// roles/azure · containers

Azure Kubernetes Service RBAC ReaderAzure built-in role

Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.

Role ID	`7f6c6a51-bcf8-42ba-9220-52d62157d7db`
Category	Containers
Actions	4
Data actions	31

Before you assign it

It reaches the data, not just the resource. It has 31 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.

Data actions

Permission	What it allows
`Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read`	Reads controllerrevisions
`Microsoft.ContainerService/managedClusters/apps/daemonsets/read`	Reads daemonsets
`Microsoft.ContainerService/managedClusters/apps/deployments/read`	Reads deployments
`Microsoft.ContainerService/managedClusters/apps/replicasets/read`	Reads replicasets
`Microsoft.ContainerService/managedClusters/apps/statefulsets/read`	Reads statefulsets
`Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read`	Reads horizontalpodautoscalers
`Microsoft.ContainerService/managedClusters/batch/cronjobs/read`	Reads cronjobs
`Microsoft.ContainerService/managedClusters/batch/jobs/read`	Reads jobs
`Microsoft.ContainerService/managedClusters/configmaps/read`	Reads configmaps
`Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read`	Reads endpointslices
`Microsoft.ContainerService/managedClusters/endpoints/read`	Reads endpoints
`Microsoft.ContainerService/managedClusters/events.k8s.io/events/read`	Reads events
`Microsoft.ContainerService/managedClusters/events/read`	Reads events
`Microsoft.ContainerService/managedClusters/extensions/daemonsets/read`	Reads daemonsets
`Microsoft.ContainerService/managedClusters/extensions/deployments/read`	Reads deployments
`Microsoft.ContainerService/managedClusters/extensions/ingresses/read`	Reads ingresses
`Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read`	Reads networkpolicies
`Microsoft.ContainerService/managedClusters/extensions/replicasets/read`	Reads replicasets
`Microsoft.ContainerService/managedClusters/limitranges/read`	Reads limitranges
`Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read`	Reads pods
`Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read`	Reads nodes
`Microsoft.ContainerService/managedClusters/namespaces/read`	Reads namespaces
`Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read`	Reads ingresses
`Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read`	Reads networkpolicies
`Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read`	Reads persistentvolumeclaims
`Microsoft.ContainerService/managedClusters/pods/read`	Reads pods
`Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read`	Reads poddisruptionbudgets
`Microsoft.ContainerService/managedClusters/replicationcontrollers/read`	Reads replicationcontrollers
`Microsoft.ContainerService/managedClusters/resourcequotas/read`	Reads resourcequotas
`Microsoft.ContainerService/managedClusters/serviceaccounts/read`	Reads serviceaccounts
`Microsoft.ContainerService/managedClusters/services/read`	Reads services

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Kubernetes Service RBAC Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Kubernetes Service RBAC Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '7f6c6a51-bcf8-42ba-9220-52d62157d7db')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f6c6a51-bcf8-42ba-9220-52d62157d7db')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "7f6c6a51-bcf8-42ba-9220-52d62157d7db"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles