Azure Kubernetes Fleet Manager RBAC Reader

Privilegiada

ContributorIAM ScopeContainers·36 permissões

Dado verificado em 31/07/2026 · Fonte

Total de permissões

Actions

NotActions

DataActions

Role ID

30b27cfc-9c84-438e-b0ce-70e35255df80

Categoria

Containers

Risk Tier

Contributor (CTB)

Risk Tier: Contributor

Grants full write access to create and manage all resources but cannot assign roles or manage access to others.

Descrição

Microsoft

Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.

Permissões

MicrosoftCarregando...Azure built-in roles

Role Definition (JSON)

{
  "Name": "Azure Kubernetes Fleet Manager RBAC Reader",
  "Id": "30b27cfc-9c84-438e-b0ce-70e35255df80",
  "IsCustom": false,
  "Description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
  "Actions": [],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/"
  ]

Assignable Scopes

PowerShell

Get-AzRoleDefinition -Name "Azure Kubernetes Fleet Manager RBAC Reader"

Azure CLI

az role definition list --name "Azure Kubernetes Fleet Manager RBAC Reader"

Ver a documentação oficial na Microsoft Learn