Azure Containers built-in role

Azure Kubernetes Fleet Manager RBAC Writer

Azure Kubernetes Fleet Manager RBAC Writer grants read and write access to most Kubernetes objects, excluding role and role-binding management on the fleet-managed hub cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService Fleet resource provider. The role also includes Fleet read and listCredentials Actions, so the assignee can retrieve the hub-cluster kubeconfig; credential retrieval is not a separate assignment for this role.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 5af6afb3-c06c-4fa4-8848-71a8aee05683

Control-plane actions (6)

Data-plane actions (51)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. At Fleet scope, the hub role applies across hub namespaces; at Managed Fleet Namespace scope, it is limited to that managed namespace.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign Azure Kubernetes Fleet Manager RBAC Writer at the exact Fleet resource or Managed Fleet Namespace ARM subresource to the principal that needs read and write access to most Kubernetes objects, excluding role and role-binding management. Treat the included kubeconfig retrieval as part of the grant, test both credential download and Kubernetes authorization, and protect downloaded credentials.

Common questions

When should I assign the Azure Kubernetes Fleet Manager RBAC Writer Azure role?

Assign Azure Kubernetes Fleet Manager RBAC Writer when you need to: Let an application team deploy and operate workloads in a Fleet hub namespace without directly managing Kubernetes roles or role bindings.. Practical scope: Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. At Fleet scope, the hub role applies across hub namespaces; at Managed Fleet Namespace scope, it is limited to that managed namespace.

What permissions does the Azure Kubernetes Fleet Manager RBAC Writer Azure role grant?

The role definition grants 57 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.ContainerService/fleets/read; and Microsoft.ContainerService/fleets/listCredentials/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Kubernetes Fleet Manager RBAC Writer Azure role?

Key considerations when assigning Azure Kubernetes Fleet Manager RBAC Writer: The role can read Secrets and run pods as any ServiceAccount in scope, so it can inherit the Kubernetes API permissions of those ServiceAccounts even though it cannot edit role bindings directly.; An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.; and The included credential-list Action exposes a reusable kubeconfig connection context in addition to the role's Kubernetes API DataActions.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →