Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters

{
  "properties": {
    "roleName": "Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters",
    "type": "BuiltInRole",
    "description": "Allows\u00a0read-only\u00a0access\u00a0to\u00a0see\u00a0most\u00a0objects\u00a0in\u00a0a\u00a0namespace.\u00a0It\u00a0does\u00a0not\u00a0allow\u00a0viewing\u00a0roles\u00a0or\u00a0role\u00a0bindings.\u00a0This\u00a0role\u00a0does\u00a0not\u00a0allow\u00a0viewing\u00a0Secrets,\u00a0since\u00a0reading\u00a0the\u00a0contents\u00a0of\u00a0Secrets\u00a0enables\u00a0access\u00a0to\u00a0ServiceAccount\u00a0credentials\u00a0in\u00a0the\u00a0namespace,\u00a0which\u00a0would\u00a0allow\u00a0API\u00a0access\u00a0as\u00a0any\u00a0ServiceAccount\u00a0in\u00a0the\u00a0namespace\u00a0(a\u00a0form\u00a0of\u00a0privilege\u00a0escalation).\u00a0\u00a0Applying\u00a0this\u00a0role\u00a0at\u00a0cluster\u00a0scope\u00a0will\u00a0give\u00a0access\u00a0across\u00a0all\u00a0namespaces.",
    "assignableScopes": [
      "/"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.Authorization/*/read",
          "Microsoft.Resources/subscriptions/operationresults/read",
          "Microsoft.Resources/subscriptions/read",
          "Microsoft.Resources/subscriptions/resourceGroups/read"
        ],
        "notActions": [],
        "dataActions": [
          "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
          "Microsoft.ContainerService/fleets/members/apps/daemonsets/read",
          "Microsoft.ContainerService/fleets/members/apps/deployments/read",
          "Microsoft.ContainerService/fleets/members/apps/replicasets/read",
          "Microsoft.ContainerService/fleets/members/apps/statefulsets/read",
          "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/read",
          "Microsoft.ContainerService/fleets/members/batch/cronjobs/read",
          "Microsoft.ContainerService/fleets/members/batch/jobs/read",
          "Microsoft.ContainerService/fleets/members/configmaps/read",
          "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
          "Microsoft.ContainerService/fleets/members/endpoints/read",
          "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
          "Microsoft.ContainerService/fleets/members/events/read",
          "Microsoft.ContainerService/fleets/members/extensions/daemonsets/read",
          "Microsoft.ContainerService/fleets/members/extensions/deployments/read",
          "Microsoft.ContainerService/fleets/members/extensions/ingresses/read",
          "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/read",
          "Microsoft.ContainerService/fleets/members/extensions/replicasets/read",
          "Microsoft.ContainerService/fleets/members/limitranges/read",
          "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
          "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
          "Microsoft.ContainerService/fleets/members/namespaces/read",
          "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/read",
          "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/read",
          "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/read",
          "Microsoft.ContainerService/fleets/members/pods/read",
          "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/read",
          "Microsoft.ContainerService/fleets/members/replicationcontrollers/read",
          "Microsoft.ContainerService/fleets/members/resourcequotas/read",
          "Microsoft.ContainerService/fleets/members/serviceaccounts/read",
          "Microsoft.ContainerService/fleets/members/services/read"
        ],
        "notDataActions": []
      }
    ],
    "createdOn": "2025-10-24T18:48:33.778Z",
    "updatedOn": "2025-10-24T18:48:33.778Z",
    "createdBy": null,
    "updatedBy": null
  },
  "id": "/providers/Microsoft.Authorization/roleDefinitions/463ad26c-fcce-4469-9c7f-5653d8acbab5",
  "type": "Microsoft.Authorization/roleDefinitions",
  "name": "463ad26c-fcce-4469-9c7f-5653d8acbab5"
}