class="mx-tableFixed"]
194194
> | Actions | Description |
@@ -231,7 +231,7 @@ Pull quarantined images from a container registry.
231231

232232
Push quarantined images to or pull quarantined images from a container registry.
233233

234-
[Learn more](/azure/container-registry/container-registry-roles)
234+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
235235

236236
> [!div class="mx-tableFixed"]
237237
> | Actions | Description |
@@ -2756,10 +2756,96 @@ Built-in role that allows a Connected Cluster managed identity to call the check
27562756
}
27572757
```
27582758

2759+
## Container Registry Cache Rule Administrator
2760+
2761+
Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets.
2762+
2763+
> [!div class="mx-tableFixed"]
2764+
> | Actions | Description |
2765+
> | --- | --- |
2766+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/read | Gets the properties of the specified cache rule or lists all the cache rules for the specified container registry |
2767+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/write | Creates or updates a cache rule for a container registry with the specified parameters |
2768+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/delete | Deletes a cache rule from a container registry |
2769+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/operationStatuses/read | Gets a cache rule async operation status |
2770+
> | **NotActions** | |
2771+
> | *none* | |
2772+
> | **DataActions** | |
2773+
> | *none* | |
2774+
> | **NotDataActions** | |
2775+
> | *none* | |
2776+
2777+
```json
2778+
{
2779+
"assignableScopes": [
2780+
"/"
2781+
],
2782+
"description": "Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets.",
2783+
"id": "/providers/Microsoft.Authorization/roleDefinitions/df87f177-bb12-4db1-9793-a413691eff94",
2784+
"name": "df87f177-bb12-4db1-9793-a413691eff94",
2785+
"permissions": [
2786+
{
2787+
"actions": [
2788+
"Microsoft.ContainerRegistry/registries/cacheRules/read",
2789+
"Microsoft.ContainerRegistry/registries/cacheRules/write",
2790+
"Microsoft.ContainerRegistry/registries/cacheRules/delete",
2791+
"Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
2792+
],
2793+
"notActions": [],
2794+
"dataActions": [],
2795+
"notDataActions": []
2796+
}
2797+
],
2798+
"roleName": "Container Registry Cache Rule Administrator",
2799+
"roleType": "BuiltInRole",
2800+
"type": "Microsoft.Authorization/roleDefinitions"
2801+
}
2802+
```
2803+
2804+
## Container Registry Cache Rule Reader
2805+
2806+
Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets.
2807+
2808+
> [!div class="mx-tableFixed"]
2809+
> | Actions | Description |
2810+
> | --- | --- |
2811+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/read | Gets the properties of the specified cache rule or lists all the cache rules for the specified container registry |
2812+
> | **NotActions** | |
2813+
> | *none* | |
2814+
> | **DataActions** | |
2815+
> | *none* | |
2816+
> | **NotDataActions** | |
2817+
> | *none* | |
2818+
2819+
```json
2820+
{
2821+
"assignableScopes": [
2822+
"/"
2823+
],
2824+
"description": "Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets.",
2825+
"id": "/providers/Microsoft.Authorization/roleDefinitions/c357b964-0002-4b64-a50d-7a28f02edc52",
2826+
"name": "c357b964-0002-4b64-a50d-7a28f02edc52",
2827+
"permissions": [
2828+
{
2829+
"actions": [
2830+
"Microsoft.ContainerRegistry/registries/cacheRules/read"
2831+
],
2832+
"notActions": [],
2833+
"dataActions": [],
2834+
"notDataActions": []
2835+
}
2836+
],
2837+
"roleName": "Container Registry Cache Rule Reader",
2838+
"roleType": "BuiltInRole",
2839+
"type": "Microsoft.Authorization/roleDefinitions"
2840+
}
2841+
```
2842+
27592843
## Container Registry Configuration Reader and Data Access Configuration Reader
27602844

27612845
Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.
27622846

2847+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
2848+
27632849
> [!div class="mx-tableFixed"]
27642850
> | Actions | Description |
27652851
> | --- | --- |
@@ -2851,6 +2937,8 @@ Provides permissions to list container registries and registry configuration pro
28512937

28522938
Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.
28532939

2940+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
2941+
28542942
> [!div class="mx-tableFixed"]
28552943
> | Actions | Description |
28562944
> | --- | --- |
@@ -2994,10 +3082,96 @@ Provides permissions to create, list, and update container registries and regist
29943082
}
29953083
```
29963084

3085+
## Container Registry Credential Set Administrator
3086+
3087+
Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules.
3088+
3089+
> [!div class="mx-tableFixed"]
3090+
> | Actions | Description |
3091+
> | --- | --- |
3092+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/read | Gets the properties of the specified credential set or lists all the credential sets for the specified container registry |
3093+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/write | Creates or updates a credential set for a container registry with the specified parameters |
3094+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/delete | Deletes a credential set from a container registry |
3095+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/operationStatuses/read | Gets a credential set async operation status |
3096+
> | **NotActions** | |
3097+
> | *none* | |
3098+
> | **DataActions** | |
3099+
> | *none* | |
3100+
> | **NotDataActions** | |
3101+
> | *none* | |
3102+
3103+
```json
3104+
{
3105+
"assignableScopes": [
3106+
"/"
3107+
],
3108+
"description": "Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules.",
3109+
"id": "/providers/Microsoft.Authorization/roleDefinitions/f094fb07-0703-4400-ad6a-e16dd8000e14",
3110+
"name": "f094fb07-0703-4400-ad6a-e16dd8000e14",
3111+
"permissions": [
3112+
{
3113+
"actions": [
3114+
"Microsoft.ContainerRegistry/registries/credentialSets/read",
3115+
"Microsoft.ContainerRegistry/registries/credentialSets/write",
3116+
"Microsoft.ContainerRegistry/registries/credentialSets/delete",
3117+
"Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
3118+
],
3119+
"notActions": [],
3120+
"dataActions": [],
3121+
"notDataActions": []
3122+
}
3123+
],
3124+
"roleName": "Container Registry Credential Set Administrator",
3125+
"roleType": "BuiltInRole",
3126+
"type": "Microsoft.Authorization/roleDefinitions"
3127+
}
3128+
```
3129+
3130+
## Container Registry Credential Set Reader
3131+
3132+
Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules.
3133+
3134+
> [!div class="mx-tableFixed"]
3135+
> | Actions | Description |
3136+
> | --- | --- |
3137+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/read | Gets the properties of the specified credential set or lists all the credential sets for the specified container registry |
3138+
> | **NotActions** | |
3139+
> | *none* | |
3140+
> | **DataActions** | |
3141+
> | *none* | |
3142+
> | **NotDataActions** | |
3143+
> | *none* | |
3144+
3145+
```json
3146+
{
3147+
"assignableScopes": [
3148+
"/"
3149+
],
3150+
"description": "Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules.",
3151+
"id": "/providers/Microsoft.Authorization/roleDefinitions/29093635-9924-4f2c-913b-650a12949526",
3152+
"name": "29093635-9924-4f2c-913b-650a12949526",
3153+
"permissions": [
3154+
{
3155+
"actions": [
3156+
"Microsoft.ContainerRegistry/registries/credentialSets/read"
3157+
],
3158+
"notActions": [],
3159+
"dataActions": [],
3160+
"notDataActions": []
3161+
}
3162+
],
3163+
"roleName": "Container Registry Credential Set Reader",
3164+
"roleType": "BuiltInRole",
3165+
"type": "Microsoft.Authorization/roleDefinitions"
3166+
}
3167+
```
3168+
29973169
## Container Registry Data Importer and Data Reader
29983170

29993171
Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules.
30003172

3173+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
3174+
30013175
> [!div class="mx-tableFixed"]
30023176
> | Actions | Description |
30033177
> | --- | --- |
@@ -3215,6 +3389,8 @@ Allows for read and write access to Azure Container Registry repositories, but e
32153389

32163390
Provides permissions to configure, read, list, trigger, or cancel Container Registry Tasks, Task Runs, Task Logs, Quick Runs, Quick Builds, and Task Agent Pools. Permissions granted for Tasks management can be used for full registry data plane permissions including reading/writing/deleting container images in registries. Permissions granted for Tasks management can also be used to run customer authored build directives and run scripts to build software artifacts.
32173391

3392+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
3393+
32183394
> [!div class="mx-tableFixed"]
32193395
> | Actions | Description |
32203396
> | --- | --- |
@@ -3300,6 +3476,8 @@ Provides permissions to configure, read, list, trigger, or cancel Container Regi
33003476

33013477
Provides the ability to transfer, import, and export artifacts through configuring registry transfer pipelines that involve intermediary storage accounts and key vaults. Does not provide permissions to push or pull images. Does not provide permissions to create, manage, or list storage accounts or key vaults. Does not provide permissions to perform role assignments.
33023478

3479+
[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)
3480+
33033481
> [!div class="mx-tableFixed"]
33043482
> | Actions | Description |
33053483
> | --- | --- |

0 commit comments

Comments
 (0)