// roles/azure · containers

Azure Red Hat OpenShift File Storage OperatorAzure built-in role

Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Files. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters.

Role ID	`0d7aedc0-15fd-4a67-a412-efad370c947e`
Category	Containers
Actions	30
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Storage/storageAccounts/delete`	Deletes an existing storage account.
`Microsoft.Storage/storageAccounts/fileServices/read`	List file services
`Microsoft.Storage/storageAccounts/fileServices/shares/delete`	Delete file share
`Microsoft.Storage/storageAccounts/fileServices/shares/read`	Get file share
`Microsoft.Storage/storageAccounts/fileServices/shares/write`	Create or update file share
`Microsoft.Storage/storageAccounts/listKeys/action`	Returns the access keys for the specified storage account.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/write`	Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.
`Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/routeTables/join/action`	Joins a route table. Not Alertable.
`Microsoft.Network/natGateways/join/action`	Joins a NAT Gateway
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/privateEndpoints/write`	Creates a new private endpoint, or updates an existing private endpoint.
`Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action`	Action permission for associate resources to Ipam Pool
`Microsoft.Network/networkIntentPolicies/join/action`	Joins a Network Intent Policy. Not alertable.
`Microsoft.Network/serviceEndpointPolicies/join/action`	Joins a Service Endpoint Policy. Not alertable.
`Microsoft.Network/locations/operations/read`	Gets operation resource that represents status of an asynchronous operation
`Microsoft.Network/privateDnsOperationStatuses/read`	Gets status of a Private DNS operation
`Microsoft.Network/privateDnsZones/read`	Get the Private DNS zone properties, in JSON format. Note that this command does not retrieve the virtual networks to which the Private DNS zone is linked or the record sets contained within the zone.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/read`	Get the Private DNS zone link to virtual network properties, in JSON format.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/write`	Create or update a Private DNS zone link to virtual network.
`Microsoft.Network/privateDnsZones/write`	Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone.
`Microsoft.Network/privateDnsZones/join/action`	Joins a Private DNS Zone
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write`	Puts a Private DNS Zone Group
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read`	Gets a Private DNS Zone Group
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Red Hat OpenShift File Storage Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Red Hat OpenShift File Storage Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '0d7aedc0-15fd-4a67-a412-efad370c947e')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0d7aedc0-15fd-4a67-a412-efad370c947e')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "0d7aedc0-15fd-4a67-a412-efad370c947e"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles