Azure Containers built-in role

Azure Kubernetes Service RBAC Reader

Azure Kubernetes Service RBAC Reader grants read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility on the AKS cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService managed-cluster resource provider.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 7f6c6a51-bcf8-42ba-9220-52d62157d7db

Control-plane actions (4)

Data-plane actions (31)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the AKS cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.

Common use cases (1)

Prerequisites (1)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign Azure Kubernetes Service RBAC Reader at the narrowest documented namespace scope to the principal that needs read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.

Common questions

When should I assign the Azure Kubernetes Service RBAC Reader Azure role?

Assign Azure Kubernetes Service RBAC Reader when you need to: Let an approved reviewer inspect nonsensitive workload state in an AKS cluster or namespace without reading Secrets or changing Kubernetes objects.. Practical scope: Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the AKS cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.

What permissions does the Azure Kubernetes Service RBAC Reader Azure role grant?

The role definition grants 35 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read; and Microsoft.ContainerService/managedClusters/apps/daemonsets/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Kubernetes Service RBAC Reader Azure role?

Key considerations when assigning Azure Kubernetes Service RBAC Reader: The role deliberately excludes Secrets because reading them can expose ServiceAccount credentials and enable privilege escalation; other visible workload configuration can still contain operationally sensitive data.; and An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →