Voltar

Azure Kubernetes Fleet Manager RBAC Reader

Azure RBAC · Containers · Contributor

Azure Kubernetes Fleet Manager RBAC Reader

Privilegiada
ContributorIAM ScopeContainers·36 na definição · ≥ 34 efetivas

Dado verificado em · Fonte

Entradas na definição

36

Actions

0

NotActions

0

DataActions

0

Alcance efetivo

piso, não total

Control plane

34

Data plane

29

Na definição (nativo)

36

Piso, não total: expandido contra 17.591 ações de 151 providers colhidas da documentação da Microsoft. A Azure Management API expõe mais — o número real é maior, nunca menor.

Role ID
30b27cfc-9c84-438e-b0ce-70e35255df80
Categoria
Containers
Risk Tier
Contributor (CTB)
Risk Tier: Contributor

Grants full write access to create and manage all resources but cannot assign roles or manage access to others.

Descrição

Microsoft

Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.

Permissões

MicrosoftCarregando...Azure built-in roles

Role Definition (JSON)

{

  "Name": "Azure Kubernetes Fleet Manager RBAC Reader",

  "Id": "30b27cfc-9c84-438e-b0ce-70e35255df80",

  "IsCustom": false,

  "Description": "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",

  "Actions": [],

  "NotActions": [],

  "DataActions": [],

  "NotDataActions": [],

  "AssignableScopes": [

    "/"

  ]

Assignable Scopes

/

PowerShell

Get-AzRoleDefinition -Name "Azure Kubernetes Fleet Manager RBAC Reader"

Azure CLI

az role definition list --name "Azure Kubernetes Fleet Manager RBAC Reader"
Ver a documentação oficial na Microsoft Learn