Skip to content

Commit f3d6d71

Browse files
rolyonrolyon
committed
Cache Rule and Credential Set roles
1 parent 420613e commit f3d6d71

File tree

2 files changed

+172
-0
lines changed

2 files changed

+172
-0
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,12 @@ The following table provides a brief description of each built-in role. Click th
221221
> | <a name='azure-red-hat-openshift-network-operator'></a>[Azure Red Hat OpenShift Network Operator](./built-in-roles/containers.md#azure-red-hat-openshift-network-operator) | Install and upgrade the networking components on an OpenShift cluster. | be7a6435-15ae-4171-8f30-4a343eff9e8f |
222222
> | <a name='azure-red-hat-openshift-service-operator'></a>[Azure Red Hat OpenShift Service Operator](./built-in-roles/containers.md#azure-red-hat-openshift-service-operator) | Maintain machine health, network configuration, monitoring, and other features that are specific to an OpenShift cluster's continued functionality as a managed service. | 4436bae4-7702-4c84-919b-c4069ff25ee2 |
223223
> | <a name='connected-cluster-managed-identity-checkaccess-reader'></a>[Connected Cluster Managed Identity CheckAccess Reader](./built-in-roles/containers.md#connected-cluster-managed-identity-checkaccess-reader) | Built-in role that allows a Connected Cluster managed identity to call the checkAccess API | 65a14201-8f6c-4c28-bec4-12619c5a9aaa |
224+
> | <a name='container-registry-cache-rule-administrator'></a>[Container Registry Cache Rule Administrator](./built-in-roles/containers.md#container-registry-cache-rule-administrator) | Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets. | df87f177-bb12-4db1-9793-a413691eff94 |
225+
> | <a name='container-registry-cache-rule-reader'></a>[Container Registry Cache Rule Reader](./built-in-roles/containers.md#container-registry-cache-rule-reader) | Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets. | c357b964-0002-4b64-a50d-7a28f02edc52 |
224226
> | <a name='container-registry-configuration-reader-and-data-access-configuration-reader'></a>[Container Registry Configuration Reader and Data Access Configuration Reader](./built-in-roles/containers.md#container-registry-configuration-reader-and-data-access-configuration-reader) | Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks. | 69b07be0-09bf-439a-b9a6-e73de851bd59 |
225227
> | <a name='container-registry-contributor-and-data-access-configuration-administrator'></a>[Container Registry Contributor and Data Access Configuration Administrator](./built-in-roles/containers.md#container-registry-contributor-and-data-access-configuration-administrator) | Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks. | 3bc748fc-213d-45c1-8d91-9da5725539b9 |
228+
> | <a name='container-registry-credential-set-administrator'></a>[Container Registry Credential Set Administrator](./built-in-roles/containers.md#container-registry-credential-set-administrator) | Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules. | f094fb07-0703-4400-ad6a-e16dd8000e14 |
229+
> | <a name='container-registry-credential-set-reader'></a>[Container Registry Credential Set Reader](./built-in-roles/containers.md#container-registry-credential-set-reader) | Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules. | 29093635-9924-4f2c-913b-650a12949526 |
226230
> | <a name='container-registry-data-importer-and-data-reader'></a>[Container Registry Data Importer and Data Reader](./built-in-roles/containers.md#container-registry-data-importer-and-data-reader) | Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules. | 577a9874-89fd-4f24-9dbd-b5034d0ad23a |
227231
> | <a name='container-registry-repository-catalog-lister'></a>[Container Registry Repository Catalog Lister](./built-in-roles/containers.md#container-registry-repository-catalog-lister) | Allows for listing all repositories in an Azure Container Registry. This role is in preview and subject to change. | bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7 |
228232
> | <a name='container-registry-repository-contributor'></a>[Container Registry Repository Contributor](./built-in-roles/containers.md#container-registry-repository-contributor) | Allows for read, write, and delete access to Azure Container Registry repositories, but excluding catalog listing. This role is in preview and subject to change. | 2efddaa5-3f1f-4df3-97df-af3f13818f4c |

‎articles/role-based-access-control/built-in-roles/containers.md

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2756,6 +2756,90 @@ Built-in role that allows a Connected Cluster managed identity to call the check
27562756
}
27572757
```
27582758

2759+
## Container Registry Cache Rule Administrator
2760+
2761+
Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets.
2762+
2763+
> [!div class="mx-tableFixed"]
2764+
> | Actions | Description |
2765+
> | --- | --- |
2766+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/read | Gets the properties of the specified cache rule or lists all the cache rules for the specified container registry |
2767+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/write | Creates or updates a cache rule for a container registry with the specified parameters |
2768+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/delete | Deletes a cache rule from a container registry |
2769+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/operationStatuses/read | Gets a cache rule async operation status |
2770+
> | **NotActions** | |
2771+
> | *none* | |
2772+
> | **DataActions** | |
2773+
> | *none* | |
2774+
> | **NotDataActions** | |
2775+
> | *none* | |
2776+
2777+
```json
2778+
{
2779+
"assignableScopes": [
2780+
"/"
2781+
],
2782+
"description": "Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn't grant permissions to manage Credential Sets.",
2783+
"id": "/providers/Microsoft.Authorization/roleDefinitions/df87f177-bb12-4db1-9793-a413691eff94",
2784+
"name": "df87f177-bb12-4db1-9793-a413691eff94",
2785+
"permissions": [
2786+
{
2787+
"actions": [
2788+
"Microsoft.ContainerRegistry/registries/cacheRules/read",
2789+
"Microsoft.ContainerRegistry/registries/cacheRules/write",
2790+
"Microsoft.ContainerRegistry/registries/cacheRules/delete",
2791+
"Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
2792+
],
2793+
"notActions": [],
2794+
"dataActions": [],
2795+
"notDataActions": []
2796+
}
2797+
],
2798+
"roleName": "Container Registry Cache Rule Administrator",
2799+
"roleType": "BuiltInRole",
2800+
"type": "Microsoft.Authorization/roleDefinitions"
2801+
}
2802+
```
2803+
2804+
## Container Registry Cache Rule Reader
2805+
2806+
Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets.
2807+
2808+
> [!div class="mx-tableFixed"]
2809+
> | Actions | Description |
2810+
> | --- | --- |
2811+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/cacheRules/read | Gets the properties of the specified cache rule or lists all the cache rules for the specified container registry |
2812+
> | **NotActions** | |
2813+
> | *none* | |
2814+
> | **DataActions** | |
2815+
> | *none* | |
2816+
> | **NotDataActions** | |
2817+
> | *none* | |
2818+
2819+
```json
2820+
{
2821+
"assignableScopes": [
2822+
"/"
2823+
],
2824+
"description": "Read the configuration of Cache Rules in Container Registry. This permission doesn't grant permission to read Credential Sets.",
2825+
"id": "/providers/Microsoft.Authorization/roleDefinitions/c357b964-0002-4b64-a50d-7a28f02edc52",
2826+
"name": "c357b964-0002-4b64-a50d-7a28f02edc52",
2827+
"permissions": [
2828+
{
2829+
"actions": [
2830+
"Microsoft.ContainerRegistry/registries/cacheRules/read"
2831+
],
2832+
"notActions": [],
2833+
"dataActions": [],
2834+
"notDataActions": []
2835+
}
2836+
],
2837+
"roleName": "Container Registry Cache Rule Reader",
2838+
"roleType": "BuiltInRole",
2839+
"type": "Microsoft.Authorization/roleDefinitions"
2840+
}
2841+
```
2842+
27592843
## Container Registry Configuration Reader and Data Access Configuration Reader
27602844

27612845
Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.
@@ -2994,6 +3078,90 @@ Provides permissions to create, list, and update container registries and regist
29943078
}
29953079
```
29963080

3081+
## Container Registry Credential Set Administrator
3082+
3083+
Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules.
3084+
3085+
> [!div class="mx-tableFixed"]
3086+
> | Actions | Description |
3087+
> | --- | --- |
3088+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/read | Gets the properties of the specified credential set or lists all the credential sets for the specified container registry |
3089+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/write | Creates or updates a credential set for a container registry with the specified parameters |
3090+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/delete | Deletes a credential set from a container registry |
3091+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/operationStatuses/read | Gets a credential set async operation status |
3092+
> | **NotActions** | |
3093+
> | *none* | |
3094+
> | **DataActions** | |
3095+
> | *none* | |
3096+
> | **NotDataActions** | |
3097+
> | *none* | |
3098+
3099+
```json
3100+
{
3101+
"assignableScopes": [
3102+
"/"
3103+
],
3104+
"description": "Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn't affect the needed permissions for storing content inside Azure Key Vault. This role also doesn't grant permissions to manage Cache Rules.",
3105+
"id": "/providers/Microsoft.Authorization/roleDefinitions/f094fb07-0703-4400-ad6a-e16dd8000e14",
3106+
"name": "f094fb07-0703-4400-ad6a-e16dd8000e14",
3107+
"permissions": [
3108+
{
3109+
"actions": [
3110+
"Microsoft.ContainerRegistry/registries/credentialSets/read",
3111+
"Microsoft.ContainerRegistry/registries/credentialSets/write",
3112+
"Microsoft.ContainerRegistry/registries/credentialSets/delete",
3113+
"Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
3114+
],
3115+
"notActions": [],
3116+
"dataActions": [],
3117+
"notDataActions": []
3118+
}
3119+
],
3120+
"roleName": "Container Registry Credential Set Administrator",
3121+
"roleType": "BuiltInRole",
3122+
"type": "Microsoft.Authorization/roleDefinitions"
3123+
}
3124+
```
3125+
3126+
## Container Registry Credential Set Reader
3127+
3128+
Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules.
3129+
3130+
> [!div class="mx-tableFixed"]
3131+
> | Actions | Description |
3132+
> | --- | --- |
3133+
> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/credentialSets/read | Gets the properties of the specified credential set or lists all the credential sets for the specified container registry |
3134+
> | **NotActions** | |
3135+
> | *none* | |
3136+
> | **DataActions** | |
3137+
> | *none* | |
3138+
> | **NotDataActions** | |
3139+
> | *none* | |
3140+
3141+
```json
3142+
{
3143+
"assignableScopes": [
3144+
"/"
3145+
],
3146+
"description": "Read the configuration of Credential Sets in Container Registry. This permission doesn't allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn't grant permission to read Cache Rules.",
3147+
"id": "/providers/Microsoft.Authorization/roleDefinitions/29093635-9924-4f2c-913b-650a12949526",
3148+
"name": "29093635-9924-4f2c-913b-650a12949526",
3149+
"permissions": [
3150+
{
3151+
"actions": [
3152+
"Microsoft.ContainerRegistry/registries/credentialSets/read"
3153+
],
3154+
"notActions": [],
3155+
"dataActions": [],
3156+
"notDataActions": []
3157+
}
3158+
],
3159+
"roleName": "Container Registry Credential Set Reader",
3160+
"roleType": "BuiltInRole",
3161+
"type": "Microsoft.Authorization/roleDefinitions"
3162+
}
3163+
```
3164+
29973165
## Container Registry Data Importer and Data Reader
29983166

29993167
Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules.

0 commit comments

Comments
 (0)