// roles/azure · containers

Azure Kubernetes Fleet Manager RBAC WriterAzure built-in role

Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.

Role ID	`5af6afb3-c06c-4fa4-8848-71a8aee05683`
Category	Containers
Actions	6
Data actions	51

Before you assign it

It reaches the data, not just the resource. It has 51 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.ContainerService/fleets/read`	Get fleet
`Microsoft.ContainerService/fleets/listCredentials/action`	List fleet credentials

Data actions

Permission	What it allows
`Microsoft.ContainerService/fleets/apps/controllerrevisions/read`	Reads controllerrevisions
`Microsoft.ContainerService/fleets/apps/daemonsets/read`	Reads daemonsets
`Microsoft.ContainerService/fleets/apps/daemonsets/write`	Writes daemonsets
`Microsoft.ContainerService/fleets/apps/deployments/read`	Reads deployments
`Microsoft.ContainerService/fleets/apps/deployments/write`	Writes deployments
`Microsoft.ContainerService/fleets/apps/statefulsets/read`	Reads statefulsets
`Microsoft.ContainerService/fleets/apps/statefulsets/write`	Writes statefulsets
`Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read`	Reads horizontalpodautoscalers
`Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write`	Writes horizontalpodautoscalers
`Microsoft.ContainerService/fleets/batch/cronjobs/read`	Reads cronjobs
`Microsoft.ContainerService/fleets/batch/cronjobs/write`	Writes cronjobs
`Microsoft.ContainerService/fleets/batch/jobs/read`	Reads jobs
`Microsoft.ContainerService/fleets/batch/jobs/write`	Writes jobs
`Microsoft.ContainerService/fleets/configmaps/read`	Reads configmaps
`Microsoft.ContainerService/fleets/configmaps/write`	Writes configmaps
`Microsoft.ContainerService/fleets/endpoints/read`	Reads endpoints
`Microsoft.ContainerService/fleets/endpoints/write`	Writes endpoints
`Microsoft.ContainerService/fleets/events.k8s.io/events/read`	Reads events
`Microsoft.ContainerService/fleets/events/read`	Reads events
`Microsoft.ContainerService/fleets/extensions/daemonsets/read`	Reads daemonsets
`Microsoft.ContainerService/fleets/extensions/daemonsets/write`	Writes daemonsets
`Microsoft.ContainerService/fleets/extensions/deployments/read`	Reads deployments
`Microsoft.ContainerService/fleets/extensions/deployments/write`	Writes deployments
`Microsoft.ContainerService/fleets/extensions/ingresses/read`	Reads ingresses
`Microsoft.ContainerService/fleets/extensions/ingresses/write`	Writes ingresses
`Microsoft.ContainerService/fleets/extensions/networkpolicies/read`	Reads networkpolicies
`Microsoft.ContainerService/fleets/extensions/networkpolicies/write`	Writes networkpolicies
`Microsoft.ContainerService/fleets/limitranges/read`	Reads limitranges
`Microsoft.ContainerService/fleets/namespaces/read`	Reads namespaces
`Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read`	Reads ingresses
`Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write`	Writes ingresses
`Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read`	Reads networkpolicies
`Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write`	Writes networkpolicies
`Microsoft.ContainerService/fleets/persistentvolumeclaims/read`	Reads persistentvolumeclaims
`Microsoft.ContainerService/fleets/persistentvolumeclaims/write`	Writes persistentvolumeclaims
`Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read`	Reads poddisruptionbudgets
`Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write`	Writes poddisruptionbudgets
`Microsoft.ContainerService/fleets/replicationcontrollers/read`	Reads replicationcontrollers
`Microsoft.ContainerService/fleets/replicationcontrollers/write`	Writes replicationcontrollers
`Microsoft.ContainerService/fleets/resourcequotas/read`	Reads resourcequotas
`Microsoft.ContainerService/fleets/secrets/read`	Reads secrets
`Microsoft.ContainerService/fleets/secrets/write`	Writes secrets
`Microsoft.ContainerService/fleets/serviceaccounts/read`	Reads serviceaccounts
`Microsoft.ContainerService/fleets/serviceaccounts/write`	Writes serviceaccounts
`Microsoft.ContainerService/fleets/services/read`	Reads services
`Microsoft.ContainerService/fleets/services/write`	Writes services
`Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read`	Read fleet internalmembercluster resource
`Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read`	Read fleet resourceoverride resource
`Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/write`	Write fleet resourceoverride resource
`Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read`	Read fleet resourceoverridesnapshot resource
`Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read`	Read fleet work resource

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Kubernetes Fleet Manager RBAC Writer" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Kubernetes Fleet Manager RBAC Writer" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '5af6afb3-c06c-4fa4-8848-71a8aee05683')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5af6afb3-c06c-4fa4-8848-71a8aee05683')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "5af6afb3-c06c-4fa4-8848-71a8aee05683"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles