Azure Containers built-in role

Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters

Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters grants read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility on member clusters reached through a Managed Fleet Namespace. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService Fleet resource provider.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 463ad26c-fcce-4469-9c7f-5653d8acbab5

Control-plane actions (4)

Data-plane actions (31)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. Microsoft warns that a Managed Fleet Namespace assignment also grants access to unmanaged namespaces with the same name on member clusters.

Common use cases (1)

Prerequisites (1)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters at the exact Fleet resource or Managed Fleet Namespace ARM subresource to the principal that needs read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.

Editorial sources (6)

Official Microsoft Learn documentation →