Administrator
- Administrator
- All Products
{ "properties":{ "roleName":"cluster_role", "description":"", "assignableScopes":[ "/subscriptions/<subscription ID>/resourceGroups/<cluster_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<storage_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<vnet_resource_group>", "/subscriptions/<subscription ID>/resourceGroups/<managed_identity_resource_group>" ], "permissions":[ { "actions":[ "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Compute/virtualMachineScaleSets/delete/action", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/instanceView/read", "Microsoft.Compute/virtualMachineScaleSets/write", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/write", "Microsoft.Network/loadBalancers/backendAddressPools/join/action", "Microsoft.Compute/disks/delete", "Microsoft.Compute/disks/write", "Microsoft.Compute/disks/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write", "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action" ], "notActions":[], "dataActions":[], "notDataActions":[] } ] } }
Permission
| Description
|
---|---|
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
Microsoft.Compute/virtualMachineScaleSets/write
Microsoft.Network/loadBalancers/backendAddressPools/join/action
Microsoft.Network/networkSecurityGroups/join/action
| Required. Used by the Secure Agent to discover cluster resources.
|
Microsoft.Network/virtualNetworks/subnets/join/action
| Required. Used by the Secure Agent to discover cluster resources.
If you use an existing VNet, the scope for this permission must include the resource group that holds the VNet.
|
Microsoft.Network/virtualNetworks/subnets/read
| Required if you use an existing VNet. The scope for this permission must include the resource group that holds the VNet.
|
Microsoft.Network/virtualNetworks/subnets/write
| Required. Used to create and update a subnet.
|
Microsoft.Compute/virtualMachineScaleSets/read
Microsoft.Compute/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read
Microsoft.Compute/virtualMachineScaleSets/instanceView/read
| Required. Used by the Secure Agent to discover master and worker nodes running in Azure.
|
Microsoft.Network/virtualNetworks/subnets/join/action
Microsoft.Compute/virtualMachineScaleSets/write
Microsoft.Network/networkSecurityGroups/join/action
| Required when the cluster auto-scales to add a worker node to the cluster.
|
Microsoft.Compute/disks/write
Microsoft.Compute/disks/read
Microsoft.Compute/disks/delete
| Required when storage auto-scales.
These permissions manage disks on Azure.
|
Microsoft.Compute/virtualMachineScaleSets/virtualmachines/write
| Required when the storage and cluster auto-scales.
These permissions attach Azure disks to worker nodes.
|
Microsoft.Network/virtualNetworks/subnets/join/action
| Required when the storage and cluster auto-scale.
|
Microsoft.Network/networkSecurityGroups/join/action
| Required when the storage and cluster auto-scale.
The Secure Agent uses this permission to update the metadata attached to master and worker nodes.
|
Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
| Required when you use managed identity authentication to connect to a source or target. The service principal uses this permission to assign managed identities to virtual machines in the virtual machine scale sets.
|