Azure Containers built-in role

Azure Red Hat OpenShift Image Registry Operator

Azure Red Hat OpenShift Image Registry Operator is a service-agent role for the user-assigned managed identity associated with the Image Registry operator. It allows that operator to configure the singleton OpenShift image registry and create or manage its Azure Storage and private-network resources. Azure Red Hat OpenShift creates a separate assignment of this role on the ARO managed resource group for the service-managed resources. The role combines Azure control-plane Actions with Azure Blob DataActions for the registry content; it is not a human OpenShift administration role.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 8b32b316-c2f5-4ddf-b05b-83dacd2d08b5

Control-plane actions (25)

Data-plane actions (5)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

The ARO service creates the assignment on the managed resource group. For customer-owned resources outside that group, Microsoft documents customer-created assignments to the corresponding Image Registry operator identity only at the ARO virtual network. Do not infer additional external assignment scopes from the role's Actions.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (2)

Assignment guidance

Allow the ARO service to create Azure Red Hat OpenShift Image Registry Operator on the managed resource group. For customer-owned infrastructure, assign it only to the dedicated Image Registry operator identity at the ARO virtual network, exactly as listed in the current identity architecture and deployment examples. Do not duplicate the managed-resource-group assignment or extrapolate other external scopes from Actions, and do not grant the role to human administrators.

Related roles (1)

Common questions

When should I assign the Azure Red Hat OpenShift Image Registry Operator Azure role?

Assign Azure Red Hat OpenShift Image Registry Operator when you need to: Allow the ARO Image Registry operator identity to operate service-managed resources in the managed resource group and only the documented customer-owned resources required by the cluster architecture.. Practical scope: The ARO service creates the assignment on the managed resource group. For customer-owned resources outside that group, Microsoft documents customer-created assignments to the corresponding Image Registry operator identity only at the ARO virtual network. Do not infer additional external assignment scopes from the role's Actions.

What permissions does the Azure Red Hat OpenShift Image Registry Operator Azure role grant?

The role definition grants 30 combined control-plane and data-plane actions. Representative operations include: Microsoft.Storage/storageAccounts/blobServices/read; Microsoft.Storage/storageAccounts/blobServices/containers/read; Microsoft.Storage/storageAccounts/blobServices/containers/write; Microsoft.Storage/storageAccounts/blobServices/containers/delete; Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action; and Microsoft.Storage/storageAccounts/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Red Hat OpenShift Image Registry Operator Azure role?

Key considerations when assigning Azure Red Hat OpenShift Image Registry Operator: The operator can list storage account keys, which provide full storage-account data access, and request a blob user-delegation key that can sign SAS tokens for limited blob access. It can also change or delete storage accounts and containers and read, write, move, or delete registry blobs, affecting every image stored in the OpenShift registry.; and A broader customer-created external assignment or a human assignment would grant infrastructure permissions outside the documented ARO component boundary and bypass the separation among core operator identities.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (9)

Official Microsoft Learn documentation →